Are Remote Contractors A Cyber Security Risk?

As a result of the pandemic, businesses have had to get used to having staff who work remotely. Thankfully this has provided a huge range of benefits and advantages for companies that have been willing to embrace the change. However, there are also potential challenges and issues that arrive with a remote workforce. 

One of the major ongoing challenges for businesses of all sizes relates to cyber security. Cyber criminals are becoming more sophisticated and the number of attacks has skyrocketed during the pandemic. 

Those problems are compounded when the workers are contractors rather than employed staff. Where employed remote staff are more likely to attend training sessions and understand company-specific cyber security challenges, contractors may not be as involved with the company, and therefore less conscious of these potential dangers.

Here we take a closer look at whether remote contractors are a cyber security risk for your business. 

Remote Workers Do Add Risk

It is important to first note that it is generally accepted that remote staff can add some element of cyber security risk to the way a business operates. This is especially true if your business has always operated exclusively in an office environment. There are certain issues relating to remote work that naturally lead to increased risk. 

These are not unique to contractors - however, they are still relevant and they can pose problems. However, it is also true that good security practices can significantly mitigate many of these issues. 

Use Of Personal Devices 

In an office environment it can be easy to manage how staff work, ensuring that they only ever operate through company devices. These devices have layers of natural protection built into them, for example, they are regularly updated by the IT team. They work with the corporate network, and sit behind the company firewall. They can also be easily monitored by security staff. 

Remote workers can make use of their own devices, which may not have the kind of security measures in place. They may also use weak passwords or have out-of-date cyber security (or no cyber security at all). These devices can be a potential weak point that cyber criminals can exploit.

It is important to provide remote contractors with training on the devices that they should and shouldn’t use. 

Shadow IT

Another potential cyber security challenge comes in the form of shadow IT. Shadow IT refers to software and applications that have not been approved by the IT department. They may allow workers to do their job more easily, but in doing so they can cause huge cyber security issues. 

Remote contractors are potentially more likely to make use of shadow IT than employed staff, simply because they may use devices that utilise a much broader range of software and applications if they take on a broader variety of work. 

Lack Of Training

It is, unfortunately, the case that contractors are not always prioritised in terms of staff training. However, with cyber security, training staff is crucial to ensure they understand the latest threats and challenges. It is a great idea to integrate your remote contractors into your standard staff training. 

When Contractors Manage Digital Transformation

More businesses than ever are choosing to transform their operations and do more of their business online. It’s not hard to understand why: in a survey by ClearHub, 84% of CTOs saw benefits from a cloud migration in less than six months. Companies can make fast and noticeable positive outcomes for their business simply via cloud migration. 

However, this can create a problem. Here we have an example where businesses see that acting sooner rather than later can have a huge positive impact on their company.

This can lead to rushed procedures and getting in staff simply to get the job done as soon as possible. This is clearly the wrong way to use remote contractors, and it can be a cyber security hazard. 

“The risks of rushed and poorly planned cloud migrations have been highlighted throughout the COVID-19 crisis,” says George Glass, Head of Threat Intelligence at cyber security specialists Redscan. “In the move to adapt, companies have quickly adopted cloud services such as Office 365 and G Suite to support remote working. However, this shift has led to a rise in cyber-attacks.” 

The key thing to learn here is that remote contractors should not be considered simply a way to get a project completed as quickly as possible. Taking sensible steps to plan out and consider all relevant factors is the best way to work when carrying out any kind of digital transformation. 

Additional Risk Is Low

While we looked at some areas in which working with remote contractors can potentially add security risk - the actual level of risk can be minimized. It is important for businesses to integrate remote staff and ensure they understand how to keep the business secure while carrying out their contract. 

One of the most effective ways to minimise the risk from contractors is to ensure that their access to the system is limited. If contractors are only given access to the parts of the system and the data that they need to do their job, their account can only be used for a limited scope if it is compromised by cyber criminals. 

Ultimately, then, you should not be put off hiring remote contractors because you are worried that they will be a security risk for your business. Taking the proper precautions effectively keep risk relatively low, and allow you to benefit from the range of advantages from remote contractors.

Chester Avey is a business growth consultant who writes on cyber security for ClearHub

You Might Also Read: 

Is Ethical Hacking A Business Necessity In 2021?:

 

« Toolbox For Outlook Password Is Unrivaled
Security Trends For 2022 - The Need For Talent & Cloud Migration »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

44CON

44CON

44CON is an Information Security Conference & Training event taking place in London. Designed to provide something for the business and technical Information Security professional.

Tresorit

Tresorit

Tresorit helps teams to collaborate securely and easily by protecting their data with end-to-end encryption.

Miller Group

Miller Group

Miller Group is an IT managed service provider. We proactively monitor and manage your entire business computer network. Services include backup & recovery and cyber security.

Latvian Information & Communications Technology Association (LIKTA)

Latvian Information & Communications Technology Association (LIKTA)

LIKTA brings together leading Latvian companies, organizations and professionals in the field of Information & Communications Technology

Mitek Systems

Mitek Systems

Mitek's global mobile capture and identity verification technology optimizes the digital user experience for thousands of financial services organizations.

Crypteia Networks

Crypteia Networks

Crypteia Networks delivers a patent-pending technology that identifies zero-day threats along with misconfigurations on already deployed defenses.

exceet Secure Solutions

exceet Secure Solutions

exceet Secure Solutions is your experienced specialist for Internet of Things (IoT), Heath Telematics, electronic signatures and timestamps and IT security.

Fujitsu

Fujitsu

Fujitsu is the leading Japanese global information and communication technology company, offering a full range of products, solutions and services including Managed IT Services and Cyber Security.

Neurosoft

Neurosoft

Neursoft is a fully integrated ICT company with Software Development, System Integration and Information Technology Security capabilities.

Keeper Security

Keeper Security

Keeper is a leading enterprise password manager and cybersecurity platform for preventing password-related data breaches and cyberthreats.

Guardara

Guardara

Guardara's mission is to help our customers to continuously improve in every aspect of software development.

ValueMentor

ValueMentor

ValueMentor is a leading cyber security service provider in the Middle East. We enable clients to reduce risk by taking a strategic approach to cybersecurity.

SoloKeys

SoloKeys

SoloKeys provides the first open-source FIDO2 security key: Protect your online accounts against unauthorized access by using the most secure login method.

HACKNER Security Intelligence

HACKNER Security Intelligence

HACKNER Security Intelligence is an independent security consultancy delivering comprehensive security assessments across IT security, physical security, and social engineering.

Inversion6

Inversion6

Inversion6 (formerly MRK Technologies) is a cybersecurity risk management provider that offers custom security solutions.

Intelligent Technical Solutions (ITS)

Intelligent Technical Solutions (ITS)

We help businesses manage their technology. Intelligent Technical Solutions provide you with the right technical solution, so you can get back to running your business.