Tuesday, 13 February 2018

SERM - The Domino Effect

Credit Stock Photo

I have two little monsters and like the little monsters they are, they love the whole Disney Pixar thing. One edition of Disney Pixar that we have watched maybe a little over what feels like one or two million times is Robots. For anyone who knows the story behind the film, they will be familiar with the dominoes scene which marks the triumphant return of Bigweld – the company’s missing boss and hero to the main character – Rodney Copperbottom. For those who are not familiar, Rodney causes the crash of hundreds of billions of dominoes by just toppling one. This domino effect, which starts innocently enough, can lead to disastrous effects.


Let’s exchange the Pixar setting for your organisation. Think of your organisation as the last domino, the biggest in the chain, centred in a large circle of a long list of “supplier” dominoes. Would a breach that affects, spreads and ultimatley topples a supplier have disastrous effects for you? The real impact of toppling a supplier is ultimately unknown, unless your organisation has taken steps to adequately asses the risks suppliers present. This process is known as Supplier Evaluation and Risk Management or SERM.


Let’s break SERM down;
  • Supplier Evaluation is;

    • Gathering information on the suppliers we have. First and foremost, we need to determine how many suppliers we have! Many organisations have only a rough head count of suppliers, Supplier Evaluation will give organisations a firm grip on the actual size of their supplier domino chain! From identifying the length of the domino chain, we will be able to accurately gauge the level of risk they present to the organisation.
    • Identifying what these suppliers do.  The risks a supplier presents to an organisation is largely dependent on what that supplier does for the organisation. A supplier that provides office furniture, can be viewed as much less risky than one that provides data analytic services. In the case of the office furniture supplier, an assessment can be considered complete once it’s determined that they pose little risk to the information security of the organisation. Whereas for the data analytics provider, it’s necessary to dig a little deeper and get to the crux of the risk they pose to the business.

    • Assessing how good a supplier is at Security is the deeper digging. This assessment can be conducted via a combination of the following activities,

      • Requesting that the supplier respond to a broad set of short yes or no questions about the security controls they have in place.
      • Requiring evidence (where necessary) that demonstrates that the controls they attest to; are indeed in place.
      • Benchmark the configuration of their estate, highlighting missing patches, outdated OS and Common Vulnerabilities and Exposures (CVE).
  • Risk Management
    After completing the evaluation, we have a clearer view of how dominoes in the chain may fall. Now, we need to weigh the impact of their fall. This helps an organisation determine the risk each vulnerable domino exposes them to. Would the risk be minor, maybe effecting a gentle shake upon our domino or will it be a major, earth shattering crash, that would tumble our organisation completely?
    We can determine the size of the supplier domino by;

    • The supplier’s risk score, based on the Supplier Evaluation.
    • Their impact on our organisation's short and long-term goals and objectives. Imagine we are an organisation that delivers Online Training. As an Online Trainer, we have an online meeting supplier - which we use daily to deliver webinars to our customers across the globe. Our online meeting supplier is hit by a cyber-attack and topples. Unless an alternative can be used, this will result in our inability to deliver Training.... Such an event would be disastrous to our customers and therefore our brand and our organisation, even though we have not been directly hit by the cyber-attack ourselves, our domino has fallen.

We must, at this point have the understanding that SERM is a multiphase process. To adequately measure the risk posed by our suppliers, we need to;
  1. Distribute surveys to all suppliers
  2. Gather those response
  3. Analyse and assess the responses
  4. Distribute follow up surveys if required
  5. Gather those responses
  6. Gauge the level of risk posed by those suppliers
  7. Implement safeguards or take necessary steps to remove or mitigate individual supplier risk.

Take a moment to consider how arduous this process could potentially be. The length of the supplier domino chain could be miles! This doesn’t just depend on the size of your organisation, even the smallest of organisations could have many suppliers. The length of the domino chain largely depends on the nature of the business.

