Four Important Best Practices for Assessing Cloud Vendors

By Nick Sorensen, President & CEO, Whistic

When it comes to evaluating new vendors, it can be challenging to know how best to communicate the requirements of your vendor assessment process and ultimately select the right partner to help your business move forward — while at the same time avoiding the risk of a third-party security incident. After all, 63 percent of data breaches are linked to third parties in some way. In fact, we all recently learned about how an Equifax vendor was serving up malicious code on their website in a newly discovered security incident.

The Whistic team has done thorough research on what a good vendor assessment process looks like and how to keep your organization safe from third party security threats. In the following article, we’ll outline a few of these best practices that your organization can follow in order to improve your chances of a successful vendor review. Of course, there will still be situations that you must address in which a vendor is either not prepared to respond to your request or isn’t willing to comply with your process. However, we’ll share some tips for how to best respond to these situations, too.

But before we get started, keep these three keys in mind:

  1. Time your assessments: The timing of the assessment will be the single greatest leverage you have in getting a vendor to respond. Keep in mind that aligning your review with a new purchase or contract renewal is key.
  2. Alert the vendor ASAP: The sooner a vendor is aware of a review the better. Plan ahead and engage early and get executive buy-in from your team to hold vendors accountable to your policy. If your business units understand that you have a policy requirement to review every new vendor, they can help set expectations during the procurement process and eliminate last-minute reviews.
  3. Don’t overwhelm your vendors: Unnecessary questions or requests for irrelevant documentation can slow the process down significantly. Be sure to revisit your questionnaire periodically and identify new ways to customize questions based on vendor feedback. You may find that after conducting several security reviews that there may be ways to improve the experience for both parties.

Personalize the Communication
At Whistic, we’ve had a front row seat to the security review processes of companies all across the world and a wide range of use cases. We’ve seen firsthand how much of a difference personalized communication can make in creating a more seamless process for all involved, especially third party vendors who are or hope to be trusted partners to your business.

With this in mind, we strongly recommend sending a personalized email to each vendor when initiating a new questionnaire request to supplement the email communication that they will receive from any software you utilize. This can help alleviate concerns the vendor may have about the assessment process and should help to improve turnaround times on completed questionnaires. Even with the automated communication support from a third party security platform, the best motivator for your vendor to complete your request may be a friendly reminder from you or the buyer that the sales process is on hold until they complete the assessment.

Deliver Expectations Early
Assuming that your vendor already understands that you are going to need to complete a security review on them, the best time to help them understand your expectations is either right before or right after you initiate a request via your third party security platform.

When doing so, keep the following in mind as you have a phone call or draft an email to your vendor to introduce the vendor assessment request:

  • Set The Stage: Let your vendor know about the third party security platform that your organization uses and that it is required method for completing your security review process.
  • Give Clear Direction: Specify a clear deadline and any specific instructions for completing the entire security review — not just the questionnaire.
  • Provide Resources: Provide information for the best point of contact who can answer questions they may have throughout the process. It’s also a good idea to let them know that your third party security platform may reach out if they aren’t making progress on their vendor assessment.

Utilize an Email Template
Whether you use a customized template created by your team or a predefined template (such as the one Whistic provides to its customers), it’s worth spending a few minutes upfront to standardize the communication process. This will save you time in the long-run and allow you to deliver a consistent message to each of your vendors.

Respond to Vendor Concerns
It isn’t uncommon for vendors, particularly account executives, to try and deflect a security review as they know it has the potential to delay the sales/renewal process. They may also have questions about sharing information through a third party security platform as opposed to emailing that information to you. We know from experience how frustrating this can be for all involved, so below are a two tips for handling pushback:

  • Preparation: If you are getting repeated pushback from vendors, review the “Keys to Success” outlined at the beginning of this article and explore additional ways to adopt those best practices.
  • Complexity, Relevance, and Length: These items can be among the reasons why vendors complain about your security review process. Consider periodically revisiting your questionnaire and consider adding additional filter logic to limit the number of questions asked of each vendor or make the question sets more relevant to vendor that is responding.

