The prevalence of contract workers leaves agencies vulnerable to cyberattacks
Westend61/Getty Images
Connecting state and local government leaders
Mitigating third-party security risk requires access management be an integral part of any identity security program.
The use of contract labor—commonly referred to as the “gig economy”— isn’t going anywhere. In fact, it’s growing. Researchers estimate that there will be 78 million workers participating in workforce as contract workers by 2023, up from 43 million in 2018. And while some associate gig work with Uber drivers and DoorDash deliveries, the truth is that even major technology companies are employing more contract workers than ever. It’s easy to see why they are attractive to organizations that value flexibility—but they can also create security challenges. Government entities should understand the potential risk that comes with working with contracted vendors and companies that are over-reliant on third-party workers.
Third-party access challenges
Not so long ago, vendor risk management was about getting a vendor to fill out a Standardized Information Gathering (SIG) questionnaire, ensuring that the vendor agreed to some contract terms about security and risk and perhaps updating the questionnaire on an annual basis. But over the past few years, high-profile breaches at companies like Target, Marriott and even the Red Cross have stemmed from security incidents involving third-party workers. Those breaches have drawn attention to the need to more carefully assess the security of the third parties that have access to sensitive employee data across private and public sector entities.
Unfortunately, third-party access often falls through the cracks. At many organizations, HR is primarily focused on employees. Procurement teams work on contracts, but often have limited (or no) contact with the individuals provided under those agreements. IT is focused on granting and removing access, but not necessarily on compliance. In addition, sponsors of contractors often do not have the time to specify precise definitions of access entitlements. This means contractors are frequently onboarded by copying the same access in a prior contractor had. Over time, this can lead to over-privilege, or “permissions bloat.”
While there has been movement toward creating a unified cybersecurity standard for government contractors, there remain few designated roles focused explicitly on vendor risk management—it sits in a “no man’s land” between departments. And even when a vendor risk management department does exist, it is often disconnected from the actual provisioning and monitoring of access. It isn’t always easy to know exactly what permissions non-employees should have.
Improving third-party access standards
The solution starts with making sure third parties have the right level of access for their responsibilities. This means government agencies must be able to positively identify each contractor, verifying that they are who they claim to be. Given the number of identities that today’s organizations deal with, automating the access process through AI-driven approvals, workflows and birthright entitlements can both streamline the process and eliminate human error.
Embracing modern identity governance practices can also help organizations comply with standards like the Cybersecurity Maturity Model Certification (CMMC) program used by the Department of Defense. This allows third-party contractors who do business with government agencies provide binding assurances that cybersecurity measures have been met.
It's important to note that there is no “set it and forget it” solution to third-party security. Organizations need to monitor these identities to ensure ongoing compliance. It is not unheard of—or even that unusual—for vendors or other organizations supplying third-party workers to skirt the system’s limits. For example, some companies will allow employees to share login credentials to obfuscate the number of workers involved with a given account. Worse, this is sometimes used to hide the fact that contractors may be using a revolving door of temporary workers rather than a dedicated staff. This creates obvious security risks—particularly for agencies working with highly sensitive information. The government needs to know who has access to its systems.
Gig workers and beyond
Government organizations must remain attuned to systemic risk. More and more workers are embracing the gig economy. Even if your agency doesn’t use them, you can be sure you have partners that do. And while there are tools available today that can look at login behavior to spot anomalies, these are not enough. Individual contract workers can create significant security risks, but mitigating that problem is just part of the broader issue of third-party security—and facing that challenge means access management will continue to be an integral part of any identity security program for both public and private entities.