Third-Parties Add Risk Even For The Largest Bank In Italy

If you have a bank account in Italy or do business there, you might want to be aware of a recent incident involving that country’s largest bank. However, this is not just about a typical data beach. Unicredit reported that it has been the victim of a security breach and to blame was a third-party provider that had access to customer data related to personal loans. You see, this is not only a data breach, but also a reminder that when third-parties have access to a company network, there is added risk.

Unicredit reported that records of personal loan customers, but not passwords for were accessed for 400,000 accounts through this third-party. And while companies should be able to trust their partners, sometimes accidents happen; even when the utmost care is taken regarding cybersecurity measures.

Always ask a lot of questions when working with third-parties, whether they are suppliers, service providers, or consultants when they have access to your company’s information. Find out what they have in place to protect it and review their incident response plan. Make sure training is provided on how to protect sensitive data to everyone connecting to your network and that all mobile and other devices that anyone brings in follow the company security guidelines regarding bring your own devices (BYOD).

While we are on the topic, with all the devices that are brought into offices these days, it’s important to have a BYOD policy in place that includes a mandate that everything connecting to the network has anti-malware installed, it’s kept updated, and that whenever those devices are used outside the office, a VPN is used to connect.  Obviously, there are more details that can and should be included in a BYOD policy, but these are the minimum points to include. There are many resources available to help create one, as well as companies who can provide this service.

Next year, the European Union will introduce the General Data Protection Regulation (GDPR). These are rules for reporting data breaches that may result in fines for anyone violating them of €20 million or 4% of the annual turnover. These don’t just apply to European Union countries either. They affect anyone doing business with citizens there. If this applies to you, consider reviewing these before May of 2018.