These are just a few things to consider as you look to assess your next cloud vendor. What else have you found helpful as you have approached this responsibility at your company?

 

Your Morning Security Spotlight

By Jacob Serpa, Product Marketing Manager, Bitglass

The top cybersecurity stories of the week revolved around malware and breaches. Infections and data theft remain very threatening realities for the enterprise.

400 Million Malware Infections in Q3 of 2017
In the last few months, malware has successfully infected hundred of millions of devices around the world. As time passes, threats will continue to become more sophisticated, effective, and global in reach. To defend themselves, organizations must remain informed about current malware trends.

Fileless Attacks Are on the Rise
It is estimated that 35 percent of all cyberattacks in 2018 will be fileless. This kind of attack occurs when users click on unsafe URLs that run malicious scripts through Flash, for example. Rather than rely solely on security measure that only monitor for threatening files, the enterprise should adopt solutions that can defend against zero-footprint threats.

Terdot Malware Demonstrates the Future of Threats
The Terdot malware, which can surveil emails and alter social media posts in order to propagate, is serving as an example of the evolution of malware. More and more, threats will include reconnaissance capabilities and increasing sophistication. Hackers are looking to refine their methods and contaminate as many devices as possible.

Spoofed Black Friday Apps Steal Information and Spread Malware
In their rush to buy discounted products, many individuals are downloading malicious applications that masquerade as large retailers offering Black Friday specials. As information is stolen from affected devices and malware makes its way to more endpoints, businesses that support bring your own device (BYOD) must be mindful of how they secure data and defend against threats.

What to Do in the Event of a Breach
ITPro posted an article on how organizations should respond when their public cloud instances are breached. Rather than assume that cloud app vendors perfectly address all security concerns, organizations must understand the shared responsibility model of cloud security. While vendors are responsible for securing infrastructure and cloud apps themselves, it is up to the enterprise to secure data as it is accessed and moved to devices. As such, remediation strategies vary depending on how breaches occur (compromised credentials versus underlying infrastructure being attacked).

Clearly, the top stories from the week were concerned with what can go wrong when using the cloud. To combat these threats, organizations must first understand them. From there, they can adopt the appropriate security solutions. To take the first step and learn more about threats in the cloud, download this report.

IT Sales in the Age of the Cloud

By Mathias Widler, Regional Sales Director, Zscaler

The cloud is associated not only with a change in corporate structures, but also a transformation of the channel and even sales itself. Cloudification makes it necessary for sales negotiations to be held with decision-makers in different departments and time zones, with different cultural backgrounds and in different languages. The main challenge: getting a variety of departments to the negotiating table, and identifying the subject matter expert among many stakeholders.

To communicate with different decision-makers, sales reps must switch quickly from their roles as salespeople to global strategists and account managers. Today’s salespeople sell services, not boxes. They must also explain how the service can benefit the business, instead of simply touting its features.

The new sales process highlights the need for new skills and qualifications in the sales department, as we explain below.

Selling business value
A decade ago, it was important to get a company’s security person excited about new technology during a sales pitch. But the days of simply closing a deal by convincing the responsible person or admin to buy the product are long gone. What is needed today is a holistic winning strategy, which starts by explaining the business advantages of a solution to a potential customer.

Today, the work starts long before the sales person picks up the phone. The pitch must be individually tailored to the current and future business requirements of each organization. True cloud solutions facilitate an integrated implementation of digital transformation processes – providing the foundation for a better user experience, more flexibility, lower costs, and much more. The cloud is sold not as an end in itself, but as a result of the above-mentioned effects. Therefore, the service must be adapted to the requirements of the prospective customer and presented convincingly.