If you apply the manual approach of SERM, which traditionally includes delivering excel based or telephone call questionnaires to all of your suppliers, will not only incur exponential costs in terms of man hours and material costs, but think about the level of expertise your team will need to have. What if you have a supplier that is not the most, let us say, “responsive”. Your SERM team will need to spend the extra time in chasing down supplier responses to capture an adequate Supplier Risk picture. Cast your eyes back to the sheer number of phases SERM has, the manual approach is usually a lengthy, laborious and error-prone process.

Yes, you will have a process in place, but is it effective? Can you adequately perform a comprehensive examination of your suppliers? To the point where you can identify the risks within your supplier domino chain and track remediation efforts? As the saying goes, do it nice or do it twice. For these reasons, among others - automation is a must.

The NotPetya outbreak which dominated the news last year is a case study that underpins the benefits of SERM. Perhaps..... If the clients of MeDoc had an automated SERM process in place, they would have been able to adequately weigh the risk MeDoc posed as their supplier. This could have resulted in the prevention or at least mitigation of the outbreak we saw spread throughout the Ukraine way back in June. Automated SERM would have highlighted the insecurities in the supply chain by automatically distributing surveys, allowing for real time status of surveys as well as providing automated reminders sent to those suppliers who have not completed the survey in a given timescale. Upon survey completion, automated SERM allows for immediate report provision which eliminates gap between time survey submissions and risk visibility.

Allowing the clients of MeDoc to weigh the risk to them would give them the choice of whether to keep trusting MeDoc as their supplier. For those conspiracy theorists out there, who will say to me “ah yes but the NotPetya attack was not about Cyber”. Firstly, I agree! There is indeed evidence that suggests NotPetya was more than just Cyber-Attack. Secondly and most importantly, what about Equifax? Or Uber? Or ? Almost all damages associated with breaches could have been severely mitigated or at least prevented if automated SERM were to be in place. By highlighting the risks to the business 3rd party suppliers pose and ascertaining exactly what those risks mean will ultimately allow the decisions to be made to prevent our domino from tumbling. 

Now, impressive as it may seem, we have come a long way without a mention of the feared EU GDPR, but... we would be neglectful to not discuss the requirements of SERM under EU GDPR. Article 4 defines the role of the data controller as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data...” In the context of a SERM project, your organisation would be considered as the data controller. The suppliers you evaluate will fall under the role of data processor, who would be “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.” 


Between you and your supplier, right from the very beginning of your working relationship, there must be a clear understanding on what Personally Identifiable Information (PII) each party will be processing. This must include the metrics used to gauge how sensitive it is. Classification of sensitive data (e.g. gender and marital status etc.) should be clearly defined so when SERM is applied, we will have an accurate, clear picture of what risk they present to the business should a supplier be breached.
As we have alluded to, the primary purpose of SERM is to survey your suppliers and gauge the level of a risk (how big of a domino) they pose to your business. Automated SERM surveys will enable your organisation to ascertain the level of protection your suppliers currently have in place and provide you with a clear risk picture of your supplier chain. If the level of risk is not acceptable by your organisation, it may be that you may need to call a cease to your business relationship with that supplier, effectively removing them from the chain of dominoes to prevent yours from falling.
Without doubt, the absolute best way to acquire an accurate risk picture of your supplier chain is through using automated SERM. ZeroDayLab would be pleased to demo our automated SERM process, please contact us for more information.

What we know is a drop, what we don’t know is an ocean
Isaac Newton

80 comments:

  1. Very good info. Lucky me I discovered your blog by chance (stumbleupon). I have saved as a favorite for later!
    Techno

    ReplyDelete
  2. Best Corporate Video Production Company in Bangalore and top Explainer Video Company in Bangalore , 3d, 2d Animation Video Makers in Chennai.

    Thank you for your informative post!!!

