DeMaio adds that partners should provide a detailed description of their attack response plan?and it should be designed around specific systems, not generic boilerplate from books and manuals.

Also, demand that partners notify you of security incidents within the hour. Charles Le Grand, director of technology practices at the Institute of Internal Auditors in Altamonte Springs, Fla., adds that you should ask to see your partners’ criteria for notifying authorities and how they’re monitoring for vulnerabilities. For example, if they operate in an NT environment, urge them to keep up with NT BugTrack, he says.

Segmented Architectures

Some security analysts advocate "segmenting" enterprise architectures into smaller networks, all behind separate firewalls. That way, if one part of the network is compromised, the rest remains safe. Bethesda, Md.-based defense contractor Lockheed-Martin does that?and looks for it in its partners too, says A. Padgett Peterson, Lockheed’s senior security analyst. (For more on Lockheed-Martin’s strict security parameters, see "Maximum Protection," at www.cio.com/printlinks.)

Background Checks

If it’s standard practice in your own organization to conduct background checks on employees with access to sensitive data, it’s reasonable to request the same for partners’ employees who also have access. Wade declined to say whether he requires background checks of the Fed’s partners, but he’s required it while working at other companies. By having business representatives, not just IT people, involved in the negotiations, you’re more likely to get your partner to agree to background checks. "It’s difficult for many IT people to appreciate the risks involved in the relationship being established," he says.

Compliance Audits

Experts and practitioners agree the best way to validate compliance is through periodic audits, either by your own auditors or an independent third-party security company, as Visa requires. Typically the party requesting the audit will foot the bill.

The most security-conscious organizations require their partners to submit to penetration testing on a regular or random basis. But Le Grand says that is an extreme measure, because there is potential to bring a partner’s system down. "If you run a denial-of-service attack just to see how they recover, the recovery will be expensive," he says. "So you’d better not do this haphazardly and without agreeing on your right to do this."

Inducements and Enforcements
The Carrot

If you work for a powerful company with partners that absolutely depend on your relationship, like Visa, you have the power to make demands. Unfortunately, most companies don’t fit into that category. Instead, they must come up with carrots to entice partners to agree to their terms and incorporate them into contracts.