Third Party Domino Effect - Governance in an Interdependent Supply Chains

Third Party Domino Effect - Governance in an Interdependent Supply Chains

Speakers: Matthew Burroughs (CISO, Novolex); Abdulrahman Almanea (CASO, Sirar by stc); Prof. Fatemah Alharbi (Cybersecurity & AI Researcher and Saudi Ambassador to GCRAI); Ben Trowbridge (Board Member & Cybersecurity Advisor, Arctic Security)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=w4TOavnGXNc

Overview

This panel discussion, "Third Party Domino Effect - Governance in an Interdependent Supply Chains," delved into the profound and increasingly complex challenges of managing cybersecurity risk in today's interconnected business ecosystem. Moderated by Ben Trowbridge, the panel featured diverse perspectives from industry CISO Matthew Burroughs, service provider CASO Abdulrahman Almanea, and academic researcher Prof. Fatemah Alharbi. The core theme revolved around the concept that in an environment where businesses rely on dozens or even hundreds of external partners, a single vendor failure or vulnerability can trigger a cascading "domino effect" that compromises the entire supply chain and, by extension, the host organization.

The discussion emphasized that effective governance and holistic oversight are no longer secondary considerations but are as critical as technical controls in preventing these supply chain collapses. The panelists explored how to quantify concentration risk, identify hidden dependencies, and validate vendor security in a landscape where traditional methods fall short. They highlighted the growing significance of underlying infrastructure (like cloud and DNS) and emerging technologies (like AI) as critical, often overlooked, sources of risk.

The talk is particularly relevant for cybersecurity professionals, risk managers, and executive leadership grappling with the expanding attack surface presented by third-party and Nth-party dependencies. It underscores the urgent need to move beyond siloed vendor assessments towards a comprehensive, continuous, and resilient approach to supply chain security, integrating insights from operational reality, service delivery, and cutting-edge academic research. The global nature of modern supply chains, coupled with rapid technological adoption, makes understanding and mitigating these interconnected risks paramount for business continuity and security.

Background

▶ Watch: Introduction to third-party domino effect governance (0:00)

The modern enterprise operates within an intricate web of interdependencies, relying on a vast array of third-party vendors for everything from cloud computing and software development to payment processing and managed services. This reliance has exponentially increased the complexity of the digital supply chain, creating a fertile ground for the "domino effect" where a compromise in one component can reverberate across an entire ecosystem. Traditional approaches to vendor risk management often fall short, primarily because they tend to assess vendors in isolation, treating security as a procurement issue rather than a fundamental operational fragility.

The problem is exacerbated by the presence of fourth-party and fifth-party dependencies—vendors of vendors—which are often invisible to the primary organization. As Abdulrahman Almanea pointed out, a company might assess its direct third-party vendor, but remain oblivious to the security posture of the sub-vendors that its third party relies upon. This creates significant blind spots where vulnerabilities can propagate undetected. Professor Alharbi reinforced this, noting that executives often focus only on top-tier suppliers, neglecting the hidden, deeper layers where many cyber breaches originate.

Furthermore, the rapid adoption of new technologies and services, such as cloud offerings, API integrations, and increasingly, Artificial Intelligence (AI), introduces new vectors for risk that outpace the implementation of internal controls. Matthew Burroughs highlighted the critical blind spot of remote access into operational technology (OT) systems in manufacturing, where transparency into who is connecting and why is often lacking. The panel also touched upon the inherent fragility of foundational internet services like DNS, which, as Prof. Alharbi detailed from her extensive research, was not designed with security as a primary consideration, making it a critical, often hidden, dependency susceptible to widespread impact from even minor breaches. This confluence of expanded attack surface, invisible dependencies, and rapidly evolving technology necessitates a rethinking of supply chain governance.

Key Findings

▶ Watch: Hidden and fourth-party dependencies as blind spots (6:00)

The panel discussion yielded several critical insights regarding the challenges and necessary shifts in managing an interdependent supply chain:

1. Concentration Risk is an Operational Fragility: Abdulrahman Almanea emphasized that concentration risk should not be viewed merely as a procurement issue, but as a fundamental operational fragility. Metrics like a dependency ratio index (e.g., 40% of client data passing through one payment gateway), an integration gravity index (number of systems integrating with a major system via APIs), and a revenue index (impact on revenue if a component goes down, e.g., 22%) are crucial for quantifying this risk and convincing leadership. The key is a holistic business view rather than siloed vendor assessments.
2. Invisible Dependencies are the Biggest Blind Spot: All panelists converged on the idea that hidden dependencies—fourth-party, fifth-party, underlying cloud infrastructure, DNS providers, and API integrations—represent the most significant blind spot. Matthew Burroughs pointed to remote access into IT/OT systems as a major concern in manufacturing. Prof. Alharbi stressed that executives often overlook these deeper layers, which are frequently the source of major cyber breaches. The AWS East incident, CrowdStrike, and Cloudflare outages were cited as real-world examples of how shared underlying infrastructure can cause widespread, unexpected disruption.
3. Vendor Security Validation is Inherently Challenging: Matthew Burroughs provocatively stated that organizations "can't actually say someone's actually secure because everybody is secure until they're not." Abdulrahman agreed, noting that while programs involving vulnerability scanning, security practice checks, and even physical site visits exist (e.g., at Saudi Aramco, STC), they are costly, not continuous, and often limited to critical vendors. This highlights the need for continuous monitoring rather than snapshot assessments.
4. The Academia-Industry Gap Hinders Progress: Prof. Alharbi highlighted the struggles of academia in obtaining real-world data from companies for research, often resorting to generating or using publicly available, less authentic datasets. This gap limits the ability of researchers to develop theory-based use cases and insights directly applicable to industry problems, underscoring the need for greater collaboration and trust, as envisioned by Saudi Arabia's Vision 2030 R&D initiatives.
5. Innovation Lies in Shared Intelligence and Continuous Monitoring: Abdulrahman proposed a platform where organizations could share anonymized third-party risk assessment results, reducing redundant efforts and saving costs. This would allow for deeper, more frequent validations across the ecosystem. Matthew supported this, advocating for a platform that continuously monitors vendor health, open gaps, and vulnerabilities, enabling universal accountability.
6. Zero Trust and Responsible AI are Essential: The panel unanimously advocated for a zero trust approach ("verify everything but trust nothing") to manage the layered, interconnected, and shared infrastructure of modern supply chains. Prof. Alharbi also introduced the critical concept of responsible AI, emphasizing the need for transparency, explainability, governance, and security in AI models, especially as they increasingly drive critical business decisions in vendor evaluation, logistics, and cybersecurity monitoring.

Technical Deep Dive

▶ Watch: Overlooking cloud and DNS infrastructure dependencies (14:00)

The panel's discussion provided several technical insights into identifying, quantifying, and mitigating supply chain risks, moving beyond superficial assessments to a deeper understanding of digital interdependencies.

Abdulrahman Almanea introduced key metrics for quantifying concentration risk, which is fundamentally an operational fragility. These include:

• Dependency Ratio Index: This metric quantifies the proportion of critical operations or data flowing through a single vendor or component. An example given was 40% of client data transactions passing through one payment gateway. Such a high ratio immediately flags a significant single point of failure.
• Integration Gravity Index: This measures the number of systems integrating with a major system, whether through API integrations or direct system-to-system communications. A high integration count signifies a concentrated risk, as a compromise in the central system or its API could affect numerous connected applications. Matthew Burroughs strongly supported this, emphasizing the danger of granting excessive API permissions without understanding the full scope of access.
• Revenue Index: This metric ties the availability of a system or component directly to its impact on revenue. If the downtime of a non-heavily trafficked component could still impact, for example, 22% of an organization's revenue, it indicates a critical concentration of risk that demands attention, regardless of transaction volume.

The concept of blind spots was heavily explored, particularly concerning Nth-party dependencies (fourth, fifth parties) and underlying infrastructure. Abdulrahman highlighted the often-overlooked shared foundations such as cloud infrastructure (e.g., the AWS East incident) and DNS providers (e.g., Cloudflare outages). These foundational services, if compromised or experiencing outages, can take down vast numbers of seemingly unrelated applications and services that share the same underlying platform. Prof. Alharbi, drawing from her extensive research since 2014, underscored the inherent security weaknesses in DNS design and how "a small breach or a small issue in the DNS can affect the whole ecosystem," having tested this on millions of DNS providers and resolvers.

Matthew Burroughs brought an Operational Technology (OT) perspective, identifying remote access into industrial control systems as a significant blind spot in manufacturing. The challenge lies in achieving transparency into who needs access to OT systems, why, and what level of permissions are granted, especially at the bridges (e-wines) between IT and OT environments. He also stressed the importance of resilience testing, citing Novolex's annual drills to operate without internet for up to three days, demonstrating that even 100-year-old equipment can maintain production, mitigating the impact of external IT outages like the CrowdStrike incident.

The discussion also delved into the emerging technical frontier of Artificial Intelligence (AI) as both a risk and a potential solution. Prof. Alharbi noted that 78% of organizations (as per McKinsey's first half of 2025 statistics) are already using AI, often for critical decisions like vendor evaluation, logistics, and cybersecurity monitoring. However, she stressed that AI models themselves present security challenges due to their lack of explainability, transparency, governance, and inherent security flaws. Researchers from Stanford have highlighted these issues, emphasizing the need for responsible AI. Abdulrahman Almanea's company, Sirar by stc, has launched solutions to address AI security, authenticity, hallucination prevention, and data accuracy, recognizing the risks of AI poisoning and ensuring trustworthy AI engines. The panel concluded that securing the Large Language Models (LLMs) and understanding their training data, testing methodologies, and decision-making processes are paramount for using AI ethically and responsibly.

Demo / Proof of Concept

▶ Watch: Why truly validating vendor security is difficult (18:00)

The panel discussion focused on theoretical frameworks, practical challenges, and strategic recommendations for managing supply chain risk. As a panel format, there was no specific technical demonstration or proof of concept presented during the talk. The speakers relied on real-world examples and hypothetical scenarios to illustrate their points, such as the AWS East, CrowdStrike, and Cloudflare incidents.