    ReplyDelete
  3. Such a very useful article. Very interesting to read this article. I would like to thank you for the efforts you had made for writing this awesome article.
    Data Science Course in Pune
    Data Science Training in Pune

    ReplyDelete
  4. Nice blog. I finally found great post here Very interesting to read this article and very pleased to find this site. Great work!
    Data Science Training in Pune
    Data Science Course in Pune

    ReplyDelete
  5. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
    Data Analytics Course in Pune
    Data Analytics Training in Pune

    ReplyDelete
  6. Thumbs up guys your doing a really good job. It is the intent to provide valuable information and best practices, including an understanding of the regulatory process.
    Cyber Security Course in Bangalore

    ReplyDelete
  7. Very nice blog and articles. I am really very happy to visit your blog. Now I am found which I actually want. I check your blog everyday and try to learn something from your blog. Thank you and waiting for your new post.
    Cyber Security Training in Bangalore

    ReplyDelete
  8. I am impressed by the information that you have on this blog. Thanks for Sharing
    Ethical Hacking in Bangalore

    ReplyDelete
  9. After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article.
    Ethical Hacking Course in Bangalore

    ReplyDelete
  10. Wow! Such an amazing and helpful post this is. I really really love it. I hope that you continue to do your work like this in the future also.
    Ethical Hacking Training in Bangalore

    ReplyDelete
  11. Hi buddies, it is great written piece entirely defined, continue the good work constantly.

    Data Science Course

    ReplyDelete
  12. It is extremely nice to see the greatest details presented in an easy and understanding manner.

    Data Science Training

    ReplyDelete
  13. I wanted to thank you for this great read!! I definitely enjoying every little bit of it I have you bookmarked to check out new stuff you post.

    Data Science Courses

    ReplyDelete
  14. I'm hoping you keep writing like this. I love how careful and in depth you go on this topic. Keep up the great work

    Data Science Certification

    ReplyDelete
  15. Very interesting blog. Many blogs I see these days do not really provide anything that attracts others, but believe me the way you interact is literally awesome.You can also check my articles as well.

    Security Guard License
    Ontario Security License
    Security License Ontario
    Security License

    Thank you..

    ReplyDelete
  16. I have to search sites with relevant information ,This is a
    wonderful blog,These type of blog keeps the users interest in
    the website, i am impressed. thank you.
    Data Science Course in Bangalore

    ReplyDelete
  17. I have to search sites with relevant information ,This is a
    wonderful blog,These type of blog keeps the users interest in
    the website, i am impressed. thank you.
    Data Science Training in Bangalore

    ReplyDelete
  18. I like this post and there is obviously a lot to know about this. I think you made some good points in Features also i figure that they having a great time to peruse this post. They might take a decent site to make an information, thanks for sharing it to me Keep working, great job!
    Braces in Bangalore

    ReplyDelete
  19. wonderful article contains lot of valuable information. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    This article resolved my all queries.good luck an best wishes to the team members.continue posting.learn digital marketing use these following link
    Digital Marketing Course in Chennai

    ReplyDelete
  20. Excellent blog with very impressive content found very unique and useful thanks for sharing,
    Invisalign in Bangalore

    ReplyDelete
  21. Actually I read it yesterday I looked at most of your posts but I had some ideas about it . This article is probably where I got the most useful information for my research and today I wanted to read it again because it is so well written.
    Data Science Course in Bangalore

    ReplyDelete
  22. Fantastic blog extremely good well enjoyed with the incredible informative content which surely activates the learners to gain the enough knowledge. Which in turn makes the readers to explore themselves and involve deeply in to the subject. Wish you to dispatch the similar content successively in future as well.

    Data Science certification in Raipur

    ReplyDelete
  23. Truly incredible blog found to be very impressive due to which the learners who ever go through it will try to explore themselves with the content to develop the skills to an extreme level. Eventually, thanking the blogger to come up with such an phenomenal content. Hope you arrive with the similar content in future as well.

    Digital Marketing Course in Raipur

    ReplyDelete
  24. Terrific post thoroughly enjoyed reading the blog and more over found to be the tremendous one. In fact, educating the participants with it's amazing content. Hope you share the similar content consecutively.

