The CrowdStrike Incident and Nth Party Risk Management

Written by: Richard Frykberg

The Global Meltdown of 19 July 2024

On Friday July 19th, 2024, IT systems across the world suffered a spectacular meltdown. From airlines and banks to Mom-and-Pop corner stores. Travelers, businesses, and consumers were all impacted, not by some malicious hacking attempt or cyberwarfare attack, but by a simple human error caused by a lack of due diligence.

Nth Party Risk: The CrowdStrike Incident 

The CrowdStrike incident will sound like a loud clarion call for executives everywhere to urgently evaluate their nth party risk and business continuity plans. Ironically, CrowdStrike serves to mitigate the risk of cyberattack and is employed by many Fortune 500 companies as a critical tool to maintain information security.

Understanding Nth Party Risk Management

CrowdStrike products are deeply embedded in the Windows operating system for maximum effectiveness. So, when an innocuous update caused computers to crash, and fail to successfully reboot, the impact around the world was devastating.

Importantly, it was not just CrowdStrike’s customers who were impacted. For many organizations, this dependency was deep for many vendor-relationships. Most organizations conduct vendor risk assessments before engagement.

Occasionally, the evaluation of vendor risk isn’t thorough enough. The danger to you isn’t solely based on the efficiency and dependability of your direct suppliers, but also their suppliers, and so on. Essentially, this is what is referred to as Nth Party risk. The diagram below outlines Nth Party Risk Management:

Vendor Risk Management: Ensuring Robust Security Measures

It is crucial for organizations to ensure that their IT suppliers have effective cloud workload protection and endpoint security measures in place. This is essential to effectively protect sensitive data and prevent cyber-attacks. One way to enhance security measures is by ensuring that not only your suppliers, but also their suppliers, have implemented top-notch security solutions such as those offered by CrowdStrike.

The CrowdStrike incident serves as a prime example of why considering Nth Party Risk is important. This incident highlights the interconnected nature of modern business relationships and the nth party risks that come with relying on multiple layers of suppliers.

By proactively addressing nth party risk management and ensuring that all parties involved in the supply chain have robust security measures in place, businesses can better protect themselves from potential cyber threats and data breaches. Investing in trusted security solutions like CrowdStrike can provide peace of mind and help mitigate the risks associated with third-party suppliers.

The Importance of SOC Reports in Risk Assessment

Identifying all your fourth party risks is onerous enough. Attempting to assess all nth party risks, which by the power of geometric progression may be enormous, is practically impossible.

Which comes back to primary vendor risk management. You need to be confident that your suppliers have themselves adopted rigorous vendor risk management processes. You need to make sure that their security posture is independently certified.

2 SOC Reports for Managing Nth Party Risk

The following two SOC reports provide independently certified security risk assessment:

1. Type 1 SOC Reports attest that an organization has appropriate cybersecurity risk management controls in place on the date of issue.
2. Type 2 SOC Reports address the effectiveness of those controls over the reporting period. Many organizations request that new vendors provide SOC 2 reports on upfront engagement. However, many do not have an effective mechanism for tracking the expiry and renewal of those certifications.

Vendor business continuity risk may have been assessed at the time of initial engagement. But is that assessment being consistently performed and regularly reassessed?

How IQX Vendor Portal Mitigates Nth Party Risk

Successful capital expenditure management is crucial for the financial health and growth of any business. At IQX Business Solutions, we understand that one of the key factors in achieving success in this area is selecting the right business partners.

Our Vendor Portal solution is designed to help you make informed decisions when choosing suppliers, thereby reducing the risk associated with third-party relationships. By asking the right questions of your suppliers and continuously monitoring their certification requirements, you can ensure that they meet your standards for quality, reliability, and compliance.

With our Vendor Portal solution, you can streamline the vendor selection process, improve transparency and communication with suppliers, and ultimately, enhance the overall efficiency and effectiveness of your capital expenditure management. By leveraging our technology and expertise, you can make smarter decisions, minimize risks, and drive better outcomes for your business.