Third-party Cloud Risk Management

Organizations are concerned about risks within the supply-chain. These include externally managed products, services and connected environments that are implicitly or explicitly trusted and, if compromised, may be used to harm the organization. Managing the cybersecurity risk of a third-party's environment is a difficult problem to solve, and requires many technological and business aspects to be in place. For cloud environments, these technological problems can be overcome by using APIs to collect data from these environments, enabling a continuous risk assessment process. Existing methods typically fail to consider the connections between cloud customers, and overlook mechanisms that can continually measure and reduce third-party risks. Risk analysis is often based on one-off audits or in the use of questionnaires, which often ends up transferring or accepting risks instead of effectively reducing them. In this study we are proposing a simpler and automatable quantitative method to calculate and monitor the risk of a cloud supply-chain, which takes into account not only third-parties but also the first-party itself. An additional innovation of this work is the formalization of a new method for defining the severity of misconfigurations in cloud environment.