Today’s dealerships are a complex network of interconnected tech systems and third-party providers that work in tandem to deliver the best customer experience. Your dealership may have dozens of outside companies accessing its system every day. Your DMS and CRM providers, payment processors, marketing platforms, OEM systems, and other vendors may all have some level of access to your dealership’s data or network.
Working with third parties is the name of the game, but exactly how much access do they have to your dealership? And more importantly… is that access secure?
Your vendors and third parties are there to make your job and your team’s job easier, but every connection creates another path into the dealership. Without proper safeguards, those connections open the door to cybercriminals lying in wait for the right time to strike.
Let’s look at three steps to understand where vendor risk exists and put the right safeguards in place.
1. Identify Your Exposure
-
Who can access your system?
-
What can they access?
-
Why do they need that access?
-
Is their access still necessary?
To give context to these questions, consider a third-party payment processor. This type of vendor handles highly sensitive financial information — information that could harm your customers if cybercriminals exploit it. So, if your dealership isn’t aware of current access and the extent of that access, those visibility gaps can lead to exposure and put your dealership at risk.
2. Build a Vendor Risk Inventory
If you had to list every vendor that can access your dealership’s system off the top of your head, could you? The answer is most likely — and understandably — no. You don’t need to memorize this information, but creating a central inventory of vendors with system or data access could make all the difference when it comes to safeguarding your dealership. This could look like an Excel sheet that includes the following information:
-
Vendor: Who is the vendor or third-party provider?
-
System/Data Access: What systems and information can the vendor reach?
-
Access Type: Does the vendor need all of that access, or can it be limited?
-
Authentication: Is multi-factor authentication required?
-
Security Practices: What controls does the vendor have in place? What happens if the vendor experiences a breach?
-
Last Reviewed: When was this information last reviewed?
Knowledge is power, and documenting this information is a big step toward locking down your dealership from outside interference.
3. Strengthen Your Security Strategy
Understanding visibility gaps and building a vendor risk inventory is only half of the story. The next step is managing this information effectively. Vendor management isn’t a one-time exercise. It requires constant oversight, and assigning a team member to review vendors is a good practice. This person should routinely:
-
Review vendor access and update vendor risk inventory.
-
Remove unnecessary accounts and permissions.
-
Require MFA and limit access wherever possible.
-
Set clear expectations for vendors handling sensitive information.
-
Establish a process for quickly revoking access when an employee or vendor relationship ends.
Vendor management can be time-consuming, but it’s an important element in keeping your dealership secure. Given the busy day-to-day nature of dealerships, the best option is to put vendor and third-party review into the hands of a cybersecurity partner. This way, a cybersecurity expert can identify third-party connections and potential vulnerabilities, conduct regular assessments to uncover outdated permissions and security gaps, and monitor the safeguards in place to ensure a safe tech environment at your dealership.
With
the right partner, your dealership can gain greater visibility into third-party risk — without adding another responsibility to your team’s plate.
