Evolving the approach to Third Party Risk Management

Evolving the approach to Third Party Risk Management

Speakers: Alessandro Miracca, Director Cybersecurity and Risk, Mastercard

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=FPHM3bQ5k

Overview

In an era defined by increasingly sophisticated supply chain attacks and stringent regulatory demands, effective Third-Party Risk Management (TPRM) has become a critical, yet often burdensome, challenge for organizations worldwide. Alessandro Miracca, Director of Cybersecurity and Risk at Mastercard, delivered a compelling presentation at DefCamp, shedding light on Mastercard's evolved, multi-tiered strategy for managing third-party risks. The talk underscored the imperative for companies to ensure their extended digital ecosystems maintain a security posture commensurate with their own, or at least adhere to a common security baseline.

Miracca highlighted Mastercard's significant investment in cybersecurity, including the strategic acquisition of Recorded Future, a leading threat intelligence platform, as part of a journey initiated in the early 2000s. This evolution reflects a shift from purely defensive measures to a more proactive, preventive, and predictive approach to cybersecurity. The core message of the presentation revolved around streamlining the often complex and resource-intensive process of monitoring third parties, making it more efficient and scalable for businesses of all sizes.

The talk provided a comprehensive deep dive into Mastercard's framework, which leverages a combination of proprietary tools, open-source integrations, and human advisory expertise to achieve continuous monitoring and holistic risk assessment. By categorizing vendors based on criticality and applying tailored assessment methodologies, Mastercard aims to mitigate the severe consequences of third-party failures, which can range from significant financial losses and regulatory penalties to irreparable damage to brand reputation and overall ecosystem maturity.

Background

▶ Watch: Introduction to Third Party Risk Management challenges (1:10)

The landscape of cybersecurity risks has fundamentally shifted, with third-party vulnerabilities emerging as a primary vector for major breaches. High-profile incidents like MoveIT, NotPetya, SolarWinds, and Kaseya serve as stark reminders of how a single compromise within a vendor's infrastructure can cascade into widespread disruption and compromise across an entire supply chain. These events underscore the "pain" associated with TPRM, a domain further complicated by the proliferation of regulations that mandate equivalent security maturity levels or shared baselines between organizations and their third-party partners.

Miracca framed the challenge within the classic "people, process, and technology" pyramid, emphasizing that these three elements must be synergistically led by a clear strategy. Strong processes empower people to effectively fulfill their cybersecurity roles, while robust technology is essential to complement human effort and ensure scalability. Supporting functions such as Security Information and Event Management (SIEM) for log management, Vulnerability Management to identify system weaknesses, automated Penetration Testing, and Threat Hunting all contribute to a comprehensive security posture. However, a critical failure in any of these pillars, particularly within the third-party ecosystem, can lead to severe consequences, notably impacting brand reputation and the overall security maturity of the entire digital ecosystem.

The traditional approach to TPRM often involves manual, labor-intensive assessments that struggle to keep pace with the sheer volume of vendors and the dynamic threat landscape. Companies, even smaller ones, often deal with hundreds of third parties, making it a significant burden to invest in the skilled personnel and time required for thorough, individual assessments. This inherent complexity and the potential for severe impact necessitate an evolved approach—one that prioritizes continuous monitoring, automates repetitive tasks, and provides a holistic view of risk, moving beyond mere compliance checkboxes to truly understand and mitigate systemic vulnerabilities.

Key Findings

▶ Watch: Quantifying cyber risks in financial terms with Cyber Quant (13:00)

Mastercard's core finding is that an effective and scalable TPRM strategy must be tiered and continuously monitored, moving away from static, point-in-time assessments. The talk introduced a sophisticated framework that begins with rigorous prioritization of vendors based on their criticality to the business. By mapping suppliers to core business processes, organizations can identify high-risk third parties that warrant more intensive scrutiny, while streamlining assessments for lower-priority vendors.

