Winging It · Implausible Deniability
Some years ago, a man emailed me photographs of a door.
Fourteen of them, individually captioned, sent with the pride of a man announcing a firstborn. A month earlier I'd spent two days at his company's offices doing a security assessment, and anyone who's done supplier reviews for a living will know how those visits normally go. You're a nuisance. You get the dark meeting room that has a view of a brick wall, and everyone involved is counting the hours until you leave.
This was nothing like that. I'd flown to their city and my badge was waiting at reception. Everyone from the CISO down had cleared their diary for two days. Engineers queued up to show me things I hadn't asked about, and at some point on the first afternoon the CEO drifted past for a coffee, unannounced, in the way that CEOs never do anything unannounced.
I'd love to tell you all this was down to my reputation.
That logo changes the physics of the whole exercise. For most vendors a security assessment is a chore performed for a customer they could survive losing. For these companies the account was the business, everyone in the building knew what the contract was worth, and a finding from me arrived with the full weight of the account behind it. Nobody else gets this. I've done the same job for other employers before and since, and no CEO has ever drifted anywhere near me.
The assessment itself turned up what assessments turn up. On the first morning, before anyone knew I'd arrived, I got into the building behind a man carrying sandwiches, which rather set the tone, and by the second afternoon I'd established that access to the place rested heavily on a receptionist called Magda, who was excellent, but who was also one person with a buzzer. The corrective action plan went out by email a week later, written in the tone you use for these things, the tone that says I'm obliged to put this in writing and we both know it'll sit in a remediation tracker for the rest of its natural life.
The photographs arrived a month after I flew home. They'd rebuilt the entrance. Biometric mantrap, anti-tailgating sensors, somewhere north of half a million dollars, and beneath the final photograph sat a question, asked with what I can only describe as hope: would I like to fly back out and walk through it in person?
And the strangest part is that the door barely stood out. Findings were received like commandments carried down a mountain, and the fixes arrived at a pace I've never seen since. Vendors would ask whether there was anything else I'd like to look at, anything at all, and mean it.
A few years later I took a job at a challenger bank in London, running what was on paper the same program. The approach was different, questionnaires for most suppliers and on-site reviews for the critical few, but the job was the job. Find the gaps, get them fixed.
I sent the first questionnaire out and waited, and nothing came back, so I chased, and nothing came back from that either, and when I chased a third time I received an out of office from a man who, it later transpired, had left the company months earlier. When a response finally arrived, a third of the answers said N/A, including, memorably, against the question asking whether they had an information security policy. Several answers belonged to different questions entirely. Two said "see attached" with nothing attached. And everything else was answered with the SOC 2 report, offered as the response to thirty-odd separate questions, including several it didn't cover and at least one it directly contradicted.
Then came the negotiating. Their counsel wished to explore the definition of "personal data". A call was arranged to align on scope, which produced a second call, which produced a document called Scope Alignment v3 FINAL (2). The question about encryption at rest was, I was informed, commercially sensitive, and I have never discovered what is commercially sensitive about the word "yes".
The on-site reviews were, if anything, worse. At Apple I'd had two days and the run of the building. At the bank, arranging a visit carried all the urgency of a planning application, and what came back, after weeks of correspondence, was an offer of forty-five minutes in a meeting room within sight of reception, with a man from pre-sales who answered every technical question by writing it down.
Months of this. Vendor after vendor, until eventually, each time, the same ending: I'd dig out the master services agreement, find the audit clause, 14.3 in one case I remember fondly, and quote it back at them word for word, in an email so polite it was practically a threat. The transformation was miraculous, because diaries opened, buildings opened, and account managers discovered reserves of warmth that months of pleading had never located. The same request that had achieved nothing all quarter achieved everything in four days, from which I concluded that the contract is the only security control in existence with a hundred per cent adoption rate.
It took about three vendors for the penny to drop. My corrective action plans read exactly as they always had, and one of the companies stonewalling me was one I'd assessed years before, in the other life, when they'd have repainted their car park if I'd frowned at it on the way in. The only thing that had changed was the logo, on my lanyard back then and at the top of my emails now, and with that logo everything moved: response times, the seniority of whoever turned up, the willingness to answer a yes or no question with a yes or a no, and the general sense that anyone on their side much cared whether we lived or died.
Which tells you what vendor assurance actually measures: how much the vendor values your business, and precisely nothing else. You can vary the methodology all you like, spreadsheet or site visit or anything in between, and the instrument still returns a reading about whoever's holding it. It's a reading I'd spent years taking personally.
We'd tiered our vendors, naturally, by criticality and data sensitivity and all the rest of it. The vendors had tiered us right back, and we hadn't done well out of it. Somewhere in each of their systems sat a field, and that field decided whether our assessment landed on the desk of their CISO or with whoever had annoyed their manager that week.
And honestly, the arithmetic is hard to argue with. A vendor's security team has only so many hours, and the customer worth eight figures a year gets them. Nobody writes this down anywhere. Every customer is a valued partner, according to the emails. It's just that some partners get a biometric security door and some get Scope Alignment v3 FINAL (2), sent by registered post from the general counsel.
I did fly back. Of course I did. He met me at the new entrance, badge already waiting, and walked me through the mantrap himself, watching my face the whole way, and it was, I'm delighted to report, a tremendous door. Half a million dollars of anti-tailgating engineering, raised in a month, for an audience of one company. It remains the most sincere piece of security infrastructure anyone has ever shown me, and I walked through it twice, because once wasn't enough for either of us.
The bank's vendors, meanwhile, are protected by clause 14.3.
— Chris