Cybersecurity and third-party risk: third party threat hunting

Title Page
Introduction
	Who Will Benefit Most from This Book
	Special Features
Chapter 1: What Is the Risk?
	The SolarWinds Supply‐Chain Attack
	The VGCA Supply‐Chain Attack
	The Zyxel Backdoor Attack
	Other Supply‐Chain Attacks
	Problem Scope
	Compliance Does Not Equal Security
	Third‐Party Breach Examples
	Conclusion
Chapter 2: Cybersecurity Basics
	Cybersecurity Basics for Third‐Party Risk
	Cybersecurity Frameworks
	Due Care and Due Diligence
	Cybercrime and Cybersecurity
	Conclusion
Chapter 3: What the COVID‐19 Pandemic Did to Cybersecurity and Third‐Party Risk
	The Pandemic Shutdown
	SolarWinds Attack Update
	Conclusion
Chapter 4: Third‐Party Risk Management
	Third‐Party Risk Management Frameworks
	The Cybersecurity and Third‐Party Risk Program Management
	Kristina Conglomerate (KC) Enterprises
	Conclusion
Chapter 5: Onboarding Due Diligence
	Intake
	Cybersecurity Third‐Party Intake
	Conclusion
Chapter 6: Ongoing Due Diligence
	Low‐Risk Vendor Ongoing Due Diligence
	Moderate‐Risk Vendor Ongoing Due Diligence
	High‐Risk Vendor Ongoing Due Diligence
	“Too Big to Care”
	A Note on Phishing
	Intake and Ongoing Cybersecurity Personnel
	Ransomware: A History and Future
	Conclusion
Chapter 7: On‐site Due Diligence
	On‐site Security Assessment
	On‐site Due Diligence and the Intake Process
	Conclusion
Chapter 8: Continuous Monitoring
	What Is Continuous Monitoring?
	Enhanced Continuous Monitoring
	Third‐Party Breaches and the Incident Process
	Conclusion
Chapter 9: Offboarding
	Access to Systems, Data, and Facilities
	Conclusion
Chapter 10: Securing the Cloud
	Why Is the Cloud So Risky?
	Conclusion
Chapter 11: Cybersecurity and Legal Protections
	Legal Terms and Protections
	Cybersecurity Terms and Conditions
	Conclusion
Chapter 12: Software Due Diligence
	The Secure Software Development Lifecycle
	On‐Premises Software
	Cloud Software
	Open Web Application Security Project Explained
	Open Source Software
	Mobile Software
	Conclusion
Chapter 13: Network Due Diligence
	Third‐Party Connections
	Zero Trust for Third Parties
	Conclusion
Chapter 14: Offshore Third‐Party Cybersecurity Risk
	Onboarding Offshore Vendors
	Country Risk
	KC's Country Risk
	Conclusion
Chapter 15: Transform to Predictive
	The Data
	Level Set
	A Mature to Predictive Approach
	The Predictive Approach at KC Enterprises
	Conclusion
Chapter 16: Conclusion
Index
Copyright
Dedication
(ISC)2®
About the Author
About the Technical Editor
Acknowledgments
Foreword
End User License Agreement