登录查看更多内容

How do you vet your software partners for security?

由人工智能和领英社区提供技术支持

Security is a top priority for any enterprise software project, especially when you rely on external partners to provide or integrate solutions. But how do you ensure that your software partners meet your security standards and expectations? In this article, we will share some tips and best practices for vetting your software partners for security, from the initial screening to the ongoing monitoring.

此文章中的业界达人

由社区从 3 条内容中精选。了解更多

William Hall

UNC Health, CISSP, CISM, CPHIMS

1 Define your security requirements

Before you start looking for software partners, you need to have a clear and comprehensive set of security requirements for your project. These should include the security policies, procedures, and practices that you expect your partners to follow, as well as the specific security features and functionalities that you need from their solutions. You should also define the security risks and threats that you want to mitigate or avoid, and the security metrics and indicators that you will use to measure and evaluate your partners' performance.

添加您的观点

2 Assess your partners' security capabilities

Once you have your security requirements, you can use them as a basis for assessing your potential or existing software partners' security capabilities. You can do this by asking them to provide evidence of their security certifications, accreditations, audits, or assessments, such as ISO 27001, SOC 2, or NIST. You can also request them to share their security policies, procedures, and practices, such as how they handle data encryption, backup, recovery, access control, incident response, or vulnerability management. You can also conduct your own security audits or tests on their solutions, such as penetration testing, code review, or configuration analysis.

添加您的观点

William Hall

UNC Health, CISSP, CISM, CPHIMS
举报内容
This statement is highly problematic: “You can also conduct your own security audits or tests on their solutions, such as penetration testing, code review, or configuration analysis.” It would be highly unusual for a potential 3rd party vendor to allow your organization to perform a pentest on them. If you initiate this independently, the Computer Fraud and Abuse Act (amongst other laws) defines this as “criminal hacking”. However, you CAN request a sanitized executive summary of their most recent pentest.

已翻译

赞

3 Negotiate your security agreements

After you have assessed your partners' security capabilities, you can negotiate your security agreements with them. These are the formal contracts or documents that specify the security roles, responsibilities, and expectations of each party, as well as the security standards and guidelines that they will adhere to. You should also include the security clauses and terms that define the security scope, objectives, deliverables, milestones, timelines, costs, and penalties of the project. You should also ensure that your security agreements are aligned with your legal and regulatory obligations, such as GDPR, HIPAA, or PCI DSS.

添加您的观点

William Hall

UNC Health, CISSP, CISM, CPHIMS
举报内容
This is why it is SO important to be part of the conversation BEFORE an internal department signs the contract. Once the contract is executed and the money is spent, it’s a day late and a dollar short to negotiate security. It’s like getting your mechanic to inspect a used car AFTER you buy it and drive it home.

已翻译

赞

4 Monitor your partners' security performance

Once you have signed your security agreements, you need to monitor your partners' security performance throughout the project lifecycle. You can do this by establishing regular communication and reporting channels with them, such as meetings, calls, emails, or dashboards. You should also review and verify their security deliverables and outputs, such as documentation, reports, or logs. You should also track and measure their security metrics and indicators, such as compliance rates, incident rates, or response times. You should also provide feedback and guidance to them on how to improve or maintain their security quality and standards.

添加您的观点

5 Evaluate your partners' security outcomes

At the end of the project or at predetermined intervals, you should evaluate your partners' security outcomes and results. You can do this by comparing their actual security performance with your expected security requirements and goals. You should also identify and analyze the security strengths and weaknesses of their solutions, as well as the security opportunities and challenges for future collaboration. You should also document and share your security findings and recommendations with them, as well as with your internal stakeholders and customers.

添加您的观点

6 Update your security strategy

Finally, you should update your security strategy based on your experience and learning from working with your software partners. You should review and revise your security requirements, capabilities, agreements, performance, and outcomes, and incorporate any changes or improvements that you have discovered or implemented. You should also update your security policies, procedures, and practices, and ensure that they are consistent and compatible with your partners' security standards and guidelines. You should also update your security risk management and mitigation plan, and prepare for any new or emerging security threats or issues.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

William Hall

UNC Health, CISSP, CISM, CPHIMS
举报内容
Software vendors are for-profit companies looking to maximize the return on investment for their shareholders. They are NOT your friend. It is a business transaction in which the less resources they must dedicate to maintenance of the product, the more profitable the transaction is for them. Therefore, your organization must act in its own best interest to properly vet and negotiate deals with software vendors to ensure the best outcomes for our side. It’s nothing personal, it’s business.

已翻译

赞

Enterprise Software

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you vet your software partners for security?

1

2

3

4

5

6

7

1 Define your security requirements

2 Assess your partners' security capabilities

3 Negotiate your security agreements

4 Monitor your partners' security performance

5 Evaluate your partners' security outcomes

6 Update your security strategy

7 Here’s what else to consider

Enterprise Software

给文章评分

感谢您的反馈

更多Enterprise Software相关文章

更多相关阅读内容

How do you vet your software partners for security?

1

2

3

4

5

6

7

1 Define your security requirements

2 Assess your partners' security capabilities

3 Negotiate your security agreements

4 Monitor your partners' security performance

5 Evaluate your partners' security outcomes

6 Update your security strategy

7 Here’s what else to consider

Enterprise Software

给文章评分

感谢您的反馈

查看其他技能