Amica CISO: 5 Tips to Select a Secure Vendor
April 17, 2016 3:49 PM
Amicas Chief Information Security Officer Gil Bishop doesnt necessarily see third parties as liabilities, but his job is to fully vet the security and privacy capabilities of vendors before forging relationships. Insurers cant simply beef up with firewalls and intrusion detection systems and feel content we've done enough, he explains, offering tips to ensuring sensitive data accessed by third parties is well protected.
Begin With Basic Risk Assessment
Dont limit initial discussions to IT related service, Bishop says. Remember, any vendor remote or network connectivity presents an entry point for an attack. This includes systems that may be overlooked even HVAC or lighting controls can have online management portals.
Trust, but Verify
Bishop says potential vendors are required to provide documentation to Amica showing they have a capable and mature information security program. These include security policies, network infrastructure diagrams, physical and logical access controls and, most importantly, findings reports from any independent information security audits or assessments.
Rely on Independent Audits
The problem with accepting a third-party validation is that the scope of the assessment must include all of the systems and processes which directly or indirectly touch Amica's information, Bishop says. Vendors may provide a valid ISO certification from their hosting provider, indicating their infrastructure is well-protected, but the provider itself may not be up to par with application-level security. An independent, respected agency should review all critical elements.
Visit Vendor Facilities
When an acceptable independent validation report isn't available, site visits, and in-person meetings with the vendor's technical and operational IT security staff are necessary. The goal is to develop a rating on the effectiveness of the vendors information security program. There cant be any doubt that Amicas information is protected, Bishop stresses.
Require Routine Updates From Vendors
It is the vendors responsibility to provide the insurer with current independent certification reports on an annual basis, Bishop says. At minimum, updated security reviews must be conducted whenever a contract is up for renewal. In cases involving high data volume and sensitivity, these periodic refreshes occur more frequently, he notes.