SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisHard
An organization relies heavily on a third-party cloud provider for its critical infrastructure. During a recent audit, it was discovered that the cloud provider experienced a significant outage due to a configuration error in their global load balancing service, impacting several of the organization's applications. The organization had performed due diligence on the provider's security controls but did not adequately assess the provider's operational resilience. This scenario highlights the importance of understanding which type of risk from a third-party perspective?
- AReputational risk
- BRegulatory risk
- CSupply chain risk
- DMarket risk
Show answer & explanationAnswer & explanation
Correct answer: C. Supply chain risk
Supply chain risk encompasses the risks associated with an organization's reliance on external providers or components. The cloud provider's operational failure (configuration error leading to outage) directly impacted the organization's operations because it is part of their supply chain. This demonstrates that even with good security controls, operational failures within the supply chain pose a significant risk.
Why the other options are wrong
- A. Reputational risk is a consequence, not the underlying type of risk from the third-party's operational failure.
- B. Regulatory risk is about non-compliance with laws, while the problem here is an operational outage, not a compliance violation (though it might lead to one).
- D. Market risk relates to changes in market conditions, not operational failures of a service provider.
Supply Chain Risk
The risk of disruption to the flow of goods or services caused by vulnerabilities or incidents within the network of organizations that supply components or services.
- Extends beyond direct suppliers to their suppliers (N-tier risk).
- Includes risks from software, hardware, and service providers.
- Requires due diligence and continuous monitoring of third parties.
Memory trick: Vendor risks ripple through the Supply Chain.