The framework is built on three distinct assessment tiers: low, medium, and high priority, each progressively integrating more advanced tools and analytical capabilities. A crucial finding is the emphasis on tool-driven automation to reduce the human burden, allowing skilled cybersecurity professionals to focus on complex advisory roles rather than repetitive checks. This automation is exemplified by the use of Risk Recon for external posture evaluation, Cyber Quant for quantitative risk assessment, and Cyberfront for breach and attack simulation.

Furthermore, a significant contribution is the integration of both qualitative and quantitative risk assessment, particularly the ability to translate cyber risks into potential financial losses. This allows cybersecurity discussions to resonate directly with top management, speaking their language of monetary impact. For the most critical vendors, Mastercard extends beyond purely cyber considerations to embrace a holistic risk assessment, incorporating financial, geopolitical, and catastrophic risks through its Systemic Risk Assessment (SRA) platform. This multi-faceted view is deemed essential for ensuring the resilience and stability of critical business processes supported by third parties.

Technical Deep Dive

▶ Watch: Holistic high-risk assessment: integrating cyber, financial, geopolitical risks (18:00)

Mastercard's evolved TPRM approach is meticulously structured across three tiers of vendor criticality, each leveraging a distinct set of tools and methodologies.

Low Priority Vendors: Outside-in Cyber Posture with Risk Recon

For vendors providing complementary services or those with lower business impact, Mastercard employs Risk Recon. This platform offers an automated cyber security posture evaluation from an outside-in perspective, meaning it performs non-invasive checks without requiring internal access or active penetration testing. As Miracca explained, Risk Recon executes "a ton of Nmap commands" against the target company's internet-exposed systems. This involves identifying open ports, understanding operating systems, and enumerating exposed services to construct a comprehensive map of the third party's external attack surface.

Risk Recon analyzes nine distinct domains, including software patching, web encryption, network filtering, and past breaches. The latter is achieved by integrating with Mastercard's own threat intelligence sources. Notably, Risk Recon is natively integrated with Shodan, a well-known search engine for internet-connected devices, allowing for cross-validation of collected data. The outcome is a qualitative risk score, typically ranging from 0 to 10 or A to F, which can be customized. This provides an immediate, high-level understanding of a company's cyber maturity, guiding decisions on where to allocate further assessment efforts. Risk Recon also features an action plan management module, allowing discovered issues to be tracked, assigned, and monitored for resolution.

Medium Priority Vendors: Quantitative Risk and Breach Simulation with Cyber Quant and Cyberfront

Vendors that occupy a middle ground in terms of criticality—perhaps involved in customer relationship management or ERP platforms—undergo a more comprehensive assessment. This tier starts with Risk Recon's outside-in view and integrates two powerful additional capabilities: Cyber Quant and Cyberfront.

Cyber Quant is a solution dedicated to the quantification of cyber risks. While it incorporates traditional questionnaires, its unique strength lies in Mastercard's customization of the FAIR Institute ontology (Factor Analysis of Information Risk) for cyber risk quantification. This customization allows Cyber Quant to provide not only qualitative scores (e.g., 0-5 according to ISO 27001 or 0-4 according to NIST Cybersecurity Framework) but, crucially, a quantitative assessment of potential financial loss. Miracca defined a crisis scenario as a "triad made by the attack methods, the threat actors and the target of the attack" (e.g., "a black hat group targeting customer personal information via phishing"). For such scenarios, Cyber Quant can estimate a precise monetary value of potential impact, enabling direct communication with top management in financial terms. To further enhance the accuracy and efficiency of questionnaire fulfillment, Mastercard is integrating support from Stick, a generative AI platform trained to process information security policies and SOC 2 reports, helping to mitigate human bias in self-assessments.

