Striving For Supply Chain Security

The video discusses the risks associated with third-party suppliers, emphasizing the importance of transparency, vetting, and risk assessment. It highlights the need for stratifying vendors based on data access rather than financial relationships and critiques the reliance on questionnaires for security evaluations. The video also explores incentives for suppliers, the evolution of supply chain security, and the response to supply chain attacks. It concludes with a discussion on the security of embedded systems and the blurred lines between third-party and supply chain risks.

What is a key challenge when dealing with third-party suppliers?

• Ensuring they have no access to any data

• Avoiding any form of communication with them

• Gaining complete control over their operations

• Balancing control and visibility over shared data

Why is it important to have a risk-based approach when vetting new suppliers?

• To ensure all suppliers have the same financial relationship

• To avoid any form of due diligence

• To focus resources on suppliers with the highest risk

• To ensure all suppliers are treated equally

What is a major limitation of using questionnaires to evaluate supplier security?

• They are not accepted by regulators

• They require too much time to complete

• They often provide inaccurate or unreliable data

• They are too expensive to implement

What is the purpose of the high trust common security framework?

• To eliminate the need for any supplier assessments

• To provide a standardized method for assessing supplier security controls

• To ensure all suppliers have the same level of security

• To replace all existing security frameworks

Why is continuous monitoring important in supplier relationships?

• To ensure suppliers have no access to any data

• To avoid any form of communication with suppliers

• To maintain ongoing engagement and address evolving risks

• To ensure suppliers never change their security practices

How can incentives and disincentives be used in supplier contracts?

• To avoid any form of engagement with suppliers

• To ensure suppliers never report any issues

• To align supplier success with the company's success

• To penalize suppliers for any form of communication

What is a key focus in the evolution of cybersecurity?

• Eliminating all forms of data sharing

• Focusing on basic security practices like patching and access control

• Ensuring all devices have the same default password

• Developing complex and expensive security solutions

What is a significant risk associated with embedded systems in healthcare?

• They are too expensive to maintain

• They often lack secure configurations

• They require constant software updates

• They are not used in critical applications

Why is it important to secure medical devices in hospitals?

• They are rarely used in critical situations

• They often have no impact on patient care

• They can pose significant security risks if not properly configured

• They are always secure by default

What is a potential future focus in cybersecurity according to the transcript?

• Focusing on identity security risks

• Eliminating all forms of data sharing

• Ensuring all devices have the same default password

• Developing more complex security frameworks