4 Questions Government Officials Should Ask Their Technology Vendors

Over the past year, we’ve experienced a shocking rise in cyber attacks by increasingly sophisticated perpetrators. While much attention is being paid to vulnerable large-scale industrial operations, government offices remain a prime target. In fact, Microsoft warned against another potential attack from the same Russian group behind SolarWinds, and this time, it’s specifically targeting agencies. 

Breaches at any level of government can put incredibly sensitive information up for grabs. As we saw with the SolarWinds hack last year, many cyber vulnerabilities can originate from technology vendors. Even so, it’s critical that governments’ digital initiatives, many of which were accelerated by the pandemic, continue progressing to meet the needs of constituents. Rather than slowing down transformation initiatives, governments need to be more rigorous in assessing the security postures of prospective tech vendors. 

Most government leaders know to look for certifications such as FedRAMP, NIST, ISO and others when vetting a potential partner, but in some ways, these certifications are table stakes. They’re just the first credentials to look for (without them, it’s a sign that security isn’t a priority), but there are many other signals you should look for as well. To truly minimize risk, here are the questions government officials should be asking technology vendors in regards to security: 

1. How is security built into your organization? 

In today’s threat landscape, security needs to be built into vendor culture. Every employee is responsible for ensuring that the network remains secure. If the company can say they  constantly update security protocols and teach employees about them on an ongoing basis, that’s a good sign that they’re taking a strong, preventative approach to security. Beyond coaching employees to not click on phishing emails, they should conduct regular training for every individual on the volume and severity of cyber attacks, key indicators of a potential attack, and more. On top of that, organizations must have a dedicated internal security team committed to evolving the company’s security protocols and continually educating employees. 

2. What is your process for detecting and responding to security threats?

Beyond keeping all employees up to speed on the security landscape, vendors should have a physical Security Operations Center where security professionals constantly monitor for vulnerabilities within their products and networks. With this level of visibility into their systems, vendors will be well-positioned to quickly respond to security threats before they can cause serious damage. For instance, the recent hackers behind the M.T.A. breach took advantage of zero-day holes (holes in the software that are unknown to the operator)—a clear example of what can happen when you don’t work proactively to patch up vulnerabilities. 

Ensuring that your tech partners have an SOC could be the difference between experiencing a network-wide shutdown and receiving a reminder email to be vigilant about security protocols. Needless to say, you’ll want them to have one in place.

3. How do you build and evaluate your software?

Technology companies are constantly updating their software to ensure customers are receiving the best experience possible. But with constant updates, developers can unknowingly poke holes in the software, creating opportunities for hackers to get into the network. 

Whenever coding is changed, the code should be scanned to make sure no new vulnerabilities are introduced. Dynamic application scanning, a common testing procedure, allows software teams to scan running applications, quickly identify vulnerable areas and close any holes before the application is formally deployed. On top of that, regular penetration testing across all software (new and old) is critical, too. Penetration tests simulate cyberattacks and can help security teams regularly confirm that there aren’t any digital backdoors within their network that cyber criminals can break through. 

With each of these tests done consistently, software teams can develop and iterate on tools and applications without exposing your organization to new cyber threats.

4. Do you have a Chief Security and Information Officer?

Just as a chief financial officer and chief marketing officer are integral to an executive leadership team, so is a chief information security officer. If the company invested in hiring a C-level security leader, that’s a strong indicator that they are prioritizing security just as much as they are prioritizing finance and marketing. The CISO function ensures that efforts to protect customer data and identify potential risks are done right and all security protocols are developed in accordance with the latest NIST security framework.

Some agencies will be tempted to put vendor solutions on the premises, which will allow them to dodge security mandates for cloud computing vendors. But putting a vendor’s solutions into your data centers or on your cloud will not make your organization more secure. In fact, this strategy introduces serious security risks. The only way to ensure your organization is as protected as possible from growing cyber threats is to hold vendors accountable for abiding by security best practices.

By the same token, any vendor that comes to you and says “we manage security so you don’t have to” should not be trusted. Security is no longer something to outsource. True security is collaborative between vendors and customers.  

Integrating technology into day-to-day operations will inherently present new security challenges. By asking the right questions in the vetting process, your digital transformation can continue without a hitch.  

Bob Ainsbury is the chief product officer at Granicus.