AN OPEN LETTER TO THIRD-PARTY SUPPLIERS

Summary from the TLDR InfoSec newsletter

Patrick Opet, CISO of JPMorgan Chase, penned an open letter addressing the increasing prevalence of SaaS as the preferred or exclusive method of distributing third-party software. Opet highlighted issues where third-party suppliers prioritize new features to compete with their competitors over security and where authentication and authorization are blurring together, leading to architectural vulnerabilities and hidden dependencies that the vendors themselves use. He calls on third parties to prioritize security and calls upon practitioners to push back against solutions that do not do so.