Reaching out to more decision-makers
Besides the CIO, many more stakeholders now need to be brought to the table, including the application-level department, network managers, security contacts, project managers, data protection officers, and potentially the works council. The decision-making processes involved in the purchase of a cloud service are therefore much more complex and protracted. According to a recent CEB report, in just two and half years, the average number of decision-makers per project increased by 26 percent from 2013 to 2016.

Today, the average number of persons involved in a buying decision is 6.8. A group of stakeholders is no longer as homogeneous as before, because it is much more difficult to reach consensus among a diverse group of senior executives. What is more, in addition to internal decision-makers, external decision-makers can also play a decisive role. This increases still further the number of stakeholders, and adds to the complexity of the decision-making processes.

To reach a consensus, a winning strategy must be acceptable to all decision-makers with various backgrounds. The demands placed on sales have become inherently more complex in the age of the cloud. Sales people who were used to sell an appliance have to reinvent themselves as strategists, who need to balance conflicting interests and find common ground, in particular with respect to the introduction of the cloud.

Dealing with long sales cycles
CEB points out that the sales process up to closing has been prolonged by a factor of two, as it involves efforts to overcome differences of opinion as well as fine-tuning to reach a consensus. For the project to succeed, departments that have previously made separate decisions now have to come together at the table. To sell a cloud service today, sales professionals must be able to convince the entire buying center that their solution is the right one. It’s helpful if sales people can identify the subject matter expert in a negotiating team, whose vote will ultimately be decisive.

Globalization also means that the salesperson needs to take cultural sensitivities into account. It is no longer a rarity for an IT department of a global corporation to be based in Southern or Eastern Europe due to available expertise and the wage level of the workforce.

At the same time, salespeople should not lose sight of how they can act as catalysts to speed up a decision. Which different types of information do the stakeholders need? Where does leverage come into play to move the team to the next step? What conflicting interests need to be balanced?

Understanding new principles: capex vs opex, SLAs and trust
Before a company can benefit from the much-promised advantages of the cloud, it must rely on the expertise of sales, which makes the value-add clear across the organization. This is all the more important as the cloud service is not as “tangible” as hardware. The process of building trust is handled through service level agreements, reference customer discussions, and, where necessary, credit points for non-performance. A portal can provide insight into the availability of the service level, which highlights the continuous availability of the service or describes service failures.

As capital expenditures (capex) are converted into operating expenses (opex), another issue, which needs to be made clear, comes into play with respect to license agreement-based procurement. The businesses pay only for use of the services, which can be adjusted as and when required. Regarding the data protection provisions applicable to the cloud service, consulting with the works council and understanding its respective concerns is recommended. A contract on data processing establishes the legal framework for cooperation with the cloud provider.

Once the effectiveness of the cloud approach can be demonstrated by a proof-of-concept, the cloud has basically won. After all, a test environment can be set up within a very short time. The maintenance cost for maintaining and updating of hardware solutions is thus a thing of the past, which should be a compelling argument for every department from an administrative point of view.

What makes a successful salesperson?
In a nutshell, the sales manager has to convince the customer of the business value of a cloud-based solution – at all levels of the decision-making process. In this context, the personal skills to engage in multi-faceted communication with a wide range of contacts are much more relevant than before.

Emotional intelligence, as well as technical expertise in project management, should also be thrown into the mix. It’s important to take an active role at all levels of the sales process, taking account of the fact that the counterarguments of the prospective customer have to be addressed at various points on the path to digitization.

Project management plays an increasingly important role in the age of the cloud, such as keeping in touch with all stakeholders and monitoring the progress of the negotiations. Even after the project is brought to a successful conclusion, sales has to continue to act as an intermediary, and remain available as a contact to ensure customer satisfaction. This is because services can be quickly activated – and canceled.

For this reason, it’s important in the new cloud era to continue to act as an intermediary and maintain contact with the cloud operations team in the implementation phase. The salesperson of a cloud service is in a sense the account manager, who initiates the relationship and keeps it going.