Third-Party and Supply-Chain Risk

Lesson plan

Level

Beginner

Time

About 50 minutes; the steps below add up to 50

Learners judge how secure a house is when a cleaner keeps the spare key in an unlocked drawer, and which supplier deserves more scrutiny, before inherited risk is named. Predictions then precede the ways a supplier brings risk, whose browsers run an altered script, what changes over a contract and who answers for a supplier’s breach; checks follow why web skimming goes unnoticed and which lifecycle stage catches a change. The habit to build: for every supplier, ask what it can reach, what it holds and who still answers for it.

Objectives

• Explain how organisations inherit risk through suppliers, services, software and loaded content
• Describe how web skimming works, using the British Airways Magecart example
• Follow supplier risk management from identification to exit, in proportion to the risk
• Explain why accountability stays with the organisation

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Treating Risk lesson first.
• The British Airways case is summarised in general terms; refer to the regulator’s published notice for its detail rather than describing it from memory.
• The lesson takes about 50 minutes.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain how organisations inherit risk through suppliers, services, software and loaded content
   • Describe how web skimming works, using the British Airways Magecart example
   • Follow supplier risk management from identification to exit, in proportion to the risk
   • Explain why accountability stays with the organisation

   Purpose: Learners judge how secure a house is when a cleaner keeps the spare key in an unlocked drawer, and which supplier deserves more scrutiny, before inherited risk is named. Predictions then precede the ways a supplier brings risk, whose browsers run an altered script, what changes over a contract and who answers for a supplier’s breach; checks follow why web skimming goes unnoticed and which lifecycle stage catches a change. The habit to build: for every supplier, ask what it can reach, what it holds and who still answers for it.

2. 1. A spare key Think 5 min

   Purpose: Raise inherited risk with an everyday spare key.

   Ask

   • How secure is the house now?
   • Which supplier needs more scrutiny?

   Responses to expect

   • “Only as secure as the drawer” usually comes quickly.
   • On screen in turns: the opening question, its answer; then the question on paper or administrator access, and its answer.

   Discussion pause: Let learners suggest what the householder could do about the key before revealing.

   In the lesson window

   • Think it through: Your house has strong locks, but a cleaning company has a spare key, which it keeps in an unlocked drawer at its office. How secure is your house now?
   • Think it through: Which supplier needs more security scrutiny before signing: one delivering printer paper, or one with administrator access to every system?

3. 2. Inheriting risk from others Predict 6 min

   Purpose: Show the four ways third parties affect risk.

   Ask

   • How could a supplier bring risk in?

   Responses to expect

   • Access and data come first; loaded scripts are often missed.
   • On screen in turns: the opening; then the question on ways a supplier brings risk, and its answer; four relationships, with the risk each brings held back; the risk each brings; risk grows with access, data and trust.

   Misconceptions to challenge

   • A learner may believe: “If our own systems are secure, suppliers don’t matter.” Respond: A supplier’s weakness can create a route in, however strong our own controls.

   Discussion pause: The risk column is held back: for each relationship, ask how it could bring risk in before revealing it.

   In the lesson window

   • Think it through: Name as many ways as you can that a supplier could bring risk into an organisation.

4. 3. Example: British Airways and Magecart Predict 9 min

   Purpose: Explain scripts, web skimming and supply-chain attacks, with the controls against them.

   Ask

   • Whose browsers run the altered script?
   • Why does nobody notice?

   Responses to expect

   • Many assume scripts run on the company’s server.
   • Reveal how web skimming works one step at a time; before each, ask what the attacker needs next.
   • On screen in turns: the opening; then the question on whose browsers run the script, and its answer; the British Airways incident; how web skimming works, starting with the scripts a page loads; the attacker alters one; every browser runs it; it copies what customers type; the page keeps working; the check question on why nobody notices, and its answer; the supply-chain attack; what is known of the real incident; controls against web skimming.

   If the explanation does not land: Compare a script loaded from elsewhere to a leaflet a shop lets another company put in every bag.

   In the lesson window

   • Think it through: A payment page loads a chat script from another company. If someone altered that script, whose browsers would run the altered version, and what could it see?
   • Check your understanding: Why might neither customers nor the organisation notice the altered script?

5. 4. Managing supplier risk across the relationship Predict 10 min

   Purpose: Walk the supplier lifecycle and proportionality, with the booking-provider example.

   Ask

   • What might change over three years?
   • Which stage catches a new script source?

   Responses to expect

   • Exit is the stage most often forgotten.
   • Diagram: step through the five stages; at each, ask what the booking provider example would need.
   • On screen in turns: the opening question, its answer; then supplier risk across the relationship, one stage at a time; the diagram’s stages one at a time; the check question on a new script source, and its answer; proportionality; kinds of agreement; choosing an online booking provider, starting with what it will touch; assessing proportionately; the contract; monitoring; planning the exit; who remains accountable.

   Misconceptions to challenge

   • A learner may believe: “A certified supplier is a safe supplier.” Respond: A certificate covers a scope at a point in time.

   To go further

   • Which of the agreements in the Go deeper table would hold a right-to-audit clause for the booking provider?

   In the lesson window

   • Think it through: A supplier passed every check when the contract was signed three years ago. What might have changed since, and what will need doing when the contract ends?
   • Check your understanding: A year after signing, a booking provider starts loading its script from a new source. Which stage of the lifecycle should catch that?

6. 5. Accountability stays with the organisation Predict 5 min

   Purpose: Show that accountability is not transferred.

   Ask

   • Is the breach “not our problem”?

   Responses to expect

   • Some think the contract moves responsibility.
   • On screen in turns: the opening question, its answer; then what a supplier does not transfer, starting with treating risk; data protection; assurance; a simple supplier inventory.

   Misconceptions to challenge

   • A learner may believe: “Outsourcing a service outsources the responsibility.” Respond: The organisation remains accountable for choosing and overseeing suppliers.

   In the lesson window

   • Think it through: A booking provider suffers a breach of learners’ details. The training organisation says, “Not our problem: they hold the data.” Is that right?

7. 6. Apply it in a new situation Apply 5 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The old access tests exit; the analytics script tests controls; the questionnaire tests proportionality.
   • On screen in turns: the opening; then the question on forgotten access, and its answer; the question on a free analytics script, and its answer; the question on one questionnaire for everyone, and its answer.

   In the lesson window

   • Apply it: An audit finds that a support company the school stopped using two years ago still has remote access. What went wrong?
   • Apply it: A shop adds a free analytics script from a new provider to its payment page. Which control would most directly limit the risk?
   • Apply it: A council sends the same 200-question security questionnaire to every supplier, from a sandwich firm to its payroll provider. What is the problem?

8. 7. Check your understanding Check 7 min

   Purpose: Check the lesson against the approved revision-bank questions.

   Ask

   • Answer individually, then compare before revealing.

   Responses to expect

   • The web-skimming questions link to the Magecart step.
   • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

9. 8. What to remember Consolidate 3 min

   Purpose: Summarise the five points, the key terms and the misunderstandings.

   Ask

   • Without looking: the five lifecycle stages.

   Responses to expect

   • Identify, assess, contract, monitor, exit.
   • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

10. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Suppliers bring risk in with them.
    • A loaded script runs in every visitor’s browser.
    • From selection to exit, not just at signing.
    • Scrutiny in proportion.
    • Accountability stays at home.

Consolidation

• Suppliers bring risk in with them.
• A loaded script runs in every visitor’s browser.
• From selection to exit, not just at signing.
• Scrutiny in proportion.
• Accountability stays at home.