The latest trends in supply chain cyber risk management at overseas financial institutions

Phase

Recommendations

Security risk assessment: Contractor/service selection phase

• Conduct security risk assessment for target companies and services by gathering and analysing publicly available information. Utilising third-party risk evaluation services might help to streamline the process.

Security risk assessment: Contracting phase

• Assign personnel who are familiar with technical security to the assessment team and conduct assessment based on trending threat scenarios.
• Anticipate the occurrence of incidents and suspected incidents, and stipulate the scope of responsibilities and reporting time limits in a service level agreement (SLA).

Security risk management at subcontractors’

• Conduct on-site visits to subcontractors that handle high-risk systems to review their risk management processes.
• If work is sub-outsourced, demand that the original subcontractors conduct security management for the parties to which work is sub-outsourced (third parties). If work is sub-sub-outsourced etc., require all subsequent parties to implement security on the same level as that which your own company requires.

Software management

• Software configuration management should be conducted thoroughly when new products are implemented, and should be linked with vulnerability management. Also consider the use of software bills of materials (SBOMs).
• Utilise management tools for open source software (OSS) to streamline the selection of such software and identify dependencies.

Hardware management

• Be thorough in asset management, and develop a system to enable firmware to be updated promptly.
• Conduct threat scenario-based security tests.

Reporting to senior management

• In reports regarding security costs, avoid overuse of technical terms, prepare documents using business language and make reports based on the impacts on profits, customer satisfaction, reputation and customer loyalty.
• The optimal solutions regarding the routes for reporting cybersecurity risks to senior management vary from one organisation to another. Therefore, consider risk-based, monetary cost-based, IT-based and other approaches to determine the route best suited to your organisation. When doing so, take measures to ensure there is no conflict of interest between the Chief Information Officer (CIO) and the Chief Information Security Officer (CISO).