    Data Analytics online course

    ReplyDelete
  25. Highly appreciable regarding the uniqueness of the content. This perhaps makes the readers feels excited to get stick to the subject. Certainly, the learners would thank the blogger to come up with the innovative content which keeps the readers to be up to date to stand by the competition. Once again nice blog keep it up and keep sharing the content as always.

    Data Science Course in Bhilai

    ReplyDelete
  26. Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such an amazing content for all the curious readers who are very keen of being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in future too.

    Digital Marketing Course

    ReplyDelete
  27. Terrific post thoroughly enjoyed reading the blog and more over found to be the tremendous one. In fact, educating the participants with it's amazing content. Hope you share the similar content consecutively.

    Data Analytics training in bhilai

    ReplyDelete
  28. Thank you for sharing such nice content so keep posting.
    microsoft solitaire online

    ReplyDelete
  29. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    data science training in bangalore

    ReplyDelete
  30. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data science course bangalore

    ReplyDelete
  31. I Want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging endeavors.
    cyber security course in bangalore

    ReplyDelete
  32. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    data scientist course in bangalore

    ReplyDelete
  33. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data science in bangalore

    ReplyDelete
  34. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    best data science courses in bangalore

    ReplyDelete
  35. Excellent Blog! I would like to thank for the efforts you have made in writing this post. I am hoping the same best work from you in the future as well. I wanted to thank you for this websites! Thanks for sharing. Great websites!
    Data Science Training in Bangalore

    ReplyDelete
  36. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    data scientist course in bangalore

    ReplyDelete
  37. I Want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging endeavors.
    data science institute in bangalore

    ReplyDelete
  38. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  39. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    cyber security training in bangalore

    ReplyDelete
  40. Great post i must say and thanks for the information. Education is definitely a sticky subject. However, is still among the leading topics of our time. I appreciate your post and look forward to more.
    Data Science Course in Bangalore

    ReplyDelete
  41. Thanks for posting the best information and the blog is very helpful.data science institutes in hyderabad

    ReplyDelete
  42. เราคือผู้นำด้านเกมพนันออนไลน์ Major168 เราคือผู้ให้บริการ คาสิโนออนไลน์ ที่ได้รับรองว่าดีที่สุดในประเทศไทย มีค่ายเกมส์ให้เล่นมากมาย Sagaming, Sexy bacarat, Dreamgame, Ebet, Wm casino, Vivo gaming ไม่ผ่านเอเย่นต์ ระบบปลอดภัยมีทีมงานดูแลตลอด 24ชม.

    SAGAME88 แหล่งรวมเกมส์พนันออนไลน์ คาสิโนสด บาคาร่า กำถั่ว คาสิโนออนไลน์ ไฮโล รูเล็ต รับเครดิตฟรีเล่นได้ทุกเกมส์ โบนัสสมาชิกใหม่เพียบ พร้อมระบบฝากถอนออโต้ 10วิ เรามีทุกค่ายเกมส์ให้คุณเลือกเดิมพัน SA Game Sexy bacarat Dreamgame WM Casino VIVO Gaming Ebet เล่นได้ทุกเกมส์

    Our website ufabet provides betting services in the system of Auto Deposit-Withdrawal. Our members are not only in Thailand. Online football betting UEFA Bet market And this makes a guarantee that Ufabet168 is another reliable football betting website

    ufa through the website UFABET1688 a web gambling online , one that integrated all the bets from online casinos , online casino , online , and also have a game a lot more to be chosen to play such games.

