Third Party Vendor Management
StaffCop provides third party vendor monitoring, threat detection and data loss prevention in a single platform
Request demo
The risk of third-party vendor access
Third party vendors, partners, consultants and outsourced contractors often have privileged access to a company’s internal systems through root or domain administration rights. As privileged insiders, they can change system configuration, steal company data as well as sabotage critical infrastructure. Even with no malicious intent, an external vendor is a major security liability. There are also strict regulatory requirements for some industries like banking, healthcare etc. where vendor monitoring is mandatory to ensure privacy and protection while data is transferred or processed between two parties.
For these reasons, an organization should setup a security perimeter when giving access to external vendors and contractors. It then needs a way to continuously monitor all vendor activity to ensure they conform to the company’s security policy and rules. Some compliance regulations also require organizations to keep a detailed record of any security, privacy or data breach incidents caused by a third-party.

StaffCop Third Party Vendor Management: activity monitoring, threat detection and data loss prevention in a single platform
With features like user activity monitoring, privileged user management, advanced authentication and access control, remote user monitoring and support for virtualization services, StaffCop offers an unrivaled platform to monitor, control and protect third party vendors to ensure access is only granted to systems needed, decrease the chances of accidental mistakes that can damage system settings, and help improve IT safety measures. In addition, StaffCop helps you meet many regulatory compliance requirements as it relates to third party vendor management with its extensive user activity monitoring, data exfiltration protection, audit, reporting and forensics capabilities.
1
Real-Time Activity Monitoring
Monitor all user activity covering 22+ system objects like: web pages, apps, email, file transfers, instant messaging, social media and more.
2
Authentication and Access Control
Identity based authentication and segregated access control prevent unauthorized access and sharing of sensitive systems and data by a third-party.





3
Intelligent Policy and Rules Engine
Create monitoring profiles for individual vendor or groups. Configure rules for dangerous vendor behaviors like abnormal login, privilege escalation etc. with hundreds of pre-built rules or create your own with an intuitive, visual Policy and Rules Editor. Automatically warn or take control on detection of any rule violations or anomalies.
4
Audit and Forensics
Get access to seamless real-time streaming of a vendor’s screen and an extensive visual history of all actions. Immutable logs and reports provide a vast collection of investigation data in case of an incident.


5
Vendor Risk Management
Identify high risk vendors, policies and system components on a dedicated risk dashboard. Sophisticated risk scoring helps identify and focus on areas of vulnerabilities.



6
Productivity & SLA
Built-in productivity tools let you establish a continuous feedback loop with your vendor network. Refine and adjust your organizational workflow through tracking contract schedules, projects, budget and engagement rate to improve vendor SLA and QA.
7
Compliance Management
Conform with various compliance requirements in respect to third party monitoring. For example: implementing audit trails (GDPR), limiting unauthorized login (ISO 27001), prevent unencrypted file transfers (PCI DSS), reporting, and more.
Third Party Vendors: A Weak URL in
Cyber Security Chain
3rd-party incidents are a reality for many companies
In a 2016 global survey of 170 companies, Deloitte found that 87% have experienced an incident with a 3rd-party. Source: Deloitte.
87% Suffered a Disruptive 3rd-Party Incident
3rd-party vendors have access to critical systems
3rd-parties have to access many VPNs, networks, and platforms confirmed by 75% of organization leaders. Source: SOHA.
75% Agree Third-Parties Have Access to Critical Systems
Organizations spend millions on 3rd-party breaches
On average, organizations spend $10+ million responding to 3rd-party breaches each year. Source: Riskonnect.
Avg. $10M+  Spent on 3rd-Party Breaches by Organizations
Many companies lack 3rd-party security standards
In a global survey of companies, PwC found that only 52% have security standards in place for 3rd-parties. Source: PwC.
Only 52% of Organizations Consider 3rd-Party Security a Priority
How Third Party Vendors Cause
Security Risks

Malware infection
Opening an infected email or visiting a website with malware that can spread in an organization's system.
Database access
Attempting to log in to database servers during off-hours or after the completion of a project.
Privilege elevation
A vendor attempting to bypass security clearances and gain additional access by exploiting a bug, design flaw or configuration oversight in an operating system or software application.

Data exfiltration
A vendor abusing access within a system to view confidential customer and employee records.
Cloud security
Any access to cloud-based storage services, which can lead to confidential information being transferred out of the system.
Steganography
Utilizing screen-capturing software to share confidential files and security information with unauthorized sources outside the organization.
Third Party Vendor Management
Use Cases
IT Services
The risk of third-party vendor access
IT services businesses, MSPs and hosting providers often need to monitor vendor activity in the company servers to enforce SLA and process billing. Another aspect of IT services is that, employees of third party professional services can access your organizational databases, configure servers and often setup IT security systems. They should be treated with same vigor as your other privileged employees and scrutinized for all their activity.
Solution
With StaffCop’s activity monitoring solution, it’s possible to quickly see (and prove) exactly who worked on the servers, when, for how long and what they did to ensure security and process accurate billing and SLAs.
In addition, StaffCop supports ISO 27001 compliance that further ensures an organization’s overall IT security measures are covered with a single solution.

