Why assessing third parties for security risk is still an unsolved problem – CSO Online