Third-party Risk Assessment

1. A security team runs an automated tool that identifies 47 potential vulnerabilities across a web application and produces a report categorizing each by severity (critical, high, medium, low). A separate engagement uses a skilled security professional who actively attempts to exploit those vulnerabilities to determine which ones can actually be used to gain unauthorized access. What are these two activities, and what is the key difference?

A. Both are penetration tests; the first is automated and the second is manual, but they serve the same purpose B. The first is a vulnerability scan (passive identification of potential weaknesses using automated tools); the second is a penetration test (active exploitation to determine whether vulnerabilities are genuinely exploitable and what impact a successful attacker could achieve) C. The first is a risk assessment; the second is a vulnerability scan using human analysts D. Both are vulnerability scans; the second simply uses a human operator to verify the automated results

2. Before a penetration test begins, the organization and the testing firm sign a document specifying: which IP address ranges are in scope, that testing may only occur between 10 PM and 6 AM on weeknights, that social engineering attacks are not authorized, and that the lead tester must call the CISO directly if any production system is taken offline. What is this document called, and why is it required before testing begins?

A. A non-disclosure agreement; it protects the confidentiality of vulnerability findings discovered during the test B. Rules of engagement; they define the scope, timing, authorized techniques, and emergency contacts before testing begins to ensure testers operate within agreed boundaries and the organization can respond if testing creates unintended impact C. A master service agreement; it establishes the overall framework for the penetration testing relationship D. A right-to-audit clause; it grants the testing firm the right to access any system during the engagement

3. A company's contract with a cloud storage provider includes a provision stating: "Customer may, at any time and with 30 days written notice, conduct a direct audit of Provider's security controls, access management practices, and compliance documentation." What is this provision, and why should it be included in vendor contracts?

A. A service level agreement clause; it defines the minimum security performance the provider must maintain B. A right-to-audit clause; it gives the customer the contractual right to independently verify that the vendor is actually implementing the security controls they claim, rather than relying solely on the vendor's self-attestation C. A penetration testing authorization; it allows the customer to conduct simulated attacks against the vendor's infrastructure D. An indemnification clause; it transfers financial liability for vendor security failures to the customer

4. Between March and June 2020, attackers inserted malicious code into the build pipeline of a widely-used network monitoring software. The malicious updates were signed with the vendor's legitimate digital certificate and distributed to approximately 18,000 customers as part of a routine software update. The compromise was not publicly disclosed until December 2020. Which type of attack does this describe, and what is the name of the affected software vendor?

A. A zero-day attack against SolarWinds; the attackers exploited an unpatched vulnerability in the software itself B. A supply chain attack against SolarWinds; rather than attacking the 18,000 customer organizations directly, attackers compromised the trusted software supplier's build pipeline so malicious code traveled to victims inside a legitimately signed software update C. A man-in-the-middle attack; attackers intercepted software updates between SolarWinds and their customers to insert malicious code D. A credential theft attack; SolarWinds customer credentials were stolen, allowing attackers to access their network monitoring systems

5. A healthcare organization is evaluating a new cloud EHR vendor. The vendor's own security team provides a self-assessment showing excellent security practices. The organization also requests a SOC 2 Type II report produced by an independent CPA firm. Why is the independent assessment more valuable than the vendor's self-assessment for risk decision-making?

A. SOC 2 reports are required by HIPAA; the independent assessment is mandatory while the self-assessment is optional B. Independent assessments eliminate the conflict of interest inherent in vendor self-assessments; an outside firm with no business stake in the outcome is unlikely to overlook security gaps that would damage the vendor's commercial relationship, providing objective findings that self-assessments cannot provide C. Independent assessments cover more systems than self-assessments and provide higher scan coverage D. A SOC 2 report is a penetration test result; it provides evidence of active exploitation attempts against the vendor's systems

6. During vendor selection, the procurement team discovers that a finalist vendor's CEO is the brother-in-law of the company's Chief Procurement Officer (CPO), and that the vendor has recently offered the CPO tickets to an international sporting event. The vendor also serves three direct competitors. Which risk is most directly illustrated by these facts?

A. Supply chain risk; the vendor's competitors could gain access to the organization's data through the vendor relationship B. Conflict of interest; the family relationship between the CPO and the vendor CEO, the gift of event tickets, and the vendor's access to competitors all represent situations where the vendor's interests may not be fully aligned with the organization's interests and where the CPO's objectivity in vendor selection may be compromised C. Financial risk; the vendor's relationship with multiple competitors could reduce the vendor's financial stability D. Vendor monitoring failure; the organization should have detected these conflicts during ongoing monitoring rather than during selection

Matching: Third-party Risk Assessment Concepts

Match each concept (1–4) to its correct description (A–D).

1Penetration Test

2Rules of Engagement

3Right-to-Audit Clause

4Supply Chain Attack

AA contractual provision granting the customer the right to directly verify vendor security controls and compliance at any time; essential accountability mechanism in vendor relationships

BAn authorized simulated attack that actively attempts to exploit identified vulnerabilities to determine whether they are genuinely exploitable and what impact a real attacker could achieve

CA pre-engagement document defining scope, timing, authorized techniques, out-of-scope systems, and emergency escalation contacts that must be agreed before security testing begins

DA compromise that targets a trusted software supplier or technology partner rather than the victim organization directly, allowing malicious code or access to travel through legitimate delivery mechanisms

Third-party Risk Assessment — Quiz