When most people think about cybersecurity breaches, they think about hackers breaking in from the outside. But a staggering proportion of incidents involve compromised user accounts : and vendor accounts are among the most dangerous. A third-party user has legitimate credentials, legitimate access, and often far more permissions than they actually need.
Start with Identification
Before you can secure vendor users, you need to know who they are. This sounds obvious but is often missed: some vendor users may have accounts that appear to be internal (using your organization's domain) rather than identifying them as third parties. Audit your identity systems to ensure all third-party users are clearly identified and tagged as such, regardless of how their accounts were provisioned.
The Three Steps of Access Control
All access control follows three sequential steps: 1. Identification: The user claims an identity (e.g., enters a username) 2. Authentication: The system verifies that identity (e.g., password + MFA) 3. Authorization: The system determines what that identity can access
For third-party users, all three steps must be held to Zero Trust standards.
Strong Authentication: The Five Types
Basic username/password authentication is insufficient for vendor access. Strong authentication: as defined by NIST 800-63, the EU's Strong Customer Authentication requirements, and the FIDO Alliance: requires at least two distinct factors from different categories. The five primary methods:
- One-Time Passwords (OTP): Time-limited codes delivered via SMS or authenticator apps 2. Biometrics:Fingerprint, facial recognition, voice, or typing pattern recognition 3. Certificate-based: Digital certificates that authenticate users or devices cryptographically 4. Token-based: Physical USB devices or smart cards that generate authentication credentials 5. Multi-Factor Authentication (MFA): Combining two or more of the above
MFA is the minimum bar for any third-party access to sensitive systems. If MFA isn't immediately achievable, start by hardening password policies (12+ character minimums, complexity requirements, 60-day aging, 10-password history) : but treat this only as a transitional step.
IAM and PAM: The Infrastructure Behind Strong Auth
Strong authentication must be supported by two key management systems:
• Identity and Access Management (IAM): Ensures separation of duties, enforces least-privilege, integrates MFA, enables just-in-time access, and provides complete audit logging.
• Privileged Access Management (PAM): A specialized layer for administrator and root-level accounts. Modern PAM systems (including cloud-native and next-gen ephemeral certificate approaches) rotate credentials automatically, enforce just-in-time access, and integrate with your existing IAM infrastructure.
Key Takeaway: Vendor user accounts are one of the most exploitable attack surfaces in any organization. Strong authentication, properly implemented IAM, and rigorous PAM controls are the foundation of Zero Trust for third-party users.
Tags: Identity | Authentication | MFA | IAM | PAM | Vendor Access
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →