Organizations tend to focus their security programs on the people, systems, and assets clearly inside the enterprise: employees, facilities, networks, and sensitive information. Yet many consequential risks can originate from people who sit just outside these traditional boundaries but are still given access, influence, operational importance and trust.
This series of articles will examine some of the less obvious human security risks, how they can affect organizations of any size, and practical steps companies can take to identify and mitigate them before they become losses.
The modern perimeter is not defined by who works for you, but who you allow to affect your organization: who can reach it, who can shape it, who can disrupt it, and who you believe without checking. These individuals are extended some form of access, influence, dependence, or trust without the same level of scrutiny applied to employees.
- Access: Outsiders who can enter facilities and computer networks, or receive sensitive operational and strategic information.
- Influence: Outsiders with the ability to shape organizational decisions without formally owning those decisions.
- Dependence: Outsiders whose failure, compromise, or misconduct could materially disrupt business operations.
- Trust: Outsiders whose representations or affiliation the organization accepts without independent verification.
Access: The Assigned Employee from a Subcontracting Partner
In 2008, the Raytheon Corporation was competing for contracts with the Department of Defense while hosting an employee of Paragon Dynamics, Inc. at their Aurora, Colorado facility. Paragon provided software and satellite engineering services, and the employee, a senior software engineer, was assigned to Raytheon to assist on projects unrelated to the contracts then being completed.
As part of his assignment, the Paragon employee had legitimate access to the Raytheon facility and company computer systems. He used that access to obtain proprietary Raytheon documents stored in a shared electronic location, including proposals for two Department of Defense contracts. He printed the proposals and faxed them to Paragon, which later shared them with a third party working with Paragon on competing proposals.
The employee was authorized to be inside Raytheon's environment. The risk arose because that legitimate access exposed him to information unrelated to the work he was assigned to perform. His status as a trusted outside worker placed him inside the information perimeter without making him a Raytheon employee.
Influence: The Recruiting Firm
In 2006, Staton Holdings, Inc., a wholesale sportswear distributor, hired executive-search firm Tatum, LLC to help fill its chief financial officer position. Tatum presented a candidate whom Staton ultimately hired.
The new CFO remained with the company for only nine months. During that period, Staton alleged that he caused a longtime employee to leave and hired two unnecessary employees. After his departure, Staton learned that his immediately preceding employer had fired him following severe conflicts with management and employees under his supervision.
Staton alleged that Tatum failed to contact that former employer and failed to disclose information that could have materially affected the hiring decision. Tatum's services included background and reference checks, but Staton had relied on the search firm's process without independently confirming the depth or quality of that vetting.
While the recruiter did not make the final hiring decision, it influenced the decision by identifying, presenting, and implicitly validating the candidate. The risk arose when the recruiter's judgment became a substitute for independent verification.
Dependence: The Third-Party Vendor
In 2017, Ascension Data & Analytics, a mortgage-industry data company, retained OpticsML to perform optical character recognition on approximately 37,000 mortgage documents containing sensitive personal and financial information for more than 60,000 consumers.
OpticsML stored the documents on a misconfigured cloud server without adequate protections such as encryption or password controls. The information remained exposed for more than a year and was accessed dozens of times from unauthorized IP addresses, including addresses associated with systems outside the United States.
Ascension maintained a third-party vendor risk-management policy, but the Federal Trade Commission alleged that it failed to take formal steps to determine whether OpticsML could adequately protect the information entrusted to it. The resulting exposure created both security consequences and regulatory liability for Ascension.
Once Ascension transferred sensitive data to an outside provider, that data's security depended in part on controls Ascension did not operate itself. The vendor's weakness became Ascension's weakness.
Trust: Employing Family and Friends
From 2013 through 2019, R&R Excavating, a family-owned Minnesota construction company, employed a longtime family friend as its financial controller. She was responsible for payroll, accounts receivable and payable, corporate credit cards, and company bank accounts.
Over several years, she embezzled more than $2 million by manipulating checks and company funds to pay personal credit-card bills, tax obligations, and other expenses. She also altered the company's accounting records to conceal the activity.
The consequences extended beyond the stolen money. The company suffered reputational harm, employees lost jobs, vendors went unpaid, and its credit was damaged.
R&R's employment of a family friend is not inherently a security risk. The risk occurs when that longstanding personal relationship reinforced a level of trust that was not matched by independent financial controls. Familiarity became a substitute for verification.
Where This Series Goes Next
The risks associated with people outside the perimeter are rarely confined to a single category. This article introduces a broader series examining less obvious exposure risks.
Future installments will look at specific categories of people outside the perimeter, including applicants, recruiters, vendors, subcontractors, investors, advisers, business partners, former employees, outsourced service providers, and others whose relationships with an organization can create security, financial, operational, or reputational risk.
The objective is not to treat every outsider as a threat, but to recognize where access, influence, dependence, or trust creates exposure, and to apply the right level of diligence before that exposure becomes a loss.