BROADCASTS.com

To see all the notes and links for this episode, go here (https://cisoseries.com/defense-in-depth-tools-for-managing-3rd-party-risk/)

Are there any good tools that really help to manage third-party risk? Can tools alone solve this problem? What else is required?

Check out this post and discussion\xa0for the basis of our conversation on this week\u2019s episode co-hosted by me,\xa0David Spark\xa0(@dspark), the creator of\xa0CISO Series\xa0and\xa0Allan Alford\xa0(@AllanAlfordinTX), CISO at\xa0Mitel.\xa0Our guest for this episode is Eric Cowperthwaite, director of information security, Esterline.

Got feedback?\xa0Join the conversation on LinkedIn.

As a professional services company, Praetorian helps enterprise customers solve complex cybersecurity problems. We are the security experts.

• We question if there's some type of pseudo-protection racket going on with auditors offering to increase vendors' security scores if they go into business with them.
• The basic model is to help you identify issues and resolve them in order to reduce your risk and protect yourself from certain types of risk.
• While our risk changes on a daily basis, we're not measuring the risk other 3rd parties may be introducing at the same iteration level. Often it's only annual which doesn't coincide with how we measure our own risk.
• As a result, there's a desire for ongoing real-time assessment of third party risk. CISOs want the depth of an audit combined with real-time monitoring.
• Best of breed approach often introduces new risk at the lines of integration.