The cybersecurity workforce is becoming more invisible. Trends in employment and talent seeking for specialized skills are increasingly shifting organizational workloads from employees to nonemployees — such as freelancers, independent contractors, service providers, consultancies and agencies. But just like the employee workforce, this “invisible workforce” still needs access to — and participation in — the organization’s data and IT infrastructure. And that needs to be factored in during security planning.

Bringing Third-Party Security Into Focus

New research from SAP Fieldglass in collaboration with Oxford Economics found that about 42 percent of spending on the workforce goes to the invisible part, rather than employees. Many executives feel they need, and do rely on, this invisible workforce to remain competitive and achieve business objectives. The report also found that, unfortunately, the management of these nonemployee workers is usually ineffective.

Organizations often have a completely different set of standards for training and certifications, the metrics for gauging the success of their work, and other factors. Access to internal systems is also treated differently, resulting in a glaring problem with security breaches. A whopping 44 percent of survey respondents reported security breaches happening via service providers, for example.

It’s becoming clear that even large organizations with sizable cybersecurity budgets are leaving security to the individuals or organizations they contract with — and, of course, these have smaller budgets and largely unknown security policies and practices. Cybercriminals have discovered this inattention to securing the invisible workforce and are working harder to exploit that wide entry point. The idea is to infiltrate a partner, service provider, freelancer or consultant, then piggyback on their access into the larger organization.

While the industry focuses on employee security as well as the alarming and growing trend of supply chain attacks, the security status of other nonemployees isn’t getting the attention it deserves.

See the Invisible Workforce for What It Is

Conceptually, the status of invisible workers is like that of cloud computing: There’s less visibility into how they work and the specific equipment used, which can lead to an irrational confidence or misplaced blind trust during security planning. But just as the cloud is really just somebody else’s computers, invisible workers are really just somebody else’s employees.

The wrong approach to these workers is to simply trust that the security practices, policies and infrastructure on their end is at least as good as your organization’s. Many invisible workforce employees work for very small companies that may not have security personnel or even IT people on staff.

A better approach is to treat the invisible workforce similar to how you would treat employees under both a bring-your-own-device (BYOD) and remote work policy: Assume that each of these workers is a trusted user using an untrusted device and accessing via an untrusted network.

Here’s what that means in practice:

• Avoid the provision of admin privileges to nonemployees unless absolutely necessary, and revoke permissions as soon as they’re finished with the job. In other words, embrace a privileged access management (PAM) approach to data access.
• Place an expiration date on nonemployee accounts; create temporary accounts that expire on the date contracts are scheduled to end.
• Follow a zero trust model for data access, especially for the invisible workforce. This means using an identity and access management (IAM) system to establish zones of control around sensitive data, along with visibility on who is accessing what data, when and why.
• Maintain and frequently review a list of all nonemployees who have been granted access to (or privileges on) the network that includes which employee or employees are responsible for and knowledgeable about the nonemployee’s access, as well as termination dates for access, as a normal part of security planning.
• Require special security awareness training for anyone accessing the network, including freelancers, contractors and service providers.
• Require a stringent set of security policies at partner organizations.
• Create and frequently update a specific set of policies for your invisible workforce.

Most important of all is to not sweep this potential security risk under the rug. Invisible workforce users are not employees, but they should be given at least as much attention as employees. Extra organizational attention is required to keep track of and limit the network and resource access by these employees because their security practices, policies and infrastructure is often unknowable.