NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

@NTXISSA#NTXISSACSC4

MitigatingSecurityRisksinVendorAgreements

BrianKirkpatrick,JD,MA(Econ),C|CISO,C|EHPresidentandTechnologyAttorney

KirkpatrickLawPCOctober2016

Thispresentationisaboutlegalissues,butisnotlegaladvice.Anattorneyshouldbeconsultedforadviceregardingyourindividualsituation.

AnswerstoCommonQuestions

Wearesecurityprofessionals,notlawyers.

Whyshouldthecontractsbeourproblem?

NTXISSACyberSecurityConference– October7-8,2016 2

Securityiseveryone’sproblemandresponsibility

Weareshortstaffed,budgetconstrained,andhavetoomuchworkalready.

WhyshouldIdothelegaldepartment’sjobtoo?

ImproveVendorAgreements

PreventBigProblems

SecurityOrganizationisintheBestPositiontoIdentifyTechnicalRisks

What’sinitforme?

BuildTrustwithyourPartners

ImprovetheLegal/SecurityRelationship

TopSecurityIssues

Top5issuestoreview:

1. Vendor’sInformationSecurityProgram2. SecurityStandards3. DataBreachInsurance4. SecurityAudits5. InformationSecurityWarranty

Vendor’sInformationSecurityProgram

Weneedtounderstandhowthevendoriscurrentlyprotectingitscustomer’s

information.

• Thevendorshouldactuallyhaveaninformationsecurityprogram.

• Theinformationsecurityprogramshouldbeattachedtotheagreement.

• Theagreementshouldincludeawarrantytocomplywiththeattachedprogram.

Samplebasiclanguage:

VendorwarrantsthatitwillatalltimescomplywiththeInformationSecurityProgramattachedasExhibitA.

SecurityStandards

• Thesecuritystandardsshouldbeidentified.

• Who’sstandardsmatter?

• Whatstandardsapply?

SecurityStandards

• Askthevendorwhatsecuritystandardsitusestoprotectitsclient’sinformation.

• The“Industrystandard”isvague.

• Determinewhatstandardsarerequiredbyyourindustry.PCI-DSS,HIPAA,GLBA,etc.

• Findthestandardsnamedintheagreement.

SecurityStandards

Vendorwillperforminaccordancewiththesecuritystandardsastheyapplytothehealthcareindustry.Specifically,VendorwillcomplywithHIPAA.

DataBreachInsurance

IfaCustomer’sdataislost,stolenormisused,howwilltheVendorcompensate

theCustomer?

DataBreachInsurance

• Isthevendorinsuredwiththeappropriatecoveragetypes?• Isthevendorinsuredattheappropriateamounts?• Aretheinsurancerequirementsillustratedintheagreement?• Isyourbusinessnamedasabeneficiary?

DataBreachInsurance

• Samplebasiclanguage:

Duringthetermofthisagreementandfor3yearsthereafter,Vendorshallmaintainaminimumof$500,000ofdatabreachinsurance,nameCustomerasthebeneficiary,andprovideCustomerwithaCertificateofInsurancewithin10daysofexecutingtheagreement.

SecurityAudits

Customer’sneedamechanismtoverifythattheVendorisprovidingthesecuritycontrolsthatitpromised.

SecurityAudits

3waystoaudit:

1. Customerentersthephysicalpremisestoauditthecontrolsdirectly.

2. Vendorobtainsa3rd partyaudit(SSAE16)andprovidestoCustomer.

3. VendorprovidesCustomerwithasignedself-attestationofcompliance.

SecurityAudits

Nolessthanannually,Vendorwillretainathird-partycertifiedpublicaccountingfirmtoperformaSSAE16auditofsecuritymeasuresandprovidethereporttoCustomerpromptlyafterreceipt.

InformationSecurityWarranty

Servicesthatincludeinformationsecuritycontrolsanddataprotectionsafeguardsshouldincludeawarrantytoprotectthe

Customeragainstaloss.

• Usually,allwarrantiesaredisclaimedunlessspecificallystated.

• Awarrantyshouldbeincludedregarding:1. Compliancewiththesecurityprogram2. Performanceinaccordancewiththestandards3. Conductingsecurityaudits4. Maintainingappropriateinsurancecoverage

VendorwarrantsthatitwillabidebythesecurityprograminExhibitA,performtheservicesinaccordancewiththe[applicablelawsandstandards],maintaininsuranceasdescribedinthisagreement,andconductanannual3rd partyauditofthesecuritycontrols.

Summary

• Everyindustryhasdifferentrisks.

• Vendorcontractsareyourinitialsourcesforlegalandtechnicalinformationprotection.

• LegalandSecurityorganizationsshouldformatightalliance.

@NTXISSA#NTXISSACSC4@NTXISSA#NTXISSACSC4

The Collin College Engineering DepartmentCollin College StudentChapteroftheNorthTexasISSA

NorthTexasISSA(InformationSystemsSecurityAssociation)

Thankyou

NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

Internet

Transcript of NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

Mitigating Successor Trustee Liability for Prior Fiduciary ...media.straffordpub.com/products/mitigating-successor-trustee... · Mitigating Successor Trustee Liability for Prior Fiduciary

6J Mitigating Circumstances including Extensions: Policy ... · 1 6J – Mitigating Circumstances including Extensions: Policy and ... 2 6J – Mitigating Circumstances including

Mitigating Risk

Mitigating Attacks - Arbor

Mitigating BC

GUIDES TRANSFER PRICING - internationaltaxreview.com · Pricing Agreements’ (APAs) as a means of mitigating TP risk. Penal-ties relating to transfer pricing are also increasing

Mitigating Microplastics Curriculum

NTXISSACSC4 - Detecting and Catching the Bad Guys Using Deception

Mitigating Bubbles

Mitigating Bubbles & Crises

Mitigating worm attacks

NTXISSACSC4 - A Day in the Life of a CISO

Mitigating and SRAT

NTXISSACSC4 - The Art of Evading Anti-Virus

NTXISSACSC4 - Layered Security / Defense in Depth

NTXISSACSC4 - Artifacts Are for Archaeologists: Why Hunting Malware Isn't Enough

Mitigating Climate Change

Mitigating the clicker

Mitigating Payment Fraud

Mitigating Circumstances