Tuesday 13 February 2018

SERM - The Domino Effect

Credit Stock Photo

I have two little monsters and like the little monsters they are, they love the whole Disney Pixar thing. One edition of Disney Pixar that we have watched maybe a little over what feels like one or two million times is Robots. For anyone who knows the story behind the film, they will be familiar with the dominoes scene which marks the triumphant return of Bigweld – the company’s missing boss and hero to the main character – Rodney Copperbottom. For those who are not familiar, Rodney causes the crash of hundreds of billions of dominoes by just toppling one. This domino effect, which starts innocently enough, can lead to disastrous effects.


Let’s exchange the Pixar setting for your organisation. Think of your organisation as the last domino, the biggest in the chain, centred in a large circle of a long list of “supplier” dominoes. Would a breach that affects, spreads and ultimatley topples a supplier have disastrous effects for you? The real impact of toppling a supplier is ultimately unknown, unless your organisation has taken steps to adequately asses the risks suppliers present. This process is known as Supplier Evaluation and Risk Management or SERM.


Let’s break SERM down;
  • Supplier Evaluation is;

    • Gathering information on the suppliers we have. First and foremost, we need to determine how many suppliers we have! Many organisations have only a rough head count of suppliers, Supplier Evaluation will give organisations a firm grip on the actual size of their supplier domino chain! From identifying the length of the domino chain, we will be able to accurately gauge the level of risk they present to the organisation.
    • Identifying what these suppliers do.  The risks a supplier presents to an organisation is largely dependent on what that supplier does for the organisation. A supplier that provides office furniture, can be viewed as much less risky than one that provides data analytic services. In the case of the office furniture supplier, an assessment can be considered complete once it’s determined that they pose little risk to the information security of the organisation. Whereas for the data analytics provider, it’s necessary to dig a little deeper and get to the crux of the risk they pose to the business.

    • Assessing how good a supplier is at Security is the deeper digging. This assessment can be conducted via a combination of the following activities,

      • Requesting that the supplier respond to a broad set of short yes or no questions about the security controls they have in place.
      • Requiring evidence (where necessary) that demonstrates that the controls they attest to; are indeed in place.
      • Benchmark the configuration of their estate, highlighting missing patches, outdated OS and Common Vulnerabilities and Exposures (CVE).
  • Risk Management
    After completing the evaluation, we have a clearer view of how dominoes in the chain may fall. Now, we need to weigh the impact of their fall. This helps an organisation determine the risk each vulnerable domino exposes them to. Would the risk be minor, maybe effecting a gentle shake upon our domino or will it be a major, earth shattering crash, that would tumble our organisation completely?
    We can determine the size of the supplier domino by;

    • The supplier’s risk score, based on the Supplier Evaluation.
    • Their impact on our organisation's short and long-term goals and objectives. Imagine we are an organisation that delivers Online Training. As an Online Trainer, we have an online meeting supplier - which we use daily to deliver webinars to our customers across the globe. Our online meeting supplier is hit by a cyber-attack and topples. Unless an alternative can be used, this will result in our inability to deliver Training.... Such an event would be disastrous to our customers and therefore our brand and our organisation, even though we have not been directly hit by the cyber-attack ourselves, our domino has fallen.

We must, at this point have the understanding that SERM is a multiphase process. To adequately measure the risk posed by our suppliers, we need to;
  1. Distribute surveys to all suppliers
  2. Gather those response
  3. Analyse and assess the responses
  4. Distribute follow up surveys if required
  5. Gather those responses
  6. Gauge the level of risk posed by those suppliers
  7. Implement safeguards or take necessary steps to remove or mitigate individual supplier risk.

Take a moment to consider how arduous this process could potentially be. The length of the supplier domino chain could be miles! This doesn’t just depend on the size of your organisation, even the smallest of organisations could have many suppliers. The length of the domino chain largely depends on the nature of the business.