Financial Services
Industry challenge
Banks and other financial institutions often outsource operational functions to contractors or use third parties to offer value added services. An increasing number of banks are also outsourcing core banking operations (i.e. accessing demand deposit accounts through bankcards) to third party vendors. This creates a new avenue of threats for both the banks and their customers. Regulations and laws are enacted to make sure banks held their vendors accountable for their activities. For example, Federal Financial Institutions Examination Council (FFIEC) recently released the Cybersecurity Assessment Tool that states, “Financial institutions must understand the complex nature of arrangements with outside parties and ensure adequate due diligence for the engagement of the relationships and ongoing monitoring.”
StaffCop solution
With StaffCop’s activity monitoring solution, it’s possible to quickly see (and prove) exactly who worked on the servers, when, for how long and what they did to ensure security and process accurate billing and SLAs.
StaffCop helps banks and financial institutions uncover potential cybersecurity weaknesses in their online banking system and develop threat intelligence with behavioral and content-based analysis of secure financial data. With continuous monitoring, a bank can prevent bad practices by its vendors and if necessary, conduct detailed file search to make sure vendors are using the right forms, following the agreement and addressing customer request on a prompt and responsive manner.

Retail / E-Commerce
Industry challenge
Retails and e-commerce merchants and any business processing payment information must comply with PCI DSS. This entails stringent information security requirements for the merchants and their vendors while processing credit card transactions or dealing with customer data. For example, it’s on you, as a merchant to ensure that third party service providers (TPSPs)/vendors you do business with are also following the compliance protocol. You should be able to list each vendor your company does business with, confirm what services they provide, and make sure that each provider listed is compliant with the PCI DSS on an ongoing basis.
StaffCop solution
The simplest way to ensure PCI DSS compliance and proper auditing is to add third party vendors into your existing  monitoring and auditing system so that you both have a common, transparent, end-to-end auditing system.

Retail / E-Commerce
Industry challenge
Health Insurance Portability and Accountability Act (HIPAA) is designed to facilitate efficient flow of the healthcare data and protect patient’s Personally Identifiable Information (PII), Personal Health Information (PHI) and Electronic Health Record (EHR) from fraud, theft or other misuse. HIPAA covered organizations must protect these data not just from their employees but ensure any contractors or Business Associates (BAs) has systems in place to comply with the regulation. There are even specific Administrative, Security and Technical Rules for such addressable implementation specifications.
StaffCop solution
StaffCop helps healthcare organizations conform with ongoing privacy and security requirements of HIPAA regulated PII, PHI and EHR data from both internal and external users.
With StaffCop, you can create security profiles for vendors allowing or restricting access to patient records on a need to know basis. Granular activity monitoring of all system objects like files, networks, websites, apps, emails etc. helps enforce privacy policy. Use instant alerts and audit trail to meet the HIPAA security review and reporting requirements.

Telecom
Industry challenge
Telecommunications is a fundamental backbone in today’s world. Like utilities and other critical infrastructures, it touches everyone including people, businesses and government. This is why telecom operators and ISPs are often the primary target of cybercriminals. And these criminals are getting desperate. According to a telecom threat intelligent report by Kaspersky, cybercriminals are recruiting insiders including contractors and vendors to gain access to telecommunications networks and subscriber data. They blackmail the targeted insiders forcing them to handover credentials or distribute spear-phishing attacks on the criminal’s behalf.
StaffCop solution
With StaffCop’s privileged user monitoring and intelligent behavioral analysis, telecom providers can look out for compromised vendors who show abnormal signs, like: attempting to bypass security clearances and gain additional access, attempt to change system component etc.
Moreover, StaffCop’s granular activity monitoring and data loss prevention solution is designed for high-grade security standards like NERC-CIP, NIST-FISMA, ISO 27001 for critical infrastructure providers like telecom and utilities.

GDPR / Privacy Data Protection
Industry challenge
Since May 2018, any organization handling EU citizens’ personal data has to comply with the GDPR law. Known as the Controller, these organizations also have to ensure the GDPR compliance for its Processors. A Processor is someone following instructions from the data controller to collect/process the personal data (PII), in other words a third party vendor. Any controlling organization employing a third party vendor to process EU citizens’ personal data, will be responsible for their GDPR compliance.
StaffCop solution
Third-party vendor management, access control and contractual oversight is required to make sure a GDPR Controller has implemented the right accountability procedures for its Processor(s).
StaffCop can ensure your third party is processing privacy data only in the context it is required to be processed. Additionally, the software can be configured with restricted feature sets allowing for further privacy of EU customers. Extensive reporting and forensic capability help you fulfill GDPR’s record keeping and breach reporting requirements.

