Then, one day I found out that our company's own Web site had the same basic problem. We had outsourced the Web site's new look to a cheaper vendor. See, our company's own secure programmers and computer security experts were making too much money for the company to use them on the company's own internal projects. Boy, did I change my tune when the pain was ours.

Another example of inappropriate transitive trust involves identity theft. Many of the identity theft incidents over the last few years have occurred because the original company or entity trusted another third party to safeguard its data information assets with the same zeal as it would. It could be a servicing bureau that didn't protect its networks and computers well enough or data tapes that simply disappear in transit.

Every time we allow consultants, b-to-b partners, and remote networks to access our own networks, we are giving transitive trust, whether we know it or not. Their network becomes our network. Every piece of software you install is essentially extending trust to the publisher. If their code fails, so does your data and networks.

You should strive to measure transitive trust in every extending operation you're involved with. You must define the value and criticality of the data or services being entrusted, and require that those operating on your behalf use the same appropriate precaution (called due care in legal circles) as you yourself would provide for the circumstances. How do you do it?

For one, create a security policy, if one doesn't already exist) that covers these sorts of third-party interactions. Make sure your critical data is always encrypted in transit and require that your vendors do the same. Hard-code into contracts the policy and expectations of the third party, and require that vendors and their employees document their understanding. Always reserve the right to audit, and do audit, and provide for penalties for noncompliance. It's amazing what a little policy and awareness can do to improve the transitive trust given to others.