Complementing Cyber Quant is Cyberfront, a sophisticated Breach and Attack Simulation (BAS) platform. Cyberfront doesn't perform traditional penetration testing but rather simulates real-world attack scenarios to test the effectiveness of existing security controls. It boasts a threat library of over 1,000 different attacks, including various malware and kill chain scenarios based on techniques like file transfers or malicious email attachments. The simulation involves deploying an agent on a virtual machine within the target company's internal network, which then communicates with a server in Mastercard's Amazon cloud environment. Through this secure channel, Cyberfront launches numerous connection attempts and commands (e.g., via HTTP, HTTPS, FTP) to cover different attack schemas.

Cyberfront evaluates a wide range of defensive capabilities:

• Network Perimeter: Testing for open ports (e.g., port 80), firewall effectiveness, and Intrusion Prevention System (IPS) features by sending multiple malicious packages in a short time.
• Endpoint Security: Assessing Endpoint Detection and Response (EDR) solutions by attempting to deploy and execute malware.
• Security Operations Center (SOC): Checking if SIEM platforms trigger alerts for detected malicious activity on monitored workstations.
• Email Security: Evaluating sandboxing solutions and anti-spam filters by sending emails with nested malicious attachments.
• Data Loss Prevention (DLP): Testing the ability to prevent exfiltration of confidential data from workstations.

By cross-referencing Cyberfront's tangible, technological assessment results with the questionnaire responses from Cyber Quant, Mastercard can immediately highlight discrepancies and expose gaps in the perceived versus actual security posture of the third party. Miracca explicitly differentiated Cyberfront from automated penetration testing tools like Panta, aligning it more closely with Xcyber, focusing on simulating the entire kill chain rather than just individual machine vulnerabilities.

High Priority Vendors: Holistic Risk Assessment with Systemic Risk Assessment (SRA)

For the most critical vendors, those whose failure could significantly impact Mastercard's core business, the assessment integrates all the capabilities of the lower tiers and adds a Systemic Risk Assessment (SRA). SRA is a powerful platform that aggregates all threat intelligence sources available to Mastercard, including data from the clear, dark, and deep web, to provide a comprehensive overview of cyber risks, such as breach events and exposed credentials.

Crucially, SRA extends beyond purely cyber risks to incorporate financial risks, geopolitical risks, and catastrophic risks.

• Financial Risks: SRA integrates with sources like Bloomberg to analyze news and financial data, providing insights into a company's financial stability.
• Catastrophic Risks: It uses data on natural events (e.g., floods, earthquakes, weather forecasts) and geographical information (e.g., location of data centers in prone areas) to assess potential impacts from natural disasters.
• Geopolitical Risks: This involves analyzing news feeds related to regional conflicts, government stability, and emerging legislation that could affect the vendor's operations.

This holistic approach is considered paramount for high-level risk assessments, as the interplay between cyber, financial, geopolitical, and catastrophic factors provides a more complete picture of a critical third party's overall resilience and stability. Mastercard's experience with Fortune 500 companies and SMEs alike demonstrates the value of this comprehensive framework in establishing robust security hygiene and baseline controls across diverse vendor ecosystems.

Demo / Proof of Concept

▶ Watch: Cyberfront: Breach and Attack Simulation methodology explained (24:30)

The talk primarily focused on the architectural and functional description of Mastercard's TPRM framework and the tools it employs, rather than a live demonstration or proof of concept. While no explicit demo was presented, the speaker provided detailed explanations of how each tool—Risk Recon, Cyber Quant, Cyberfront, and SRA—operates and the types of insights they generate.

For instance, the description of Risk Recon detailed its use of Nmap commands to map external attack surfaces, showcasing how an "outside-in" perspective can quickly identify exposed systems and services. The explanation of Cyberfront provided a conceptual walkthrough of its Breach and Attack Simulation (BAS) capabilities, describing how agents within a target network communicate with external servers to simulate various attack kill chains, test firewall rules, EDR effectiveness, and SIEM alerting mechanisms. While the audience did not witness a live execution, the technical specificity painted a clear picture of the tools' operational mechanics and their ability to generate tangible, evidence-based assessments of security controls. The discussion also touched upon the future integration of Stick, a generative AI platform, to assist in questionnaire fulfillment, further illustrating the innovative, automated approach Mastercard is pursuing.

