Lanware recently held a poll of operational leaders working in UK independent investment managers, asking them to vote for which areas of cyber security they felt needs the most improvement within their business. 50% of them stated that third-party risk management was currently their biggest concern, followed by technical security operations (30%) and employee training and awareness (20%).
This is unsurprising as small investment firms are more likely to use third parties extensively as outsourcing is critical to support operations. Due to their size and scale, invariably they cannot afford in-house expertise and need to focus on their core fund management business.
Adding to their concerns, financial firms must adhere to strict regulations and have effective processes in place to identify, manage, monitor, and report risks associated with outsourcing. They also need to achieve “operational resilience” to ensure the business can withstand the failures of their third-party outsourced providers.
So why is this such a challenge for financial services firms? In Lanware’s view, there are a plethora of reasons including:
Outsourcing in smaller firms
Small investment firms' extensive use of third-party vendors can leave them more vulnerable and exposed.
Growth and complexity
Financial firms rely heavily on technology and data, so with the growth of technology services like cloud and third-party usage, so too have the associated risks and complexities.
Supply chain risks
Cyber criminals are increasingly targeting the trusted suppliers of financial firms as a route into their end targets to gain access to their sensitive data.
Lack of vendor management
Smaller firms tend not to have dedicated “vendor/supplier manager” roles, whose core job is to manage the relationship with suppliers and ensure that any risks are understood and monitored.
Inadequate cyber skills
To properly assess the cyber risks of a third-party supplier, specialist skills are needed. However, it is difficult to assess the risk of a third-party vendor on cyber security controls and processes if you are unfamiliar with the latest threats and technology.
Big vendors servicing small firms
Large technology vendors who are providing services to small financial firms are unlikely to be cooperative when it comes to helping them complete their supplier risk assessments and DDQs.
How to solve these challenges
As a solution to meet these challenges, Lanware’s virtual CISO (vCISO) focused on governance, risk and compliance can perform all the ongoing cyber security risks managed around third-party vendors. This assessment uses an automated tool which contains a library of 1000 different vendors in the financial services sector.
