Recent searches

No recent searches

Search options

Only available when logged in.
techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome

Administered by:

Server stats:

4.6K
active users

techhub.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.2

#tprm

0 posts0 participants0 posts today
Replied in thread
Kevin Neely :donor:

@ravirockks I don't know much about the Pentagon's process, however, having been on both sides of #TPRM processes, I know that the first pass of the information submitted by the vendor is basically worthless and requires a lot of vetting and discussion with their security and/or RFP teams in face-to-face or video-on meetings so one can ascertain the level of truth to the submitted information.

Not to say that genAI can't be used here in some cases, but the continual and hand-wavy, "we're going to blindly chuck the old process and replace it with #genAI" just rings of rubber-stamping and not actually delivering on business objectives.

Alexandre Sieira

The second episode of the Alice in Supply Chains podcast is out!

This is a podcast where @sawaba and I discuss what we consider some of most important news related to Third-Party Cyber Risk Management from the previous month.

You can check it out on the major podcast platforms.

Youtube: youtube.com/watch?v=CMYDeb56FWs

Spotify: open.spotify.com/episode/7qPB7

Apple Music: podcasts.apple.com/br/podcast/

Amazon Music: music.amazon.com.br/podcasts/b

This is based on the longer monthly newsletter of the same name published by @TenchiSecurity on LinkedIN. You can find the latest edition at linkedin.com/pulse/issue-30-fe

YouTubeAlice in Supply Chains Podcast - Episode #2, February 2025By Tenchi Security
#tprm#tpcrm#cyber
*
Alexandre Sieira

Happy to announce the launch of the Alice in Supply Chains #podcast, posted monthly, focusing on topical discussions on the top news relevant to Third-Party Cyber Risk Management.

"Plant a tree, have a child, and write a book. These all live on after us, insuring a measure of immortality." We all know that these days, the writing a book part would probably be replaced with "host a podcast".

Given that inevitability, I have finally decided to face my impostor syndrome and my non-native and accented English and give that a go. Standing on the shoulders of the collective effort we do at @TenchiSecurity on publishing high-quality content on Third-Party Cyber Risk Management in the Alice in Supply Chains newsletter, and counting on the vast experience and expertise of my good friend and co-host @sawaba .

Please check it out and let us know what you think, we are really at the beginning of the learning curve here and can use the feedback. Hope you like it!

Youtube: youtube.com/playlist?list=PL22

Spotify: open.spotify.com/episode/2GLA4

Amazon: music.amazon.com.br/podcasts/b

Apple: podcasts.apple.com/us/podcast/

If you haven't subscribed to the newsletter yet, you can do so now at podcasts.apple.com/us/podcast/

YouTubeAlice in Supply Chains Podcast - Episode 1, January 2025By Tenchi Security
#tprm#tpcrm#cyber
*
Alexandre Sieira

Yet another reminder of the importance of Third-party Cyber Risk Management: cybersecuritynews.com/starbuck #tprm #tpcrm #cyber #security #risk #management

It is worth pointing out that there are no shortcuts on how to manage the security of third-parties. Blue Yonder, the third-party involved in this incident, boast having SOC2 type II and ISO 27001 certifications. They surely answered all of the different self-assessment questionnaires it received to their customers' satisfaction. Their security ratings scores were certainly acceptable, if they were brought on as vendors.

And I know none of those things are strict guarantors of perfect security. Even companies that are mostly doing things well can be compromised. But at the same time, we need to wake up as an industry to the fact that the existing TPCRM practices are failing to protect us.

We need to work together to do better, go beyond the illusion of risk avoidance and risk transfer, and actually manage and mitigate third-party cyber risk.

Alexandre Sieira

Wow, @TenchiSecurity 's monthly newsletter of curated Third-Party Cyber Risk Management news has reached 12,000 subscribers!

This is a low-volume, high signal newsletter for the time strapped risk manager, highlighting breaches, regulatory changes and more.

Issue 27 is out, check it out and let me know what you think! linkedin.com/pulse/issue-27-no #tprm #tpcrm #cyber #risk #compliance

www.linkedin.comIssue #27 | November, 2024‘Save the Date’ As we get used to new things, they slowly merge into the landscape. What was once shocking could now be background noise: with familiarity comes complacence.
LMG Security

Combat the rise in stolen source code incidents that is increasing your organization's #ThirdPartyRisk! Watch our 3-minute video to learn about real cases of source code theft, #darkweb listings, and how vendors can be weak links in your organization's #cybersecurity. youtu.be/Xg-UkNbP31c

youtu.be- YouTubeEnjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.
#RiskManagement#VendorSecurity#DataBreach
LeeRayl

New line of business- “$1500 Vendor Review”

I will do a proper Vendor Review using human intelligence (HI) based on your company’s Vendor and Risk Management policies.

My average vendor review is 10 hours per vendor with both BizOps and InfoSec reviews, using standard TPRM methods, and will contain relevant documentation and attachments to make risk based decisions on vendors.

Yes - $1500 gets you 1 vendor review. Not a vendor program, not a vendor manager, just a single vendor review.

Seems like a lot of cash huh. Yep, but since you need it and don’t want to do it, pay me, I will do it for you.

#smallbusiness#RiskManagement#tprm
LeeRayl

Just had to write this for a vendor review:

"High Risk of possible loss to personnel and company assets due to continued political and military actions in the area of the company's main offices and team"

This is the second time in 30 days I have had to do this and it is not the same country.

This is a real risk that real security teams are dealing with today in countries with well established tech sectors.

This job is hard enough without having to dodge bullets and missiles.

#TPRM#RiskManagement#InfoSec
LeeRayl

You all complain about #TPRM but this is exactly why 4th/5th party supply chain vendors are becoming a bigger deal.

Unless you want to be stuck in space for months or flying to grandmas house and have a door plug fall of the plane, it’s a good idea to know where your vendors and their vendors do business.

My MSP is literally focused on this. I live in a Boeing town, almost every business within 2 miles supports building planes, if not planes, trucks for Kenworth/PACCAR. I am trying my damnist to keep you all safe and I do it at the lowest level possible, the taco stand or bodega servicing the people doing the work and supporting the companies supporting Boeing and PACCAR.

It’s real security work, it’s real important, and I believe if we don’t invest in securing the spaces that support businesses, we all risk more than we should.

So jetcity.tech is my msp. It’s named that because of my supply chain support to the community supporting your business.

It’s not glamorous work, I ain’t winning awards, I ain’t speaking at cons, I am trying to keep my neighborhood safe. I didn’t know this was where I was going to when I started 2 years ago but it’s become a passion.
mastodon.green/@juliette/11293

Mastodon.greenjuliette 🌻 (@juliette@mastodon.green)Companies contract out small parts manufacturing, then big parts, then engineering and design, and only retain a "people and culture" organization that sits far from any factory, and before you know it you have two astronauts stranded in space and windows blowing our of planes because no one feels responsible for your overall product anymore. IN-SOURCE YOUR ENGINEERING AND MANUFACTURING!!!!!!!!!!!!!!
TrendingLive feeds
About