The cybersecurity workforce is becoming more invisible. Trends in employment and talent seeking for specialized skills are increasingly shifting organizational workloads from employees to nonemployees — such as freelancers, independent contractors, service providers, consultancies and agencies. But just like the employee workforce, this “invisible workforce” still needs access to — and participation in — the organization’s data and IT infrastructure. And that needs to be factored in during security planning.

Bringing Third-Party Security Into Focus

New research from SAP Fieldglass in collaboration with Oxford Economics found that about 42 percent of spending on the workforce goes to the invisible part, rather than employees. Many executives feel they need, and do rely on, this invisible workforce to remain competitive and achieve business objectives. The report also found that, unfortunately, the management of these nonemployee workers is usually ineffective.

Organizations often have a completely different set of standards for training and certifications, the metrics for gauging the success of their work, and other factors. Access to internal systems is also treated differently, resulting in a glaring problem with security breaches. A whopping 44 percent of survey respondents reported security breaches happening via service providers, for example.

It’s becoming clear that even large organizations with sizable cybersecurity budgets are leaving security to the individuals or organizations they contract with — and, of course, these have smaller budgets and largely unknown security policies and practices. Cybercriminals have discovered this inattention to securing the invisible workforce and are working harder to exploit that wide entry point. The idea is to infiltrate a partner, service provider, freelancer or consultant, then piggyback on their access into the larger organization.

While the industry focuses on employee security as well as the alarming and growing trend of supply chain attacks, the security status of other nonemployees isn’t getting the attention it deserves.

See the Invisible Workforce for What It Is

Conceptually, the status of invisible workers is like that of cloud computing: There’s less visibility into how they work and the specific equipment used, which can lead to an irrational confidence or misplaced blind trust during security planning. But just as the cloud is really just somebody else’s computers, invisible workers are really just somebody else’s employees.

The wrong approach to these workers is to simply trust that the security practices, policies and infrastructure on their end is at least as good as your organization’s. Many invisible workforce employees work for very small companies that may not have security personnel or even IT people on staff.

A better approach is to treat the invisible workforce similar to how you would treat employees under both a bring-your-own-device (BYOD) and remote work policy: Assume that each of these workers is a trusted user using an untrusted device and accessing via an untrusted network.

Here’s what that means in practice:

  • Avoid the provision of admin privileges to nonemployees unless absolutely necessary, and revoke permissions as soon as they’re finished with the job. In other words, embrace a privileged access management (PAM) approach to data access.
  • Place an expiration date on nonemployee accounts; create temporary accounts that expire on the date contracts are scheduled to end.
  • Follow a zero trust model for data access, especially for the invisible workforce. This means using an identity and access management (IAM) system to establish zones of control around sensitive data, along with visibility on who is accessing what data, when and why.
  • Maintain and frequently review a list of all nonemployees who have been granted access to (or privileges on) the network that includes which employee or employees are responsible for and knowledgeable about the nonemployee’s access, as well as termination dates for access, as a normal part of security planning.
  • Require special security awareness training for anyone accessing the network, including freelancers, contractors and service providers.
  • Require a stringent set of security policies at partner organizations.
  • Create and frequently update a specific set of policies for your invisible workforce.

Most important of all is to not sweep this potential security risk under the rug. Invisible workforce users are not employees, but they should be given at least as much attention as employees. Extra organizational attention is required to keep track of and limit the network and resource access by these employees because their security practices, policies and infrastructure is often unknowable.

More from Data Protection

SpyAgent malware targets crypto wallets by stealing screenshots

4 min read - A new Android malware strain known as SpyAgent is making the rounds — and stealing screenshots as it goes. Using optical character recognition (OCR) technology, the malware is after cryptocurrency recovery phrases often stored in screenshots on user devices.Here's how to dodge the bullet.Attackers shooting their (screen) shotAttacks start — as always — with phishing efforts. Users receive text messages prompting them to download seemingly legitimate apps. If they take the bait and install the app, the SpyAgent malware gets…

Exploring DORA: How to manage ICT incidents and minimize cyber threat risks

3 min read - As cybersecurity breaches continue to rise globally, institutions handling sensitive information are particularly vulnerable. In 2024, the average cost of a data breach in the financial sector reached $6.08 million, making it the second hardest hit after healthcare, according to IBM's 2024 Cost of a Data Breach report. This underscores the need for robust IT security regulations in critical sectors.More than just a defensive measure, compliance with security regulations helps organizations reduce risk, strengthen operational resilience and enhance customer trust.…

Skills shortage directly tied to financial loss in data breaches

2 min read - The cybersecurity skills gap continues to widen, with serious consequences for organizations worldwide. According to IBM's 2024 Cost Of A Data Breach Report, more than half of breached organizations now face severe security staffing shortages, a whopping 26.2% increase from the previous year.And that's expensive. This skills deficit adds an average of $1.76 million in additional breach costs.The shortage spans both technical cybersecurity skills and adjacent competencies. Cloud security, threat intelligence analysis and incident response capabilities are in high demand. Equally…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today