A mid-sized medical clinic recently partnered with a software vendor to streamline operations. The deal looked great — modern tools, strong references, and fast deployment.
But when the vendor arrived to install their system, they insisted on using their own remote access tool. “It’s how we support all our clients,” they said. The clinic agreed. Within hours, the vendor had installed their access software, disabled the clinic’s security agent (EDR), and quietly added tools like FileZilla for “troubleshooting.” Then vendor also proceed to create and change SQL database passwords effectively preventing existing backup software from protecting our clients data.
A few weeks later, that same vendor was breached and effectively a single employee’s account was compromised at the 3rd party and granted attackers access to every client they supported — including the clinic.
Shield53’s Incident Response team was engaged to determine how the SQL database password was changed and why multiple accounts were accessed from outside Canada. The team was able to contain the incident before any data theft occurred, but this was a near miss and serves as a strong reminder of the importance of 3rd-party risk management and remote access governance.
Lessons Learned
It’s not that vendors are bad actors — it’s that their security is not your security. When vendors connect to your systems, they extend your attack surface. If you don’t control the accounts, access, and software, you’re effectively outsourcing your governance.
Always use your own domain accounts and enforce MFA.
Never allow vendor-installed remote access tools.
Regularly perform third-party risk assessments to validate who you’re trusting.
In cybersecurity, convenience often comes at the cost of control. CEOs and CFOs don’t need to be technical experts — but they do need to ask the right questions:
Who has access to our systems?
How are they connecting?
Are we enforcing our standards, or theirs?
How Effective is our 3rd Party Risk assessment program?
Because one vendor’s mistake can become your next headline.
— Shield53 helps organizations manage risk by uncover third-party risks before they cause harm.
