Cyberattacks Are on the Rise: How To Ensure Your Data Is Safe With Third-Party Vendors

The perfect Software-as-a-Service (SaaS) vendor may have the right software, but do they have the right data and information security? Small businesses like yours need to be careful about which vendors they trust to handle their data.

While most vendors are secure and considerate with how they handle customer data, some may not be prepared to fend off major cyberthreats.

With cybercrime on the rise alongside SaaS adoption, businesses must be strategic and diligent about verifying vendor security to avoid a data breach.

In 2021, there was a 105% increase in ransomware attacks around the world, with government-targeted attacks alone surging by 1,885% worldwide. The need for intensive security measures has never been greater.

Cybercriminals are becoming more adept when it comes to who and how they attack. Just as businesses are keeping an eye on trends like SaaS adoption, hackers are, too—and looking for new opportunities to profit from.

The widespread switch to remote work triggered a wave of cybercrime in 2020. Research conducted by INTERPOL found shocking increases in attacks directly connected to the COVID-19 pandemic, which hackers took full advantage of. Phishing attacks surged by 59%, with ransomware and malware close behind with a 36% increase worldwide.

These trends haven't slowed down; cybercrime is only growing more sophisticated and widespread.

Your business can also find itself in serious legal trouble if you fail to address security risks. A prime example of this is a 2019 case that resulted in a loss for the plaintiff specifically due to poor data security, which put critical information at risk.

On the business-to-community (B2C) level, things can get even more complicated due to expanding government regulations regarding data protection. If customers or government officials learn that your business is putting sensitive data at risk, the legal repercussions can be serious, resulting in major fines and a damaging public backlash.

Working with SaaS vendors can often result in better data protection for businesses if they choose a reliable vendor with secure software. To accomplish this, business leaders like you need to be aware of red flags and risks to watch for when researching vendors.

Knowing the potential risks associated with SaaS will help you determine whether or not a vendor knows how to responsibly manage cybersecurity.

1. Phishing

By far the most common security risk associated with SaaS is phishing. Phishing attacks have been on the rise since the COVID-19 pandemic began in 2020. All it takes is one unsuspecting employee clicking on a link or opening an attachment in an infected email and suddenly an entire network could fall victim to ransomware.

When it comes to SaaS, phishing risks appear on a few fronts:

1. The risk of a business experiencing a phishing attack itself.

2. The risk of the vendor experiencing a phishing attack.

3. The risk of another customer of the vendor falling prey to phishing, which could lead to a wider breach on the vendor’s end.

Remember: SaaS is not a vacuum. Any breach of the vendor’s cloud network security can be considered a danger to everyone working with that vendor.

2. Access management

Employees might share the password to a limited-access folder to save time or effort, or send/share data over unsecured channels. They might fail to encrypt sensitive data.

All of these are examples of failed access management, which is a major risk when working with SaaS vendors. Access management can be tricky to keep track of and quick to spiral out of control.

This risk comes down to trust in the vendor. Your business might have diligent, zero-trust access management practices in place. As soon as you begin using cloud-based SaaS programs, though, you are trusting the vendor to also have diligent access management (which might not be the case).

3. Insider breaches

Unfortunately, insider data breaches are among the most dangerous of cyberthreats. Since they are typically more difficult to detect, it is easier for attackers to get inside and steal or damage data undetected, sometimes for months or more. Surveys indicate that 98% of organizations feel vulnerable to insider threats.

Due to the nature of insider threats, it is difficult for businesses to analyze a vendor’s risk in this area. This is where peripheral risks—especially access management—become much more important. A responsible SaaS vendor will have safeguards in place to stop insider threats from endangering customers’ data.

4. Vendor-side disaster

Not all risks are related to cyberattacks. It is entirely possible for a real-world disaster to destroy a vendor’s data. For example, if a vendor’s data storage facility is damaged in a hurricane, that disaster can put customer data at risk if the proper safeguards aren't in place.

Since SaaS is operated over the cloud, business leaders like you need to remember that data stored with vendors is being stored on off-site servers. If those servers aren’t physically protected, secured, and backed up, data could be permanently lost in the event of a vendor-side disaster.

Once you know the risks, you can use a checklist to actively analyze the security measures of your chosen SaaS vendor (or any you're considering). These five items can get you started, but may not cover the unique needs of every SMB.

1. Verify vendor compliance with security regulations

A good place to start in any SaaS vendor security analysis is regulatory compliance. Data protection laws around the world can help ensure that businesses (including SaaS vendors) are using responsible security measures.

By far the most impactful of these laws is the General Data Protection Regulation (GDPR). While this data protection regulation was enacted in the EU, it affects businesses all over the world, including any business that handles the data of EU citizens. This includes many major SaaS vendors. The U.S. doesn’t have policies that rise to the level of GDPR, but other federal and state regulations (such as the California Consumer Privacy Act) apply to many vendors.

Any SaaS vendor that can verify compliance with relevant regulations is a good sign. If they can't or have been non-compliant in the past, look elsewhere.

2. Assess the vendor’s data protection strategy

If a vendor is compliant with data protection regulations, they likely have at least basic minimum data security in place. This may not mean their methods are up to your needs or security standards, though, so it’s always a good idea to thoroughly assess their data protection strategy.

Vendors that care about customers’ data security will be more than happy to demonstrate that they have strong risk mitigation measures in place.

Industry experts suggest using a brief questionnaire to conduct a basic vendor risk assessment. These questions will help dig up any potential red flags, such as poor password management or a lack of backup infrastructure.

3. Confirm the vendor’s disaster recovery plan

Disasters may be rare, but they can be devastating if SaaS vendors aren't prepared. Responsible vendors will have a clear disaster recovery plan.

It's important to note that this plan should address cyberattacks as well as natural disasters. Any loss of data or security on a large scale can be considered a disaster, whether by ransomware or extreme weather.

A disaster recovery plan will outline the vendor’s strategies for recovering compromised data, the backup data storage they have in place, and their strategy for dealing with hostile players and disaster.

4. Analyze any third-party risks

One of the top SaaS security risks is inadequate third-party risk management. This ties back to trust and access management. Control of who can access and grant third-party permissions is a key part of access management.

SaaS vendors may want permission to share your business’ data with a third party as well, which may not be acceptable for some business leaders.

Any and all third-party connections need to be closely analyzed as well as the methods a vendor has in place for granting third-party access permissions.

5. Conduct internal cloud security training

One of the most important parts of any security strategy is employee security training. 2021 studies found that 85% of data breaches were due to some human element, such as clicking a link in a malicious email.

With proper training, your employees can learn to recognize threats like these, significantly reducing cyberattack success rates.

Business leaders should keep in mind that a good security training program is important for all parties involved, including the SaaS vendor as well as your own internal team. Internal employees should be aware of what data they share with a SaaS vendor and how to protect it on their end.

Similarly, SaaS vendors’ employees should be trained to handle customer data responsibly and pay careful attention to things like access management and vendor-side encryption.

While it can seem stressful and complicated to manage data security at first, it is often a matter of verifying best practices on all sides.

There are many threats small businesses like yours should be aware of, such as ransomware, phishing, and internal vulnerabilities. Be sure to put in the initial effort to ensure your employees, vendors, and systems are up-to-date, responsible, and trustworthy.Are you interested in becoming a guest writer for GetApp? Reach out to guestcontributors@gartner.com for details.