News + Resources

On 4 March 2021, the airline data company SITA announced that on 24 February 2021 it had discovered a data breach on its US subsidiary SITA Passenger Service System (US) Inc, as a result of a ‘highly sophisticated attack’. It said containment measures were being put in place and customers were being notified.

The hack on the SITA system is disastrous for SITA, clearly. But the repercussions will not be serious for SITA alone. Many airlines use SITA for the management of their customer loyalty systems, for example. And customers of those airlines whose data has been compromised will identify the airline as responsible, irrespective of the outsourcer. As understanding of the extent and depth of this breach grows, the seriousness of the situation facing SITA and its customers will become clearer. Although aviation-focused, there are some lessons here which are relevant for all sectors, and in particular our own – the maritime sector.

Mind the dependencies

We urge our clients to care about those 3^rd party organisations that provide critical services, whether booking, e-commerce, IT infrastructure or any other key service. If they fail, we go with them and our customers will not care who was doing what in the data value chain. If it is our data that was lost, our customers will blame us for (a) losing the data and (b) entrusting our customer data to a business that doesn’t care about their customer data.

In an era where time is money, we cannot afford to contract with suppliers who themselves do not themselves have a thought through business continuity plan which they have had the courtesy to share with us. Nor can we afford to work with suppliers who care less about our data than we do.  Our contracts with these big organisations are often one sided (i.e. we take it or leave it – maximum indemnity worth 1 x contract value), and we never have full confidence that they are acting with our best interests at heart. Service level agreements really matter – as do contract discussions about exit strategies and disaster recovery planning. In cyber, we have to work with what we have and create realistic scenarios. These can then be used to articulate the indemnities. And don’t forget that responsibility works both ways – if your behaviour damages a supplier, they should have recourse against us.

It is no coincidence that the European Commission is now looking to Include 3^rd partly suppliers within the ambit of the financial services regulations to ensure that they to take cyber security seriously – or risk a fine of 1% of their turnover.

Outsourcing never transfers all risk

Many companies believe that outsourcing expatriates the risk associated with the service being outsourced. But as this and other breaches show, there is little comfort to be had – indeed it could be argued that outsourcing increases the risk, since it puts a function in the hands of a third party that might have other priorities. It is incumbent on the outsourcer to do their due diligence and to structure the arrangement so that problems and risks are appropriately managed.

There is a particular risk when airlines – or any other businesses – have to deal with a small number of suppliers. Lack of real competition, allied to the power of the incumbent, leads to a potentially toxic equation, where companies may have doubts about their key supplier but cannot do anything about it.

So, what’s the point?

Understand your dependencies – but don’t let them become your Achilles’ heel. Companies get into difficulties when a system, component or process become so mission critical that any down time causes loss for the business. This particularly refers to mission critical OT systems which cannot be taken offline for patching because there is no fallback method of providing the same service or function. Traditionally, redundancy has been regarded as a tradeable commodity – and it is only now that management is realising that running organisations ‘skinny’ compromises their ability to keep them secure.

Mind your reputation – outsourcing merely to save money will ultimately cheapen your reputation. If there are no incentives in the contract to improve, e.g. gainshare, then the service will degrade and poison the relationship.  It is also unwise to believe that your reputation matters as much to your outsourcer as it does to you.

Treat your information assets as if they were cash – data and information have a value both to you and your attacker; they need to be protected – losing company data can be as value destroying as a natural catastrophe or the loss of a key client, particularly for listed businesses.                                       

Sweat the small stuff – the fine detail of a long-term outsourcing contract often gets forgotten over time. But it is precisely these details that will help both sides manage the relationship and protect each other’s brand. So, the time spent up front on establishing business continuity arrangements, exit strategies and preparing for eventualities that might never happen is rarely wasted.

There are times when outsourcing makes great sense and can drive great value through exploitation of economies of scale. But when a single supplier provides an essential service to 90% of the sector, alarm bells need to ring at both the operating and the regulatory levels. Monopoly suppliers need to be required to take additional precautions. And purchasers of their services need to have resilience in mind as they design their systems. It may cost more up front, but it will save more time, expense and effort than when the service fails and there is no plan B.