Unmanaged Third Party Identity Risk: The Hidden Threat
A practical guide to manage third party and non-employee identity risk
The expanding identity and access management challenge
Cyber-attacks are on the rise and it's estimated that as many as 60% are identity-based, making strong identity and access management (IAM) an increasing priority for a robust cyber defense.
- 48% increase in the ratio of non-employees, with one contractor being hired for every five employees
- 90% of businesses indicate that they intend to maintain or increase their use of contractors
- 59% experienced a data breach caused by one of their third parties in the past 12 months
Over the past five years, there have been dramatic changes in the way we work, with digital and remote working on the increase and a widening digital ecosystem. Organizations are increasingly reliant on third parties who access their environment, creating vulnerability.
Why this matters?
Identity access management for an organization's permanent workforce is not sufficient to deal with the risks associated with the extended third-party and non-employee workforce.
Digital account sprawl
- On average, a digital identity is estimated to have anywhere between 5-15 different accounts associated with it.
- The number of accounts is further proliferated for non-employees due to duplicate or temporary accounts.
- This substantially increases the attack surface of the organization.
Over-privileged access
- Third parties often require elevated system access beyond standard users.
- This access is often untailored and excessive, with maximum privileges given.
- It's this access that becomes a prime target for attackers, increasing the risk of significant breaches.
Obtaining visibility
You cannot effectively manage what you're unaware of, so gaining a clear understanding of your business's current identity position is crucial.
Questions you should ask
- Do you truly know your digital workforce?
- Do you know what access your third parties have in your organization?
- Do you have a broader third-party risk capability that can be leveraged?
Three foundational elements to manage third-party and non-employee identity risk
- Prioritize identifying third parties that pose the greatest risk.
- Establish a centralized, trusted source capable of integrating with existing security and identity tools.
- Choose the appropriate technology and treat it as a transformation.
Putting data at the core
Develop a data model that prioritizes cleansing data, starting with the highest-risk systems. Robust and accurate data is fundamental for strong identity access management controls.
Components of a data-led approach
- Establishing a data model tailored for non-employee identities.
- Implementing data cleansing in alignment with the newly established data model.
Embedding non-employee IAM governance
Identity and access management is an ongoing process that must be sustainable, adaptable, and resilient.
Success is based on strong ownership, clear accountability, and effective governance
- Stakeholder engagement and relationships development.
- Clarity and collaboration.
- Process transformation.
- Continuous improvement.
Characteristics of robust third-party IAM
- Clear, documented, and verified understanding of all non-employees.
- Limited use of shared credentials and centralized credential management.
- Identified, inventoried, and tightly controlled highest privileged and sensitive access.
- Defined roles and access rules tailored for non-employees.
How KPMG and SailPoint can help
KPMG and SailPoint can assist organizations in managing third-party identity risk through their expertise and technology solutions.
- Our firm’s experience in IAM, TPRM, and cyber security.
- SailPoint's market-leading Non-Employee Risk Management tool.
By combining their capabilities, KPMG and SailPoint can help organizations tackle complex IAM programs, saving time and money while advancing long-term ROI.
Unmanaged Third Party Identity Risk – The Hidden Threat to Your Business
A practical guide from KPMG and SailPoint to help you manage third-party and non-employee identity risk, strengthen your cyber defense, and protect your organization from the fastest-growing source of breaches.
Meet the team
