What are 3rd party tools?
Everyone, from individuals to enterprises, uses third party tools and applications on their workstations, servers and mobile devices. Some examples are Adobe Reader, Java, WinRAR, and many more. They are applications that are run or installed, but are typically not centrally managed by your organization.
Why are they important to an organization?
Many times these tools are required to carry out critical job functions. These can be running applications that require Java applets, fax services, custom written applications and so on.
What risks can they introduce?
Since these applications are usually not centrally managed, their patches and updates may not be applied as quickly. Just like all software/hardware, vulnerabilities are found every day in third party applications such as a recently exposed flaw in WinRAR. According to Apigee, new attack techniques are emerging as well, including:
- Exploitation of mobile and app vulnerabilities with insecure API access
- Stealing of sensitive data cached by apps that don’t follow security best practices
- Social engineering of developers to gain unauthorized access of developer keys and credentials.
So what can you do?
While this is an accepted risk when choosing these tools, there are several things you need to remember in order to make the tools as secure as possible:
- Ensure you stay up-to-date on zero-day vulnerabilities
- Always be aware of any updates available
- Use strict authentication methods to secure your systems
- Consistent monitoring & reporting
In summary, third party tools are an unlocked window into your network and have the potential to cause great damage to your organization when not properly secured. Organizations should consider adopting policies and procedures around approving specific applications and maintaining an inventory of where they are used. This, in addition to a patch management process for these applications can significantly improve the security posture of your organization.