Defensive Implications

▶ Watch: Tips for suppliers to prepare for assessments (40:30)

Mastercard's evolved TPRM framework offers several crucial defensive implications for both organizations managing third-party risks and the third parties themselves.

For organizations implementing TPRM, the primary implication is the necessity of a tiered and prioritized approach. Rather than applying a one-size-fits-all assessment, companies should strategically allocate resources based on a vendor's criticality to core business processes. This ensures that the most significant risks receive the deepest scrutiny, while automated tools streamline assessments for lower-priority partners. The integration of tools like Risk Recon, Cyber Quant, Cyberfront, and SRA highlights the importance of leveraging technology for continuous monitoring and to reduce the manual burden associated with TPRM. This automation frees up skilled cybersecurity professionals to focus on advisory roles, connecting the dots between technical findings and broader business implications, and coordinating with procurement and legal departments. Crucially, for high-priority vendors, embracing a holistic risk assessment that includes financial, geopolitical, and catastrophic factors is paramount to ensure comprehensive resilience against a wider spectrum of threats.

For suppliers and vendors on the receiving end of such assessments, the key takeaway is the profound benefit of aligning with established cybersecurity standards and best practices. Miracca explicitly advised suppliers to adopt frameworks like ISO 27001 and the NIST Cybersecurity Framework, or industry-specific standards. This alignment provides a common language and a measurable benchmark for their security posture, making the assessment process smoother and more transparent. It allows for easier comparison against peers and ensures that the evaluation accurately reflects reality, rather than a unique, difficult-to-categorize posture. Furthermore, suppliers should be prepared to provide evidence-based responses to questionnaires, as tools like Cyberfront will validate self-attestations with tangible technical checks. Proactively managing and resolving identified issues, potentially using features within platforms like Risk Recon to track action plans, demonstrates commitment to security and can significantly improve assessment outcomes. Building a robust security hygiene, regardless of company size, is not just about compliance but about demonstrating resilience and trustworthiness to critical partners.

Key Takeaways

• Prioritization is Paramount: Effective TPRM starts with rigorously categorizing vendors based on their criticality to core business processes, allowing for tailored assessment efforts.
• Automation is Essential for Scale: Leveraging tools like Risk Recon, Cyber Quant, and Cyberfront streamlines repetitive tasks, reduces human burden, and enables continuous monitoring across a large vendor ecosystem.
• Quantify Cyber Risks in Financial Terms: Translating cyber risks into potential financial losses (e.g., "10-20 million euros") through tools like Cyber Quant enables direct and impactful communication with top management.
• Validate Controls with Breach and Attack Simulation (BAS): Platforms like Cyberfront provide tangible, evidence-based validation of security control effectiveness by simulating real-world attack kill chains, identifying gaps between perceived and actual security postures.
• Embrace a Holistic Risk View for Critical Vendors: For high-priority third parties, assessments must extend beyond cyber security to include financial, geopolitical, and catastrophic risks through tools like SRA, ensuring comprehensive resilience.
• Align with Industry Standards: Suppliers should proactively align with recognized cybersecurity frameworks such as ISO 27001 or NIST Cybersecurity Framework to streamline assessments and provide a common, measurable baseline for their security maturity.

About the Speaker(s)

Alessandro Miracca is the Director of Cybersecurity and Risk at Mastercard, based out of the company's Milan office. In his role, he is responsible for the delivery of cybersecurity services across Europe. Miracca's presentation provided insights into Mastercard's significant and evolving investment in cybersecurity, highlighting the company's strategic acquisitions, such as Recorded Future in December 2024, as part of a long-term journey initiated in the early 2000s. His work focuses on shifting Mastercard's approach from reactive defense to proactive prevention and prediction in the cybersecurity domain, particularly in the critical area of Third-Party Risk Management.