If you apply the manual approach of SERM, which traditionally includes delivering excel based or telephone call questionnaires to all of your suppliers, will not only incur exponential costs in terms of man hours and material costs, but think about the level of expertise your team will need to have. What if you have a supplier that is not the most, let us say, “responsive”. Your SERM team will need to spend the extra time in chasing down supplier responses to capture an adequate Supplier Risk picture. Cast your eyes back to the sheer number of phases SERM has, the manual approach is usually a lengthy, laborious and error-prone process.

Yes, you will have a process in place, but is it effective? Can you adequately perform a comprehensive examination of your suppliers? To the point where you can identify the risks within your supplier domino chain and track remediation efforts? As the saying goes, do it nice or do it twice. For these reasons, among others - automation is a must.

The NotPetya outbreak which dominated the news last year is a case study that underpins the benefits of SERM. Perhaps..... If the clients of MeDoc had an automated SERM process in place, they would have been able to adequately weigh the risk MeDoc posed as their supplier. This could have resulted in the prevention or at least mitigation of the outbreak we saw spread throughout the Ukraine way back in June. Automated SERM would have highlighted the insecurities in the supply chain by automatically distributing surveys, allowing for real time status of surveys as well as providing automated reminders sent to those suppliers who have not completed the survey in a given timescale. Upon survey completion, automated SERM allows for immediate report provision which eliminates gap between time survey submissions and risk visibility.

Allowing the clients of MeDoc to weigh the risk to them would give them the choice of whether to keep trusting MeDoc as their supplier. For those conspiracy theorists out there, who will say to me “ah yes but the NotPetya attack was not about Cyber”. Firstly, I agree! There is indeed evidence that suggests NotPetya was more than just Cyber-Attack. Secondly and most importantly, what about Equifax? Or Uber? Or ? Almost all damages associated with breaches could have been severely mitigated or at least prevented if automated SERM were to be in place. By highlighting the risks to the business 3rd party suppliers pose and ascertaining exactly what those risks mean will ultimately allow the decisions to be made to prevent our domino from tumbling. 

Now, impressive as it may seem, we have come a long way without a mention of the feared EU GDPR, but... we would be neglectful to not discuss the requirements of SERM under EU GDPR. Article 4 defines the role of the data controller as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data...” In the context of a SERM project, your organisation would be considered as the data controller. The suppliers you evaluate will fall under the role of data processor, who would be “a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.” 


Between you and your supplier, right from the very beginning of your working relationship, there must be a clear understanding on what Personally Identifiable Information (PII) each party will be processing. This must include the metrics used to gauge how sensitive it is. Classification of sensitive data (e.g. gender and marital status etc.) should be clearly defined so when SERM is applied, we will have an accurate, clear picture of what risk they present to the business should a supplier be breached.
As we have alluded to, the primary purpose of SERM is to survey your suppliers and gauge the level of a risk (how big of a domino) they pose to your business. Automated SERM surveys will enable your organisation to ascertain the level of protection your suppliers currently have in place and provide you with a clear risk picture of your supplier chain. If the level of risk is not acceptable by your organisation, it may be that you may need to call a cease to your business relationship with that supplier, effectively removing them from the chain of dominoes to prevent yours from falling.
Without doubt, the absolute best way to acquire an accurate risk picture of your supplier chain is through using automated SERM. ZeroDayLab would be pleased to demo our automated SERM process, please contact us for more information.

What we know is a drop, what we don’t know is an ocean
Isaac Newton

69 comments:

  1. Very good info. Lucky me I discovered your blog by chance (stumbleupon). I have saved as a favorite for later!
    Techno

    ReplyDelete
  2. Hi buddies, it is great written piece entirely defined, continue the good work constantly.

    Data Science Course

    ReplyDelete
  3. It is extremely nice to see the greatest details presented in an easy and understanding manner.

