Vendor Security: Where Our Data Goes We Follow
summary
Panelists give concrete practices: use vendor questionnaires plus third‑party or in‑house pen tests (about 90% of high‑risk vendors get tested), triage by data access, and block shadow apps via OAuth whitelists. Scale with automation and division of labor — Google’s VSAQ open‑source collector, a remediation portal and triage scripts, Slack bots to kick off requests, and occasional third‑party firms to clear backlog. Track every request and surface vendor timelines to justify staffing.
AI-written summary · about
chapters (17)
- 0:00Introduction and welcome
- 0:21What is vendor security
- 1:03Panelist introductions
- 3:10Why invest in vendor security
- 5:57Evaluating vendor security posture
- 9:25Building vendor security into org
- 11:53Hurdles in vendor security
- 16:24Scaling vendor security at Google
- 17:30Scaling at Salesforce
- 18:35Scaling at Slack
- 19:38Outsourcing vendor reviews
- 21:00Data-driven vendor tracking
- 22:24Netflix's program evolution
- 23:25One Medical's program growth
- 24:50Macro-level program impact
- 26:19Lessons learned from the field
- 29:12Closing remarks and Q&A
related talks
23mAdventures in Vendor Security and Continuous Review
35mEffective Handling of Third-Party Supplier Incidents
41mAim-Ready-Fire
50mThe Application Security State of the Union
47mManaging Vendor Incidents
48mRemaining Resilient in the Supply Chainpocalypse
27mThird-party Risk Management: SOC 2s, Security Questionnaires...
43mApplication Security is a Community Effort