Chapter 23 — Supplier and cloud services
Lesson map
Lesson 23 published. Map, example, EX067.
flowchart TD
N0["Learning outcomes"]
N1["23.1 Supplier list"]
N2["23.2 Security commitments"]
N3["23.3 Supplier accounts"]
N4["23.4 Cloud responsibilities"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX067"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["23.1 Supplier list"]
N2["23.2 Security commitments"]
N3["23.3 Supplier accounts"]
N4["23.4 Cloud responsibilities"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]
[Learning outcomes]
|
v
[23.1 Supplier list]
|
v
[23.2 Security commitments]
|
v
[23.3 Supplier accounts]
|
v
[23.4 Cloud responsibilities]
|
v
[Worked example] --> [Exercise EX067]
Learning outcomes
You will (1) list suppliers and their access; (2) check supplier security commitments; (3) manage supplier accounts.
23.1 Supplier list
Jamal lists Riverbend's suppliers with access to its systems or data: the booking system provider, the payment processor, the email provider, the café supplier, the camera maintenance company and the pool controller supplier. For each, he records what data they hold, how they connect and who manages the relationship. Ms. Grant explains that suppliers extend an organisation's attack surface, so knowing them is as important as knowing internal systems. He stores the list with the contracts and asks each relationship manager to confirm the details are correct and complete.
23.2 Security commitments
Jamal reviews contracts for security terms: data protection, incident notification, access control and data return at the end of the contract. The booking provider's contract is strong and refers to an ISO/IEC 27001 certificate covering its hosting service. The camera maintenance company's contract has no security terms. He recommends adding basic terms at renewal. He notes that a certificate is useful evidence only when its scope covers the service Riverbend uses. The IT manager adds the recommendation to the renewal checklist and asks the camera company for its current security practices in writing.
23.3 Supplier accounts
Several suppliers have accounts on Riverbend systems. Jamal finds the camera maintenance company has an always-on remote access account with a shared password. He recommends disabling it between visits, enabling it only for scheduled work and using individual accounts with multi-factor authentication. The IT manager agrees. He also adds supplier accounts to the quarterly account review, which had previously covered only staff. The camera company agrees to the new arrangement after a short discussion, and Jamal tests it during the next scheduled maintenance visit. The account is enabled at the start and disabled at the end, with both steps recorded in the IT log.
23.4 Cloud responsibilities
For cloud services, Jamal learns that responsibilities are shared. The provider secures its infrastructure, but Riverbend manages its own users, settings and data. He checks the email service settings and finds that external sharing of files is allowed by default. He restricts it to approved partners. Ms. Grant notes that many cloud exposures come from customer settings, not provider failures. He documents the change and checks the other sharing settings in the service, finding two more that allowed anonymous links. He restricts them as well and records all three settings in the documentation for future reviews.
Worked example
Jamal lists six suppliers, checks contract terms and certificate scope, disables always-on supplier access and restricts default cloud file sharing.
Synthetic case. Suppliers are synthetic.
Errors and limits
A supplier certificate is useful evidence only if its scope covers the service used.
Exercises
- EX067 — Missing terms. Which contract has no security terms? Rubric: 3 = camera maintenance company;; 2 = partly correct;; 1 = other;; 0 = none.
- EX068 — Supplier access fix. How is the camera company's access changed? Rubric: 3 = enabled only for scheduled work;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX069 — Cloud setting. What default cloud setting is restricted? Rubric: 3 = external file sharing;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 23 (chapter 23 of 30)
← Chapter 22 · Course chapter index · Chapter 24 →
Continue to the next authored lesson.