    Data Science Training

    ReplyDelete
  4. I like this post and there is obviously a lot to know about this. I think you made some good points in Features also i figure that they having a great time to peruse this post. They might take a decent site to make an information, thanks for sharing it to me Keep working, great job!
    Braces in Bangalore

    ReplyDelete
  5. Thank you for sharing such nice content so keep posting.
    microsoft solitaire online

    ReplyDelete
  6. Aha, it's a good discussion about this paragraph at this place on this website, I read all of that, so now I'm commenting here too...Eligible travelers can obtain a Tourist visa to Turkey and pay the e Visa Turkey cost online by filling an online form with their personal details and passport information.

    ReplyDelete
  7. This is very cool article about domino effect. I think your blog is very interesting. You can lead instagram blog too. You can buy instagram followers to promote your page

    ReplyDelete
  8. Since situations change, our bodyguards close protection in UK
    undergo refresher training regularly. They are evaluated after each training to assess whether they are fit for security assignments.

    ReplyDelete
  9. This is really very nice post you shared, i like the post, thanks for sharing..
    data scientist certification malaysia

    ReplyDelete
  10. Attractive component of the material. I just stumbled across your web site and accession capital to say that I really enjoyed your site. With just a few clicks, foreign nationals can apply for a
    Kenya visa on arrival from their home. Fill the form with accurate and complete information about the passenger's data.

    ReplyDelete
  11. Loved the way you have written the piece of content. Thanks for sharing. We are one of the best Dental Clinic in South Delhi.

    ReplyDelete
  12. Thanks for this incredible information. I think you could make a video about domino effect and post it on Youtube. By the way if you want to get more subscribers for your channel, you can repeatly use the help of https://viplikes.net/buy-youtube-subscribers to quickly boost their number.

    ReplyDelete
  13. I love to read this, thank you... Getting an Indian visa online is easy. You can apply via evisa India website online fully securely.





    ReplyDelete
  14. You understand your business more than anybody else, keep the content but make it visually appealing and break down info to make it easy to digest. presentation design

    ReplyDelete
  15. Land sterling takes pride in offering best-in-class real estate valuation services in Dubai. Ever Since our inception in 2009, we have put in the best of our efforts to ascertain that our clients receive asset valuation services aimed at helping them make the best, most knowledgeable decisions. valuation companies in dubai

    ReplyDelete
  16. I love what you guys do too. Much clever work and reporting!Keep up the good work guys...Turkish visa for USA, You can apply online via Turkish visa website.

    ReplyDelete
  17. Microsoft Office 365 Product Key Activation Free incorporates Microsoft Office, SharePoint Online, Lync Online and Exchange Online combined in a very cloud service which is often as many as day. Office 365 will make it much easier for buyers to collaborate from just about anywhere and on any device https://freeprosoftz.com/microsoft-office-365-product-key/

    ReplyDelete
  18. Hii guys, Traveling to India interests you. For more information about e visa India, please visit our e visa to India page and read all visa requirements & guidelines.

    ReplyDelete
  19. Taking Window 7 item Key free is definitely not a straightforward work. On the off chance that you experience issues with your advanced windows seven establishment and have to improve or re-introduce Windows, you need the windows 7 item key or sequential key. However, immediately, you don't need to look through any extra since here we have recorded fundamental item keys for windows seven most recent 64 digit and 32 cycles. These are present day, working free keys. It positively will be appropriate for all extreme clients. windows 7 crack free product key

    ReplyDelete
  20. Are you perplexed about what design you should pick this time for your kitchen? If yes, then your search ends here as this article would be a great help for you undoubtedly. blog

    ReplyDelete



  21. We are also provide crack software. It has a wonderful feature. This is a good job. It is easy to use.
    https://azanpc.com/wondershare-filmora-11-crack-download-latest-version/

    ReplyDelete
  22. Grateful to have you in our lives. Hope you have a merry Christmas and a happy New Year. Hope your holiday season is filled with friendship and .
    Cute Christmas Wishes

    ReplyDelete
  23. Thanks For Update :

    https://carzillauae.com/range-rover-repair-services/

    ReplyDelete
  24. Carzilla Auto is one of Dubai’s leading Porsche garage in Dubai. The company offers a wide range of automotive repair and modification services. Carzilla’s team is ready to change your vehicle, with free pick-up and delivery from your home. Porsche Repair Dubai

    ReplyDelete
  25. This comment has been removed by the author.

