Okta’s Tips for Securing Third Parties and Identifying Fake Applicants

Title: Securing the Extended Workforce: Okta’s Guidelines for Protecting Third-Party Access

In today’s digital landscape, safeguarding sensitive information is more critical than ever. The identity management provider Okta emphasizes the importance of securing not just regular employees but also the "extended workforce," which includes contractors, vendors, and service providers. Recent insights from Okta reveal that these third-party accounts warrant the same level of protection as employee accounts to mitigate potential security risks.

As a leader in identity and access management, Okta has become a prime target for cyber threats. Its systems have been exploited to attack its customers, which has prompted the company to establish stringent internal standards for securing the extended workforce. In a recent blog post, Okta’s SVP and Deputy Chief Security Officer, Charlotte Wylie, outlined these essential guidelines, urging organizations to adopt similar measures.

Understanding the Extended Workforce

What is the "Extended Workforce"?

The term "extended workforce" encompasses not only contractors and temporary workers but also individuals indirectly employed by other companies who have access to your organization’s systems. This includes consultants, vendors, and service providers, such as those from managed service providers or data-analytics firms.

Wylie warns that threat actors may view this group as a vulnerability in an organization’s defense. "Securing our extended workforce with the same safeguards as our employees is crucial," she states, underscoring the need for comprehensive security protocols.

Key Strategies for Securing the Extended Workforce

To ensure robust security for the extended workforce, Okta recommends the following strategies:

1. Use Hardened and Managed Devices

   • Ensure that all personnel accessing your systems, including contractors and vendors, utilize company-managed devices. This means issuing authorized laptops or smartphones that are strictly controlled and monitored.
   • Implement strict security protocols such as mandatory VPN use and device security posture assessments.

2. Implement Phishing-Resistant Authentication

   • Equip all contractors with phishing-resistant authentication methods, such as YubiKeys. This offline security key must be activated for accessing any systems, adding an extra layer of protection.
   • Explore additional multi-factor authentication options for verifying identities, such as SMS codes or authentication apps.
3. Provide Comprehensive Security Training
   • Ensure that all contractors undergo the same security training as employees, focusing on data privacy, physical security, and awareness of social engineering tactics.
   • Highlight the importance of being cautious about personal information shared online, as contractors may become targets for attackers.

Verifying Remote Workers

In addition to securing third-party access, organizations must also focus on verifying remote employees. With reports of identity fraud on the rise, particularly from individuals acting on behalf of hostile regimes, it’s essential to implement thorough verification processes. Here are some recommended practices:

• Conduct in-person or live video interviews when possible.
• Require multiple forms of government-issued identification.
• Check references through independent channels.

Conclusion: Protecting Your Organization Starts with the Extended Workforce

As cyber threats evolve, so too must the strategies for protecting sensitive information. Organizations must recognize that their extended workforce is a critical component of their security posture. By implementing Okta’s guidelines, businesses can reinforce their defenses against potential attacks.

For more insights on identity management and security strategies, share your thoughts in the comments below or explore our related articles on safeguarding digital assets.

For further reading, check out Okta’s blog on identity management and Cybersecurity & Infrastructure Security Agency’s recommendations.