The cybersecurity workforce is becoming more invisible. Trends in employment and talent seeking for specialized skills are increasingly shifting organizational workloads from employees to nonemployees — such as freelancers, independent contractors, service providers, consultancies and agencies. But just like the employee workforce, this “invisible workforce” still needs access to — and participation in — the organization’s data and IT infrastructure. And that needs to be factored in during security planning.

Bringing Third-Party Security Into Focus

New research from SAP Fieldglass in collaboration with Oxford Economics found that about 42 percent of spending on the workforce goes to the invisible part, rather than employees. Many executives feel they need, and do rely on, this invisible workforce to remain competitive and achieve business objectives. The report also found that, unfortunately, the management of these nonemployee workers is usually ineffective.

Organizations often have a completely different set of standards for training and certifications, the metrics for gauging the success of their work, and other factors. Access to internal systems is also treated differently, resulting in a glaring problem with security breaches. A whopping 44 percent of survey respondents reported security breaches happening via service providers, for example.

It’s becoming clear that even large organizations with sizable cybersecurity budgets are leaving security to the individuals or organizations they contract with — and, of course, these have smaller budgets and largely unknown security policies and practices. Cybercriminals have discovered this inattention to securing the invisible workforce and are working harder to exploit that wide entry point. The idea is to infiltrate a partner, service provider, freelancer or consultant, then piggyback on their access into the larger organization.

While the industry focuses on employee security as well as the alarming and growing trend of supply chain attacks, the security status of other nonemployees isn’t getting the attention it deserves.

See the Invisible Workforce for What It Is

Conceptually, the status of invisible workers is like that of cloud computing: There’s less visibility into how they work and the specific equipment used, which can lead to an irrational confidence or misplaced blind trust during security planning. But just as the cloud is really just somebody else’s computers, invisible workers are really just somebody else’s employees.

The wrong approach to these workers is to simply trust that the security practices, policies and infrastructure on their end is at least as good as your organization’s. Many invisible workforce employees work for very small companies that may not have security personnel or even IT people on staff.

A better approach is to treat the invisible workforce similar to how you would treat employees under both a bring-your-own-device (BYOD) and remote work policy: Assume that each of these workers is a trusted user using an untrusted device and accessing via an untrusted network.

Here’s what that means in practice:

  • Avoid the provision of admin privileges to nonemployees unless absolutely necessary, and revoke permissions as soon as they’re finished with the job. In other words, embrace a privileged access management (PAM) approach to data access.
  • Place an expiration date on nonemployee accounts; create temporary accounts that expire on the date contracts are scheduled to end.
  • Follow a zero trust model for data access, especially for the invisible workforce. This means using an identity and access management (IAM) system to establish zones of control around sensitive data, along with visibility on who is accessing what data, when and why.
  • Maintain and frequently review a list of all nonemployees who have been granted access to (or privileges on) the network that includes which employee or employees are responsible for and knowledgeable about the nonemployee’s access, as well as termination dates for access, as a normal part of security planning.
  • Require special security awareness training for anyone accessing the network, including freelancers, contractors and service providers.
  • Require a stringent set of security policies at partner organizations.
  • Create and frequently update a specific set of policies for your invisible workforce.

Most important of all is to not sweep this potential security risk under the rug. Invisible workforce users are not employees, but they should be given at least as much attention as employees. Extra organizational attention is required to keep track of and limit the network and resource access by these employees because their security practices, policies and infrastructure is often unknowable.

More from Data Protection

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Defensive Driving: The Need for EV Cybersecurity Roadmaps

As the U.S. looks to bolster electric vehicle (EV) adoption, a new challenge is on the horizon: cybersecurity. Given the interconnected nature of these vehicles and their reliance on local power grids, they’re not just an alternative option for getting from Point A to Point B. They also offer a new path for network compromise that could put drivers, companies and infrastructure at risk. To help address this issue, the Office of the National Cyber Director (ONCD) recently hosted a…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

How the CCPA is Shaping Other State’s Data Privacy

Privacy laws are nothing new when it comes to modern-day business. However, since the global digitization of data and the sharing economy took off, companies have struggled to keep up with an ever-changing legal landscape while still fulfilling their obligations to protect user data. The challenge is that there is no one-size-fits-all solution regarding data privacy's legal requirements. Depending on the location and jurisdiction, data privacy laws can vary significantly in terms of scope and enforcement. But while the laws…