The cybersecurity workforce is becoming more invisible. Trends in employment and talent seeking for specialized skills are increasingly shifting organizational workloads from employees to nonemployees — such as freelancers, independent contractors, service providers, consultancies and agencies. But just like the employee workforce, this “invisible workforce” still needs access to — and participation in — the organization’s data and IT infrastructure. And that needs to be factored in during security planning.

Bringing Third-Party Security Into Focus

New research from SAP Fieldglass in collaboration with Oxford Economics found that about 42 percent of spending on the workforce goes to the invisible part, rather than employees. Many executives feel they need, and do rely on, this invisible workforce to remain competitive and achieve business objectives. The report also found that, unfortunately, the management of these nonemployee workers is usually ineffective.

Organizations often have a completely different set of standards for training and certifications, the metrics for gauging the success of their work, and other factors. Access to internal systems is also treated differently, resulting in a glaring problem with security breaches. A whopping 44 percent of survey respondents reported security breaches happening via service providers, for example.

It’s becoming clear that even large organizations with sizable cybersecurity budgets are leaving security to the individuals or organizations they contract with — and, of course, these have smaller budgets and largely unknown security policies and practices. Cybercriminals have discovered this inattention to securing the invisible workforce and are working harder to exploit that wide entry point. The idea is to infiltrate a partner, service provider, freelancer or consultant, then piggyback on their access into the larger organization.

While the industry focuses on employee security as well as the alarming and growing trend of supply chain attacks, the security status of other nonemployees isn’t getting the attention it deserves.

See the Invisible Workforce for What It Is

Conceptually, the status of invisible workers is like that of cloud computing: There’s less visibility into how they work and the specific equipment used, which can lead to an irrational confidence or misplaced blind trust during security planning. But just as the cloud is really just somebody else’s computers, invisible workers are really just somebody else’s employees.

The wrong approach to these workers is to simply trust that the security practices, policies and infrastructure on their end is at least as good as your organization’s. Many invisible workforce employees work for very small companies that may not have security personnel or even IT people on staff.

A better approach is to treat the invisible workforce similar to how you would treat employees under both a bring-your-own-device (BYOD) and remote work policy: Assume that each of these workers is a trusted user using an untrusted device and accessing via an untrusted network.

Here’s what that means in practice:

  • Avoid the provision of admin privileges to nonemployees unless absolutely necessary, and revoke permissions as soon as they’re finished with the job. In other words, embrace a privileged access management (PAM) approach to data access.
  • Place an expiration date on nonemployee accounts; create temporary accounts that expire on the date contracts are scheduled to end.
  • Follow a zero trust model for data access, especially for the invisible workforce. This means using an identity and access management (IAM) system to establish zones of control around sensitive data, along with visibility on who is accessing what data, when and why.
  • Maintain and frequently review a list of all nonemployees who have been granted access to (or privileges on) the network that includes which employee or employees are responsible for and knowledgeable about the nonemployee’s access, as well as termination dates for access, as a normal part of security planning.
  • Require special security awareness training for anyone accessing the network, including freelancers, contractors and service providers.
  • Require a stringent set of security policies at partner organizations.
  • Create and frequently update a specific set of policies for your invisible workforce.

Most important of all is to not sweep this potential security risk under the rug. Invisible workforce users are not employees, but they should be given at least as much attention as employees. Extra organizational attention is required to keep track of and limit the network and resource access by these employees because their security practices, policies and infrastructure is often unknowable.

More from Data Protection

Cost of a data breach 2023: Pharmaceutical industry impacts

3 min read - Data breaches are both commonplace and costly in the medical industry.  Two industry verticals that fall under the medical umbrella — healthcare and pharmaceuticals — sit at the top of the list of the highest average cost of a data breach, according to IBM’s Cost of a Data Breach Report 2023. The health industry’s place at the top spot of most costly data breaches is probably not a surprise. With its sensitive and valuable data assets, it is one of…

Cost of a data breach 2023: Financial industry impacts

3 min read - According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year. For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies…

Advanced analytics can help detect insider threats rapidly

2 min read - While external cyber threats capture headlines, the rise of insider threats from within an organization is a growing concern. In 2023, the average cost of a data breach caused by an insider reached $4.90 million, 9.6% higher than the global average data breach cost of $4.45 million. To effectively combat this danger, integrating advanced analytics into data security software has become a critical and proactive defense strategy. Understanding insider threats Insider threats come from users who abuse authorized access to…

One simple way to cut ransomware recovery costs in half

4 min read - Whichever way you look at the data, it is considerably cheaper to use backups to recover from a ransomware attack than to pay the ransom. The median recovery cost for those that use backups is half the cost incurred by those that paid the ransom, according to a recent study. Similarly, the mean recovery cost is almost $1 million lower for those that used backups. Despite this fact, the use of backups is actually falling. This was one of the…