Defensive Implications

▶ Watch: Leveraging responsible AI for zero trust security (26:00)

The insights shared by the panel offer critical guidance for cybersecurity defenders looking to bolster their posture against supply chain threats:

1. Adopt a Holistic, Business-Centric View of Risk: Defenders must move beyond siloed vendor assessments. Instead of evaluating vendors individually, assess the entire ecosystem from a business perspective. Utilize metrics like the dependency ratio index, integration gravity index, and revenue index to quantify concentration risk across critical business functions, not just individual technologies. This enables leadership to understand the true business exposure.
2. Map and Monitor All Dependencies, Especially Hidden Ones: Proactively identify and map fourth-party and fifth-party dependencies, as well as underlying infrastructure like cloud providers and DNS services. Implement continuous monitoring solutions that provide visibility into these deeper layers, rather than relying on static questionnaires or snapshot audits. For OT environments, strictly control and monitor remote access, ensuring full transparency on who connects, why, and with what permissions.
3. Prioritize Resilience Over Unattainable "Security": Acknowledge that 100% security is an illusion ("everybody is secure until they's not"). Instead, focus on building organizational resilience. Conduct regular, realistic drills to test the business's ability to operate during major outages or compromises affecting critical third parties (e.g., operating without internet for several days). Develop robust backup and failover strategies for critical services, including multi-cloud or multi-DNS provider approaches where feasible.
4. Implement a Zero Trust Architecture: Embrace the principle of "verify everything but trust nothing" across the entire digital supply chain. This means continuously authenticating and authorizing all users and devices, regardless of location, and applying least privilege principles to all access, especially for third-party integrations and APIs. Do not assume inherent security for any component, particularly foundational services.
5. Scrutinize and Secure AI Integrations Responsibly: As AI adoption grows, defenders must ensure its responsible and ethical use. When integrating AI-powered tools or models from third parties, demand transparency regarding their training data, testing methodologies, decision-making processes (explainability), and inherent security vulnerabilities. Implement solutions to prevent AI hallucination and AI poisoning, especially in critical decision-making scenarios. Focus both on using AI to secure systems and, crucially, securing the AI models themselves.
6. Advocate for Industry-Wide Collaboration and Data Sharing: Support initiatives for trusted platforms where organizations can share anonymized third-party risk assessment results. This collaborative approach can reduce redundant efforts, provide more continuous and comprehensive insights into common vendors, and raise the overall security baseline across the ecosystem.
7. Bridge the Academia-Industry Gap: Actively engage with academic researchers by providing anonymized data, real-world use cases, and challenging problems. This collaboration can help develop more effective, theory-based security solutions and foster innovation that directly addresses industry needs.

Key Takeaways

• Holistic Risk Assessment: Move beyond siloed vendor assessments to a comprehensive, business-centric view of supply chain risk, utilizing metrics like dependency ratio, integration gravity, and revenue impact.
• Identify Hidden Dependencies: Actively map and monitor fourth-party, fifth-party, and underlying infrastructure dependencies (cloud, DNS, APIs) as these are often the biggest blind spots and sources of major breaches.
• Prioritize Resilience and Testing: Acknowledge that 100% security is unattainable; focus on building and regularly testing organizational resilience, including the ability to operate during critical third-party outages.
• Implement Zero Trust: Adopt a "verify everything, trust nothing" approach across all interconnected systems and third-party interactions to mitigate risks from unknown or compromised elements.
• Secure AI Responsibly: As AI becomes integral, ensure transparency, explainability, and robust security for AI models, focusing on preventing hallucination and poisoning, and understanding their ethical implications.
• Foster Collaboration for Shared Intelligence: Advocate for platforms and initiatives that allow trusted sharing of third-party risk assessment data to reduce redundancy and enhance collective security posture.

About the Speaker(s)

• Matthew Burroughs: CISO for Novolex, a very large global pharmaceutical company. Matthew brings an operational perspective, particularly from the manufacturing sector, highlighting challenges like remote access into IT/OT systems and the importance of resilience testing for business continuity without internet access.
• Abdulrahman Almanea: Chief Advisory Services Officer (CASO) for Sirar by stc, a Saudi homegrown tier-one service provider. Abdulrahman offers insights from a service provider's viewpoint, emphasizing the need for holistic risk assessment beyond individual technologies and the potential for innovative platforms for shared vendor assessment results. His company is also actively involved in developing solutions for AI security.
• Prof. Fatemah Alharbi: Assistant Professor, Cybersecurity & AI Researcher, and Saudi Ambassador to GCRAI. Prof. Alharbi provides an academic and research-driven perspective. Her work focuses on critical areas like DNS security (with research dating back to 2014) and the ethical and responsible use of AI, highlighting the challenges of data access for research and the crucial gap between academia and industry.
• Ben Trowbridge: Board Member & Cybersecurity Advisor for Arctic Security. Ben Trowbridge served as the moderator for the panel, guiding the discussion and drawing out diverse perspectives from the panelists on complex supply chain security issues.