Authentication and Access Control
Identity based authentication and segregated access control prevents unauthorized access or sharing of confidential data outside your organization. You can setup an access account for each vendor that is going to need authorized clearance and easily track what each vendor is doing at any given time. Create profiles for regular, privileged and contract/external users and then define what information and system resources each profile can access.
Session Recording and Playback
Live view and history playback provide seamless real-time streaming of third party vendor activity through the dashboard as well as an extensive visual history of all actions taken for both on-site and remote vendors. All actions can also be searched via metadata, regular expression and natural language. Recordings can be tagged by time and date highlighting any alerts and notification.
Reduce Administrative Overhead
StaffCop has a dedicated Risk dashboard where the supervisor can conduct organization-wide risk assessment. Risk can be profiled by vendors, departments responsible for the vendor or by system objects accessed by the vendor. Reports can be derived by severity of risks or by how many times security violations occurred. Unique Risk Scores helps you identify high-risk vendors or policies so that plans can be developed for treating the risks.
Enterprise-Wide Monitoring and Tracking
Setup specific monitoring profiles for vendors separate from your regular users. Define what actions and system resources the vendor will be monitored for, when and how. Set schedule for when vendors can log into systems and from which locations. Give access upon manual approval or limit their access within certain applications, networks, websites or by time slots
Document Tracking
Monitor the interactions between third-party vendors and your data including reports on: who accesses data, when the data is accessed, any changes, abnormal activity or any attempts made to alter the data. The document tracking ability can be configured to fit your policies. Some examples of the possibilities with document tracking are: documents transferred to emails as an attachment, USB, Dropbox, Google Drive, documents printed etc. The goal of document tracking is to supply organizations with a view into what interactions vendors are making with your data.
Remote Desktop Control
Remote contractors and vendors can enjoy the simplicity of tracking their project and time with StaffCop with the click of a mouse. Once the StaffCop agent is started, all actions and data are recorded. You can take control of an external vendor's desktop control and access at the first sign of malicious activity to eliminate threats of all kinds.
Powerful Policy and Rules Editor
A user's ability to access a desktop can be instantly taken away by putting StaffCop's remote control feature to use. Manually overriding an account removes the user from the equation, ensuring that activity is contained, and potential threats are eliminated. Remote control can be started by simply clicking on the remote icon on all live sessions. Override all manual inputs by a user to prevent sensitive data from being altered and data breaches from occurring.
Integrated Threat Management
Attain full knowledge of which vendors are accessing systems and network resources with in-depth activity reports. Receive real-time alerts for high-risk vendor behavior. Session logs, anomaly and risk analysis, incident reports make your findings and observations tasks easier by identifying where sensitive data is stored, who accessed it and how. Finally, event triggers and logs from StaffCop can be send to SIEM and other analytics tools for a holistic threat management system.
Ensure Quality of Service
Built-in productivity tools let you establish a continuous feedback loop with your vendor network. Refine and adjust your organizational workflow through tracking contract schedules, projects, budget and engagement rate to improve vendor SLA. If your vendors handle customer care services, you can monitor their performance and quality and if necessary, conduct detailed investigation to make sure vendors are using the right forms, following the agreement and addressing customer request on a prompt and responsive manner.
Compliance Management
Many organizations are required to follow several regulatory, cybersecurity, administrative and privacy standards that includes vendors accountability and liability protection. StaffCop has built-in support for many of these compliance standards including HIPAA, GDPR, PCI DSS, ISO 27001 etc. and can be adapted to support evolving compliance requirements with its powerful Policy & Rules editor and various monitoring and reporting capabilities.
Need a More
Comprehensive Solution?
Information Security
Receive the required data “on the fly”. Search by keywords and regular expressions. Record sound from microphones to hear what was happening at the moment of interest.
Try for free
Remote Administration
View remote desktop without being notices. Take control over a workstation. Full picture of software and hardware usage. Intensity of usage and registry of states..
Try for free
Recommend
Employee Monitoring
Categorize applications and web-sites into productive and unproductive. Set up different configurations for particular users, groups and departments. Compare results. ...
Try for free
Flexible Deployment Options
Bare Metal
Install on bare metal from our ISO image containing Ubuntu 18.04 and StaffCop or install StaffCop packages on existing Ubuntu 18.04.
Virtual Machine
Install on any OS as a virtual machine from our ISO image, use Virtual Box, VMWare, Hyper-V or any other virtualization system. Easy administrating without risking the host machine.
Private Cloud
Use your own secure, scalable private cloud implementation including AWS, Google Cloud, Azure and more
92% of companies detect serious violations when testing StaffCop
Feature-rich, affordable with annual and perpetual licensing options
Russia, Novosibirsk, Koptug Road 4, Sobolev Institute of Mathematics

© Atom Security LLC, 2001–2020. All rights reserved. All trademarks are the property of their respective owners.
Made on Quarkly