    ReplyDelete
  26. Microsoft Office 2010
    Microsoft Office 2010 is great software which is use to enhance the working in system.

    ReplyDelete
  27. I have read some of your blog’s content. I have saved your webpage in my favorites and will visit it again later.

    cockroach pest control dubai

    ReplyDelete
  28. Nice blog. I finally found great post here Very interesting to read this article and very pleased to find this site. Great work! Bmw repair dubai

    ReplyDelete
  29. I wholeheartedly congratulate the writer of this post for explaining the difficult concepts of data science in a simple and easy-to-understand manner. My only regret is that I didn’t read this post earlier. I have made many career decisions in my life after reading this, and have no regrets whatsoever to date.data science course in KL

    ReplyDelete
  30. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.

    Porsce Repair dubai

    ReplyDelete

  31. Step into a world of luxury and indulge in unforgettable beauty experiences at our ladies salon near me . Our exclusive establishment is dedicated to enhancing your natural beauty and providing you with exceptional services that leave you feeling transformed. From expert hair styling and flawless makeup application to rejuvenating spa treatments and personalized skincare, we offer a comprehensive range of services tailored to meet your unique needs. Our team of talented professionals is committed to delivering the highest quality of service in an exquisite environment.

    ReplyDelete
  32. Dubai Hills Massage services offer an unparalleled experience of relaxation and rejuvenation in the vibrant city of Dubai. Situated amidst the breathtaking landscape of Dubai Hills Estate, this luxurious spa provides a wide range of treatments and massages tailored to meet the individual needs of each guest. With highly skilled and experienced therapists, state-of-the-art facilities, and a tranquil ambiance, Dubai Hills Massage services ensure a blissful escape from bustling city life.

    ReplyDelete
  33. Indulge in a luxurious escape at the finest ladies salon in dubai , where pampering reaches new heights. Step into a world of sophistication, elegance, and relaxation, where every detail is meticulously crafted to provide you with an unforgettable experience. From the moment you enter, you'll be greeted by a team of skilled professionals dedicated to enhancing your natural beauty and well-being. Treat yourself to a range of rejuvenating spa treatments, from soothing facials and revitalizing massages to expertly executed manicures and pedicures.

    ReplyDelete
  34. Discover the epitome of luxury and indulge in an unforgettable experience at the premier Dubai salon . Step into a world of opulence and sophistication, where every detail is meticulously designed to cater to your desires. From the moment you enter, you will be enveloped in an ambiance of sheer elegance, adorned with exquisite decor and infused with the calming aroma of indulgent fragrances. Our highly skilled and internationally trained team of beauty experts will pamper you with an array of bespoke treatments, using only the finest products and cutting-edge techniques.

    ReplyDelete
  35. Get Rid Of All Kind Of Pests From Home, Office Or Business Premises. 24/7 Service. 3 Month Warranty. Services: Sanitization, Disinfection, Cleaning.

    pest control company marina

    ReplyDelete
  36. Die taktische weste polizei ist eine hochqualifizierte und spezialisierte Strafverfolgungseinheit, die für ihre außergewöhnlichen Kenntnisse in den Umgang mit komplexen und hohen Risiken bekannt ist. Das Gerät besteht aus ausführlich ausgebildeten Beamten und ist mit fortschrittlicher taktischer Ausrüstung, modernster Technologie und einem unerschütterlichen Engagement für die öffentliche Sicherheit ausgestattet. Die taktische weste polizei demonstriert konsequent ihr Fachwissen, ihre Disziplin und ihr Anpassungsfähigkeit. Ihre strenge Ausbildung umfasst spezielle Taktiken, Kenntnisse in der Nähe von Schusswaffen, Kampfflugzeugen und strategische Entscheidungen, wodurch sie schnell und effektiv Bedrohungen neutralisieren und gleichzeitig den Schaden für unschuldige Zivilisten minimieren können.

