Protecting the modern workforce requires a new approach to third-party security

Ask any HR leader: they’ll tell you that attracting and retaining employees continues to be a top challenge. While this has never been easy, there’s little doubt that the COVID-19 pandemic (and distributed workforces) have made things even more complex. As you read this article, many workers are actively considering leaving their current roles, which don’t support their long-term goals or desired work-life balance. While organizations attempt to navigate this “Great Resignation,” more than 4 million workers are still resigning every month.

As 2022 marches on, hiring teams face another massive obstacle: global talent shortages. These trends have companies rushing to find creative stop-gap solutions to ensure business continuity in difficult times. It shouldn’t come as a surprise that more companies are relying on third-party vendors, suppliers and partners to meet short-term needs, reduce costs and keep innovation humming. In addition, the rise of the gig economy has more employees entering into nontraditional or temporary working relationships. This trend is particularly prevalent in the healthcare industry, but as many as 36% of American employees have a gig work arrangement in some form, either alongside or instead of a full-time job. 

What’s more, the corporate supplier ecosystem has become exponentially more complex. Amidst the supply chain vulnerabilities revealed by the pandemic, organizations are expanding and diversifying the number of supplier relationships they’re engaging in. Meanwhile, regulators have stepped up efforts to manage these business ecosystems.

In many cases, outsourcing to temporary workers or external partners makes good business sense. Sometimes, given the constraints of the talent pool, there’s simply no other option for a company. Either way, organizations should be aware of the security risks that third parties bring — and the steps they can take to minimize the chances of a breach occurring. 

Third-party security challenges remain prevalent

Bringing a third-party workforce onboard in a rushed way – and without proper governance or security controls in place – leaves organizations open to significant cyber risk. These risks can stem from the third-party users or suppliers themselves or those third parties’ access becoming compromised and used as a conduit for lateral movement, enabling attackers to access the company’s most sensitive data. Sadly, a lack of centralized control over suppliers and partners is all too common, no matter the industry. In many organizations, unlike full-time employees, third-party users are managed on an ad hoc basis by individual departments using manual processes or custom-built solutions. This is a recipe for increased cyber risk.

Take the now-infamous Target breach, which remains among the largest-scale third-party security breaches in history. In this incident, attackers made their way onto the retail giant’s network after compromising login credentials belonging to an employee of an HVAC contractor, eventually stealing 110 million customers’ payment information. 

In today’s world, where outsourcing and remote work are now the norm, third parties require corporate network access to get their jobs done. If companies don’t reconsider third-party security controls – and take action by addressing the root of the problem – they’ll remain open to cyber vulnerabilities that can devastate their business and its reputation.

A pervasive lack of visibility and control

Although reliance on third-party workers and technology is widespread in nearly every industry (and in some, it’s common for an organization to have more third-party users than employees), most organizations still don’t know exactly how many third-party relationships they have. Even worse, most don’t even grasp precisely how many employees each vendor, supplier or partner brings into the relationship or their level of risk. According to one survey conducted by the Ponemon Institute, 66% of respondents have no idea how many third-party relationships their organization has, even though 61% of those surveyed had experienced a breach attributable to a third party. 

Grasping the full extent of third-party access can be particularly challenging when there’s collaboration with outsiders through cloud-based applications like Slack, Microsoft Teams, Google Drive or Dropbox. Of course, the adoption of these platforms skyrocketed with the large-scale shift to remote and hybrid work that has come about over the last two years.

Another challenge is that although an organization may try to maintain a supplier database, it can be near-impossible to ensure that it’s both current and accurate with current technical capabilities. Because of processes like self-registration and guest invites, external identities remain disconnected from the security controls applied to employees. 

Growing regulatory interest and contractual obligations

As incidents and breaches attributable to third parties continue to rise, regulators are taking notice. For instance, Sarbanes-Oxley (SOX) now includes several controls targeted explicitly at managing third-party risk. Even the Cybersecurity Maturity Model Certification (CMMC) explicitly targets improving the cybersecurity maturity of third parties that serve the federal government. The ultimate goal of such regulations is to bring all third-party access under the same compliance controls required for employees so that there’s consistency across the entire workforce and violations can be mitigated quickly.

Today, we expect companies to push their suppliers, vendors and partners to implement more stringent security controls. In the long run, however, such approaches are unsustainable, since it’s difficult, if not impossible, to enforce standards across a third-party organization. Hence, the focus will need to shift to ensuring that identity-based perimeters are robust enough to identify and manage threats that third parties may pose.

Currently, decentralized identity solutions are moving into the mainstream. As these technologies become more widely accepted, they’ll continue to mature. This will help many organizations streamline third-party management in the future. It will also assist companies on their journey toward zero trust-compatible identity postures. Incorporating ongoing security monitoring and implementing continuous identity verification systems will also become increasingly important. 

Five steps to mitigate third-party risk today

Today’s challenges are complex but not unsolvable. Here are five steps organizations can take to improve third-party access governance over the short term.

1) Consolidate third-party management. This process can begin with finance and procurement. Anyone with any contract to provide services to any department in the company should be identified and cataloged in an authoritative system of record that includes information on the access privileges assigned to external users. 

Security teams should test for stale accounts and deprovision any that are no longer needed or in use. In addition, they should assign sponsorship and joint accountability to third-party administrators.

2) Institute vetting and risk-aware onboarding processes. Both the organization and its supplier/vendor need to determine workflows for vetting and onboarding third-party users to ensure they are who they say they are — and that their onboarding process follows the principle of least privilege. Implementing a self-service portal where third-party users can request access and provide required documentation can smooth the path to productivity. Access decisions should be based on risk.  

3) Define and refine policies and controls. The organization — and its vendors and suppliers — should continuously optimize policies and controls to identify potential violations and reduce false positives. Policies and controls must be tested periodically, and security teams should also review employees’ access. Over time, auto-remediation can minimize administrative overhead further.

4) Institute compliance controls for your entire workforce. Look for a third-party access governance solution that will enable consistency across employees and third-party users, especially since regulators increasingly require this. Having access to out-of-the-box compliance reports for SOX, GDPR, HIPAA and other relevant regulations makes it easier to enforce the appropriate controls and provide necessary audit documentation.

5) Implement privileged access management (PAM). Another critical step that organizations can take to boost their cybersecurity maturity is implementing a PAM solution. This will enable the organization to enforce least privileged access and zero-standing privilege automatically across all relevant accounts. 

The world of work will never again look like it did in 2019. The flexibility, agility and access to first-rate talent that businesses gain from embracing modern ways of working make the changes more than worthwhile. And enterprises can realize enormous value within today’s complex and dynamic business relationship and supplier ecosystems. They need to ensure their cybersecurity strategies can keep up by strengthening identity and third-party access governance.

Paul Mezzera is VP of Strategy at Saviynt.