A company's cybersecurity defences may be robust, but a single weak link among its external vendors could be enough to expose it to serious risks.
As Malaysian businesses increasingly rely on cloud providers, software vendors and other third-party service providers to manage critical operations and sensitive information, cybersecurity risks are no longer confined to their own systems.
BDO Malaysia executive director for cybersecurity and privacy Keshvin Singh says organisations must reconcile that their cybersecurity is only as strong as the third parties connected to them.
A security weakness involving a critical vendor could expose businesses to operational disruptions, regulatory consequences, financial losses and reputational damage, he says.
However, Keshvin notes that third-party cybersecurity risks often arise not from a single security failure, but from gaps in how organisations assess and manage their vendors.
For instance, vendors may be brought on board quickly to meet urgent business needs, with cybersecurity checks treated as little more than a compliance exercise.
"Assessments may rely heavily on self-declared questionnaires without sufficient validation or supporting evidence," he says.
Keshvin adds that contracts may also lack enforceable cybersecurity requirements, while oversight often diminishes once vendors begin providing their services.
This becomes particularly concerning as vendors may subsequently introduce new technologies, engage subcontractors or expand their access to an organisation's systems without undergoing fresh risk assessments.
He cites the example of a company adopting a Software-as-a-Service (SaaS) platform to improve productivity.
While the platform may be approved quickly, insufficient attention may be paid to where its data is processed, who can access it, how customer information is stored or whether subcontractors are involved.
What begins as a convenient business solution could eventually become a cybersecurity, privacy and regulatory concern, he cautions.
Another potential blind spot involves SaaS providers that rely on major cloud service providers to host their applications.
Businesses may mistakenly assume that security certifications held by the underlying cloud provider also guarantee the security of the application itself, says Keshvin.
However, he cautions that such certifications may cover only the cloud infrastructure, rather than the SaaS provider’s application security, access controls, software development practices or handling of customer data.
This distinction, he adds, could create a false sense of security.
To address these vulnerabilities, Keshvin says organisations must move beyond relying on vendor checklists and periodic assessments.
Instead, they should treat third-party cybersecurity as an enterprise-wide governance responsibility.
Currently, accountability is often fragmented across procurement, information technology, cybersecurity, legal and compliance departments, leaving no single party with a complete picture of the organisation’s exposure.
Clear responsibilities should therefore be established, including identifying who has the authority to approve, reject, suspend or terminate relationships with high-risk vendors.
However, he stresses that not every external supplier requires the same level of scrutiny.
A stationery supplier, for example, would not pose the same cybersecurity risk as a cloud provider hosting sensitive business information or a managed security provider monitoring critical systems.
Organisation should therefore prioritise vendors according to their access to sensitive data, critical systems and essential business operations.
Keshvin also calls for cybersecurity requirements to be incorporated into vendor contracts, covering areas such as data protection, incident reporting, access controls, audit rights and business continuity.
More importantly, he says, oversight must continue throughout the business relationship rather than ending once a vendor has been approved.
This could involve regular reassessments, reviewing security reports and evaluating risks whenever vendors introduce significant changes to their operations.
Critical vendors should also be included in organisations’ incident response and recovery exercises to ensure that responsibilities are understood before a disruption occurs, he adds.