    ReplyDelete
  37. Die taktische weste ist ein wesentliches Gerät, das eine entscheidende Rolle bei der Verbesserung der Wirksamkeit und des Schutzes von Soldaten im Kampf spielt. Diese Westen wurden mit den spezifischen Bedürfnissen des militärischen Personals entwickelt und sind sorgfältig gefertigt, um dem Schlachtfeld Haltbarkeit, Funktionalität und Vielseitigkeit zu bieten. Taktische weste militär sind mit zahlreichen Beuteln, Holstern und Anhaftungspunkten ausgestattet, sodass Soldaten mit Leichtigkeit ihre Ausrüstung und Vorräte tragen und Zugang zu dem Zugang zu dem Zugang und Vorräten haben können. Sie sollen das Gewicht gleichmäßig über den Körper verteilen, Müdigkeit verringern und die Mobilität erhöhen.

    Insgesamt ist die taktische weste militär ein wesentlicher Bestandteil der Ausrüstung eines Soldaten und bietet ihnen die erforderlichen Werkzeuge und den erforderlichen Schutz, um in anspruchsvollen und gefährlichen Situationen zu navigieren und erfolgreich zu sein.

    ReplyDelete
  38. Ontketen uw taktische weste -voordeel met de best beschikbare tactische weste. Ontworpen om je prestaties te verbeteren en essentiële functionaliteit te bieden, bieden deze vesten een ongeëvenaarde veelzijdigheid en bescherming. Met hun innovatieve kenmerken en duurzame constructie zijn ze gebouwd om de meest veeleisende missies te weerstaan. Of je nu bij de politie, het leger of een toegewijde outdoorliefhebber bent, deze tactische vesten geven je de voorsprong die je nodig hebt om uit te blinken in elke tactische situatie. Verbeter je spel en grijp het voordeel met de ultieme tactische uitrusting.

    ReplyDelete
  39. Sporthandschuhe, zijn essentiële accessoires voor sporters en fitnessliefhebbers. Ontworpen om comfort, bescherming en verbeterde grip te bieden, biedt Sporthandschuhe een scala aan voordelen bij verschillende sporten en activiteiten. Of het nu gaat om gewichtheffen, fietsen of boksen, deze handschoenen helpen de prestaties te verbeteren en het risico op blessures te minimaliseren. Met hun duurzame materialen en ergonomische ontwerpen is Sporthandschuhe een praktische keuze voor iedereen die zijn sportervaring wil optimaliseren.

    ReplyDelete
  40. De gids voor taktische rucksaecke voor elke missie is een uitgebreide bron die essentiële informatie biedt voor het selecteren van de perfecte rugzak voor elke tactische onderneming. Of je nu een outdoorliefhebber, een militaire professional of een survivalist bent, deze gids biedt waardevolle inzichten over belangrijke factoren zoals duurzaamheid, opslagcapaciteit, comfort en organisatorische kenmerken. Van robuuste ontwerpen die zijn gebouwd om extreme omstandigheden te weerstaan tot veelzijdige opties met aanpasbare compartimenten, deze gids voorziet je van de kennis die nodig is om een weloverwogen keuze te maken, zodat je rugzak een essentiële metgezel wordt op elke missie.

    ReplyDelete
  41. Buy Leather jacket mens, jackets, coats, and accessoires in USA, Canada, Uk, and Australia from the best online store Marko Woolen Leather. We manufacture high leather Jackets & Coats.

    ReplyDelete
  42. Onthulling van de ultieme gids voor leren arbeitshandschuhe leder.Deze gids biedt een diepgaand inzicht in de wereld van leren arbeitshandschoenen en de verschillende aspecten die van belang zijn bij het kiezen van de juiste handschoenen. Van materiaalkeuze tot pasvorm en bescherming, deze gids biedt professionals van waardevolle informatie om veilig en efficiënt te werken in diverse werkomgevingen.

