CISSP Crash Course - Supply Chain Risk

The video discusses supply chain risk in system building, highlighting the reliance on third-party components and the potential vulnerabilities they introduce. It emphasizes the importance of monitoring, zero trust, and setting security requirements to mitigate risks. The video also covers service level agreements and the need for thorough risk assessments to ensure application security.

What is a key factor that contributes to supply chain risk?

• Having a small team

• Using outdated software

• Relying on third-party technologies

• Building all components in-house

Which of the following is a potential access point for a malicious actor in a supply chain?

• A company newsletter

• A third-party software component

• A secure data center

• An internal memo

What approach should organizations take to minimize trust in third-party components?

• Full trust approach

• Zero trust approach

• Partial trust approach

• Blind trust approach

Why is it important to conduct assessments of third-party suppliers?

• To improve their marketing strategies

• To reduce costs

• To ensure they are not taking security lightly

• To increase their workload

What is a service level agreement (SLA)?

• A contract for purchasing hardware

• A marketing strategy document

• A statement of service expectations and performance

• A guideline for software development

What is the purpose of setting minimum security requirements for third-party providers?

• To increase their operational costs

• To enhance their brand image

• To ensure they meet the organization's security standards

• To limit their market reach

How can organizations ensure that their service providers maintain agreed-upon service levels?

• By ignoring performance metrics

• By offering incentives

• By conducting regular audits

• By reducing service fees