One Tuesday morning, the Security Operations Center (SOC) at the fictional company Rheinwerk Logistics AG reports unusual data activity. For at least 72 hours, sensitive information has been verifiably leaking out of the ERP system of the Swiss logistics group—which employs 4,200 people—in small, inconspicuous data packets. At first, the SOC suspects an insider threat or unpatched systems.
But the trail of the attack leads to an external IT service provider: Cybercriminals had stolen the provider’s login credentials and gained access to the company’s systems via a service portal. The provider had once been responsible for maintaining the warehouse management software. Its contract had expired—but its privileged access had not.
The case is fictional, but the underlying risk is real: inadequately controlled third-party access creates vulnerabilities that can persist for years.
Cyber Third-Party Risk Management (C-TPRM) encompasses the systematic assessment, monitoring, and management of cybersecurity risks arising from business relationships with external service providers, suppliers, and business partners. Any direct or indirect access to corporate systems, data, or networks expands the potential attack surface.
Particularly critical are third-party accesses whose permissions and activities are inadequately monitored. Whether it’s an API key, VPN access, or read-only permissions: such access creates additional security risks when transparency and clear responsibilities are lacking. Managing these risks therefore extends beyond IT and requires coordinated processes with the relevant business units.
How was the cyber incident at the fictional Rheinwerk Logistics AG able to unfold over such a long period of time? The timeline shows where controls were lacking and how the attackers exploited these gaps.
Year 1 | Q2 Onboarding Without a Security Assessment
A new IT service provider is integrated for warehouse management software. No standardized security onboarding, no classification by risk level, no assessment of the service provider’s maturity or security posture.
The IT team sets up persistent VPN access and a privileged service account for the provider to perform maintenance on the warehouse management system. No restrictions to specific systems or time windows, no MFA, no SIEM integration.
The maintenance contract expires. The offboarding process lacks a checklist for revoking access rights. The IT team assumes that the provider “no longer has any need for it.” The service account remains active.
Year 3 | Q1 Compromise of the provider
The third-party provider itself falls victim to a ransomware attack. In the process, the attackers also steal the login credentials for the Rheinwerk systems. Since there is no continuous monitoring, this goes unnoticed
Attackers move laterally through the network, collecting data. No alarm is triggered. The access is still registered as valid, and the data movements remain inconspicuous.
Year 3 | Q2 Discovery, far too late
An unusual volume of data is noticed during night shifts. Incident Response is activated. It takes another 11 days to fully understand the extent of the incident.
The attack was enabled by privileged third-party access that remained active after the contract expired. A lack of access restrictions and inadequate monitoring made early detection difficult.
Effective C-TPRM focuses on six control areas: onboarding, ongoing risk assessment, access control, monitoring, offboarding, and contractual security requirements. It is crucial to identify security gaps throughout the entire service provider relationship and close them with targeted measures.
|
Structural Gaps |
Solutions |
|
|
Onboarding / Due Diligence |
No classification or initial security assessment of the service provider |
Maintain a complete inventory of third-party providers. Conduct risk classification (criticality × access depth) prior to signing a contract, for example, using four levels: critical, high, medium, and low. |
|
Ongoing Assessment |
One-time assessment during onboarding, with no subsequent reassessment |
Annual or event-driven reassessment, monitoring of incidents at the provider, regular recertification of accounts and permissions. For critical service providers, additionally require audits, certification evidence (e.g., ISO 27001), or SOC 2 audit reports |
|
Access Control |
Permanent, broad access without least privilege and without MFA |
Just-in-time access, mandatory MFA, restriction to necessary systems and minimal access rights, credential rotation at critical milestones (e.g., go-live). Implement Privileged Access Management (PAM) to control privileged access. |
|
Monitoring |
Third-party activities not integrated into the SIEM, no anomaly detection |
Logging of security-relevant third-party activities, SIEM integration, behavior-based analysis. Use external threat intelligence to detect early indications of compromises at service providers. |
|
Offboarding |
No formal process for revoking access rights at the end of a contract |
Offboarding checklist and clear responsibilities; defined contractual responsibility for revoking access; automated, complete deprovisioning upon contract expiration. Rotate access credentials, reclaim provisioned assets, and document the completion of the offboarding process. |
|
Contractual Requirements |
No binding security clauses (e.g., mandatory MFA, incident reporting deadlines, audit rights) enshrined in the contract |
Mandatory security clauses, including security SLAs, incident reporting requirements, and audit and inspection rights. Specify concrete reporting deadlines (e.g., within 24 hours of becoming aware of an incident) and termination rights in the event of serious violations of agreed-upon minimum security requirements. |
A cyberattack via a third-party provider affects far more than just IT. Regulatory consequences, loss of trust, and operational disruptions can burden the entire company—even long after the actual incident has been resolved.
Regulatory Consequences: DORA, NIS2, FINMA requirements, and data protection laws impose requirements on how third-party risks are managed, depending on the industry and jurisdiction. Companies that cannot demonstrate adequate security controls and their implementation risk regulatory measures and, in some cases, fines.
Reputational Damage: For customers, investors, and partners, it hardly matters whether the company itself or one of its service providers was hacked. What matters to them is that their data was not adequately protected by the affected company.
The hypothetical case of Rheinwerk Logistics AG illustrates how a failed offboarding process can lead to a serious cyber risk. It is therefore crucial to keep a close eye on external service providers throughout the entire business relationship—from the initial risk assessment through the monitoring of privileged access to the verifiable revocation of all access rights.
Effective cyber third-party risk management creates transparency regarding existing dependencies, makes critical access controllable, and helps close security gaps early on. To achieve this, procurement, business units, and IT security must align their responsibilities and processes.
Those who continuously manage third-party risks reduce their attack surface and strengthen the resilience of the entire company.
How well are your external service providers’ access rights and cyber risks controlled? Talk to our cybersecurity experts about the targeted assessment and mitigation of your third-party risks.
Caption: AI-generated image