Are Remote Contractors A Cyber Security Risk?

As a result of the pandemic, businesses have had to get used to having staff who work remotely. Thankfully this has provided a huge range of benefits and advantages for companies that have been willing to embrace the change. However, there are also potential challenges and issues that arrive with a remote workforce. 

One of the major ongoing challenges for businesses of all sizes relates to cyber security. Cyber criminals are becoming more sophisticated and the number of attacks has skyrocketed during the pandemic. 

Those problems are compounded when the workers are contractors rather than employed staff. Where employed remote staff are more likely to attend training sessions and understand company-specific cyber security challenges, contractors may not be as involved with the company, and therefore less conscious of these potential dangers.

Here we take a closer look at whether remote contractors are a cyber security risk for your business. 

Remote Workers Do Add Risk

It is important to first note that it is generally accepted that remote staff can add some element of cyber security risk to the way a business operates. This is especially true if your business has always operated exclusively in an office environment. There are certain issues relating to remote work that naturally lead to increased risk. 

These are not unique to contractors - however, they are still relevant and they can pose problems. However, it is also true that good security practices can significantly mitigate many of these issues. 

Use Of Personal Devices 

In an office environment it can be easy to manage how staff work, ensuring that they only ever operate through company devices. These devices have layers of natural protection built into them, for example, they are regularly updated by the IT team. They work with the corporate network, and sit behind the company firewall. They can also be easily monitored by security staff. 

Remote workers can make use of their own devices, which may not have the kind of security measures in place. They may also use weak passwords or have out-of-date cyber security (or no cyber security at all). These devices can be a potential weak point that cyber criminals can exploit.

It is important to provide remote contractors with training on the devices that they should and shouldn’t use. 

Shadow IT

Another potential cyber security challenge comes in the form of shadow IT. Shadow IT refers to software and applications that have not been approved by the IT department. They may allow workers to do their job more easily, but in doing so they can cause huge cyber security issues. 

Remote contractors are potentially more likely to make use of shadow IT than employed staff, simply because they may use devices that utilise a much broader range of software and applications if they take on a broader variety of work. 

Lack Of Training

It is, unfortunately, the case that contractors are not always prioritised in terms of staff training. However, with cyber security, training staff is crucial to ensure they understand the latest threats and challenges. It is a great idea to integrate your remote contractors into your standard staff training. 

When Contractors Manage Digital Transformation

More businesses than ever are choosing to transform their operations and do more of their business online. It’s not hard to understand why: in a survey by ClearHub, 84% of CTOs saw benefits from a cloud migration in less than six months. Companies can make fast and noticeable positive outcomes for their business simply via cloud migration. 

However, this can create a problem. Here we have an example where businesses see that acting sooner rather than later can have a huge positive impact on their company.

This can lead to rushed procedures and getting in staff simply to get the job done as soon as possible. This is clearly the wrong way to use remote contractors, and it can be a cyber security hazard. 

“The risks of rushed and poorly planned cloud migrations have been highlighted throughout the COVID-19 crisis,” says George Glass, Head of Threat Intelligence at cyber security specialists Redscan. “In the move to adapt, companies have quickly adopted cloud services such as Office 365 and G Suite to support remote working. However, this shift has led to a rise in cyber-attacks.” 

The key thing to learn here is that remote contractors should not be considered simply a way to get a project completed as quickly as possible. Taking sensible steps to plan out and consider all relevant factors is the best way to work when carrying out any kind of digital transformation. 

Additional Risk Is Low

While we looked at some areas in which working with remote contractors can potentially add security risk - the actual level of risk can be minimized. It is important for businesses to integrate remote staff and ensure they understand how to keep the business secure while carrying out their contract. 

One of the most effective ways to minimise the risk from contractors is to ensure that their access to the system is limited. If contractors are only given access to the parts of the system and the data that they need to do their job, their account can only be used for a limited scope if it is compromised by cyber criminals. 

Ultimately, then, you should not be put off hiring remote contractors because you are worried that they will be a security risk for your business. Taking the proper precautions effectively keep risk relatively low, and allow you to benefit from the range of advantages from remote contractors.

Chester Avey is a business growth consultant who writes on cyber security for ClearHub

You Might Also Read: 

Is Ethical Hacking A Business Necessity In 2021?:

 

« Toolbox For Outlook Password Is Unrivaled
Security Trends For 2022 - The Need For Talent & Cloud Migration »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

European Organisation for Security (EOS)

European Organisation for Security (EOS)

EOS represents all domains of security solutions and services.providers including ICT information and communications technologies.

Dragos

Dragos

Dragos has built the first industrial cybersecurity ecosystem, the ultimate security defense.

Veriato

Veriato

Veriato develops intelligent solutions that provide companies with visibility into the human behaviors and activities occurring within their network, making them more secure and productive.

Stealthbits Technologies

Stealthbits Technologies

Stealthbits Technologies is a cybersecurity software company focused on protecting an organization's sensitive data and the credentials attackers use to steal that data.

Myra Security

Myra Security

Myra technology monitors, analyzes, and filters malicious internet traffic before virtual attacks can do any real harm.

Inseego

Inseego

Inseego provides Enterprise SaaS solutions and IoT & Mobile solutions, which together form the backbone of intelligent, reliable and secure IoT services with deep business intelligence.

Cervello

Cervello

Cervello is a leading provider of comprehensive and proven solutions to protect railways against cyber attacks.

Sky Republic

Sky Republic

Sky Republic offers a Smart Contract Platform to integrate and synchronize business networks beyond EDI and API.

Cyber Pop-Up

Cyber Pop-Up

Cyber Pop-Up provide on-demand access to top security experts. No recruiting. No onboarding. No overhead costs.

BlueRiSC

BlueRiSC

BlueRiSC invent cutting-edge system assurance solutions for the 21st century with novel software and hardware designs focusing on security technologies that can be game changing.

Privacyware

Privacyware

Privacyware's ThreatSentry combines a state-of-the-art Web Application Firewall and port-level firewall with advanced behavioral filtering to block unwanted IIS traffic and web application threats.

Gravitee

Gravitee

Gravitee helps organizations manage and secure their entire API lifecycle with solutions for API design, management, security, productization, real-time observability, and more.

Quzara

Quzara

Quzara provides trusted advisory services and highly adaptive cybersecurity services to federal, commercial and Defense Industrial Base customers to meet their security compliance and cyber needs.

Fulcrum IT Partners

Fulcrum IT Partners

Fulcrum IT Partners is the parent company of an expanding portfolio of established IT solution companies around the world with proven expertise in cyber security, cloud, and managed services.

Onwardly

Onwardly

For everyday folks tasked with implementing security and privacy. Do it faster with Onwardly - build, launch and scale your cyber resilience program in 30 minutes per week.

Adsigo

Adsigo

Adsigo AG is your reliable and professional partner for all topics concerning PCI certification, compliance and information security.