    ReplyDelete
  43. Looking for convenient and professionalgrooming pets near me
    ? Look no further! Our dedicated team of experienced groomers is here to provide top-notch care for your furry companions. With our convenient location and flexible appointment scheduling, we make it easy for you to keep your pets looking their best. Trust us to deliver a personalized grooming experience that ensures both the comfort and well-being of your beloved pets. Book your appointment today and give your furry friends the pampering they deserve!

    ReplyDelete
  44. Shop online for Men leather jacket. Buy genuine leather jackets for men with custom-size options from Marko woolen leather. Avail Flat 30% Off with Free Shipping in the USA, UK, Canada & Worldwide.

    ReplyDelete
  45. Buy Marko Woolen Leather, the best Mens Bomber Jacket at flat 30% off with free shipping USA, UK, and Canada with a return policy.

    ReplyDelete
  46. Boxing training has reached new heights with the introduction of cutting-edge boxing paddles . These innovative tools provide athletes with a unique training experience, enhancing their speed, accuracy, and overall performance. The paddles are designed with advanced technology that allows for increased precision and feedback, enabling fighters to sharpen their punches and defensive maneuvers. With the incorporation of these state-of-the-art boxing paddles, athletes can take their training to the next level and unleash their full potential inside the ring.

    ReplyDelete
  47. Unleash Your Power with Custom Punch Paddles and take your training to the next level. Designed to enhance your speed, precision, and power, these personalized paddles offer a tailored experience to meet your specific needs. Whether you're a beginner or a seasoned pro, custom punch paddles provide the perfect combination of comfort, durability, and performance, allowing you to unleash your full potential and achieve your fitness goals. Elevate your workouts and dominate your training sessions with the ultimate tool for unleashing your power.

    ReplyDelete
  48. Elegir la mochilas de viaje perfecta puede marcar la diferencia en tus aventuras. Desde la comodidad de los tirantes hasta la capacidad de almacenamiento y durabilidad, cada detalle cuenta. Descubre cómo seleccionar la mochila ideal que se adapte a tus necesidades y te acompañe en cada paso del camino.

    ReplyDelete
  49. Unleash your inner warrior with custom chest guards that combine unparalleled protection with personalized style. Designed to meet the highest standards of safety, these custom chest guards offer a secure fit and durable construction, ensuring your chest remains shielded during intense combat or high-impact activities. With a wide range of customization options available, you can express your unique personality while enjoying the confidence of knowing you're equipped with a premium, tailor-made chest guard. Step onto the battlefield with style and unbeatable protection, and let your custom chest guard become an extension of your indomitable spirit.

    ReplyDelete
  50. Elevate your karate game to new heights by equipping yourself with a high-quality karate chest protector. This essential piece of gear provides superior protection and peace of mind during intense sparring sessions and competitions. With its durable construction and secure fit, it ensures that your chest remains shielded from potential impacts, allowing you to focus on perfecting your technique and reaching your full potential as a karateka. Enhance your training experience and stay confident in your defense with a top-notch chest protector by your side.

    ReplyDelete
  51. School bags for girls are more than just accessories; they're a reflection of personality and practicality. These bags come in an array of styles, colors, and designs, allowing every student to express their individuality. From vibrant backpacks to chic totes, there's a school bag to match every taste. Beyond their aesthetic appeal, these bags are designed to keep textbooks, stationery, and essentials organized for a day of learning.

    ReplyDelete
  52. An Office bag for men is the epitome of professionalism and practicality. These bags are carefully crafted to blend seamlessly into the corporate world while efficiently carrying all your work essentials. With sleek designs, durable materials, and plenty of compartments, they make a bold statement of sophistication and efficiency. From classic leather briefcases to modern messenger bags, there's an office bag to complement every man's style and needs.

    ReplyDelete
  53. Easiest way to earn rewards online. Give it a shot! Mehandi Design for Children

    ReplyDelete