    ReplyDelete
  43. This is an excellent post . thanks for sharing it. It is really what I wanted to see. I hope in the future you will continue to share such an excellent post.

    digital marketing courses in hyderabad with placement

    ReplyDelete
  44. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Training in Chennai

    ReplyDelete
  45. i am glad to discover this page : i have to thank you for the time i spent on this especially great reading !! i really liked each part and also bookmarked you for new information on your site.
    artificial intelligence training in chennai

    ReplyDelete
  46. Terrific post thoroughly enjoyed reading the blog and more over found to be the tremendous one. In fact, educating the participants with it's amazing content. Hope you share the similar content consecutively.

    data science course in varanasi

    ReplyDelete
  47. I want to leave a little comment to support and wish you the best of luck.we wish you the best of luck in all your blogging enedevors.
    data science training in chennai

    ReplyDelete
  48. I am glad to discover this page. I have to thank you for the time I spent on this especially great reading !! I really liked each part and also bookmarked you for new information on your site.
    Data Science Course Syllabus

    ReplyDelete
  49. Thank you for sharing this nice blog Dentist Delhi & best implantologist in delhi. Dr. M. Jetley is a reputed dental surgeon. Some of his services in dental implants include titanium screw replacing for braces for the missing teeth, endosteal implants,etc.

    ReplyDelete
  50. Impressive blog to be honest definitely this post will inspire many more upcoming aspirants. Eventually, this makes the participants to experience and innovate themselves through knowledge wise by visiting this kind of a blog. Once again excellent job keep inspiring with your cool stuff.

    Data Science Training in Bhilai

    ReplyDelete
  51. Wonderful blog found to be very impressive to come across such an awesome blog. I should really appreciate the blogger for the efforts they have put in to develop such an amazing content for all the curious readers who are very keen of being updated across every corner. Ultimately, this is an awesome experience for the readers. Anyways, thanks a lot and keep sharing the content in future too.

    Data Science Course in Bhilai

    ReplyDelete
  52. toptan iç giyim tercih etmenizin sebebi kaliteyi ucuza satın alabilmektir. Ürünler yine orjinaldir ve size sorun yaşatmaz. Yine de bilinen tekstil markalarını tercih etmelisiniz.

    Digitürk başvuru güncel adresine hoşgeldiniz. Hemen başvuru yaparsanız anında kurulum yapmaktayız.

    tutku iç giyim Türkiye'nin önde gelen iç giyim markalarından birisi olmasının yanı sıra en çok satan markalardan birisidir. Ürünleri hem çok kalitelidir hem de pamuk kullanımı daha fazladır.

    nbb sütyen hem kaliteli hem de uygun fiyatlı sütyenler üretmektedir. Sütyene ek olarak sütyen takımı ve jartiyer gibi ürünleri de mevcuttur. Özellikle Avrupa ve Orta Doğu'da çokça tercih edilmektedir.

    yeni inci sütyen kaliteyi ucuz olarak sizlere ulaştırmaktadır. Çok çeşitli sütyen varyantları mevcuttur. iç giyime damga vuran markalardan biridir ve genellikle Avrupa'da ismi sıklıkla duyulur.

    iç giyim ürünlerine her zaman dikkat etmemiz gerekmektedir. Üretimde kullanılan malzemelerin kullanım oranları, kumaşın esnekliği, çekmezlik testi gibi birçok unsuru aynı anda değerlendirerek seçim yapmalıyız.

    iç giyim bayanların erkeklere göre daha dikkatli oldukları bir alandır. Erkeklere göre daha özenli ve daha seçici davranırlar. Biliyorlar ki iç giyimde kullandıkları şeyler kafalarındaki ve ruhlarındaki özellikleri dışa vururlar.

    ReplyDelete
  53. Aha, it's a good discussion about this paragraph at this place on this website, I read all of that, so now I'm commenting here too...Eligible travelers can obtain a Tourist visa to Turkey and pay the e Visa Turkey cost online by filling an online form with their personal details and passport information.

    ReplyDelete
  54. This is very cool article about domino effect. I think your blog is very interesting. You can lead instagram blog too. You can buy instagram followers to promote your page

    ReplyDelete
  55. Since situations change, our bodyguards close protection in UK
    undergo refresher training regularly. They are evaluated after each training to assess whether they are fit for security assignments.

    ReplyDelete