Build the vendor register and find the one nobody owns

applied · 75 min · Objective 5.3

Task

Inventory the third parties a small estate depends on, including the ones nobody thinks of as vendors, and set the monitoring cadence for each. The vendor nobody owns is the one whose certificate lapsed two years ago.

Steps

  1. List every third party your lab estate depends on. Push past the obvious: the operating system vendors, the package repositories, the container registry, the certificate authority, the DNS provider, the hypervisor vendor, and anything you download tooling from.
  2. Write /tmp/vendors.csv with the columns vendor,service,data_they_hold,access_they_have,criticality,owner,last_assessed,next_review,evidence_type.
  3. Set criticality from two questions: what happens to you if they are breached, and what happens if they simply stop.
  4. Set the review cadence from criticality, not uniformly. A critical vendor annually, a minor one every three years.
  5. Identify the single points of failure: vendors whose loss would stop a business function with no alternative. Mark them, because the business continuity plan from Domain 3 needs to know.
  6. Find the gaps: any vendor with no owner, no assessment date, or evidence older than its cadence. Those are the findings.

Verify

python3 - <<'PY'
import csv,datetime,re
rows=list(csv.DictReader(open('/tmp/vendors.csv')))
assert len(rows)>=8, 'fewer than eight third parties - push past the obvious ones'
noowner=[r['vendor'] for r in rows if not r['owner'].strip()]
nodate=[r['vendor'] for r in rows if not re.match(r'\d{4}-\d{2}-\d{2}', r['next_review'].strip())]
crit={r['criticality'].strip().lower() for r in rows}
print('criticality levels used:',crit)
assert len(crit)>=2, 'every vendor has the same criticality - the cadence cannot differ'
print('vendors with no owner:',noowner or 'none')
print('vendors with no next review:',nodate or 'none')
assert not noowner, 'unowned vendors are the finding - assign them'
assert not nodate, 'every vendor needs a next review date'
PY
grep -ciE "single point|no alternative|stop" /tmp/vendors.csv

The assertions require at least eight third parties and a genuine spread of criticality. Eight is deliberately more than people expect — the certificate authority, the DNS provider and the package repository are all third parties whose compromise reaches you directly, and almost nobody has them on a vendor list.

Notes

The single points of failure are the rows that belong in the continuity plan. Your recovery capability is limited by theirs, and a business impact analysis that maps functions to internal systems and stops there has missed the vendor whose outage stops the function regardless of what your own estate is doing.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.