Today’s digital world makes it easier than ever to work and collaborate remotely. Because of this, there’s been a rapid rise in the number of vendors working with companies to complete work assignments. From software engineers to copywriters, more and more people are working remotely as independent contractors. Since these people will not be coming into the office, verifying identity is now a critical part of the onboarding process for vendors. Why? Because it ensures that your company isn’t being tricked by anyone with malicious intent and it helps protect sensitive documents from potential fraudsters.

While most organisations already have in-person identity-based authentication procedures in place for new employees, contractors or vendors, are not subjected to the same level of verification. Indeed, the hiring process of any contractor or vendor is quite different to employees. In the post-Covid world, where remote working has become the norm, it becomes difficult to determine whether it is the same contractor (that you hired) or someone else working on their behalf. The big question: How can you ensure that contractors are who they say they are?

Contractor jacking is a risk in any type of remote working environment, and verifying their identity is the only solution to eliminate it. There could be a possibility that contractors may sub out their seats to somebody and now, not only do you not get the person you hired, but you have extra security exposures because you didn't do a background check on that person. When you verify the real identity of your contractors, you are preventing contractor jacking by ensuring that your contractors are who they say they are every time they log into your systems.

According to a recent NordPass report, the average user has 100 different passwords. It's no wonder that passwords are the most attractive and accessible target for hackers looking to break into critical business systems. 

In the 1960s, system designers and admins implemented username and password combinations as a logical and straightforward approach to security. At the time, this made sense because physical limitations meant that systems had limited users, and these users also had little use for multiple system accounts. 

Today, with a vast array of online services like email, social media, e-commerce, cloud storage, and banking, individuals have several accounts across hundreds of platforms, each with unique account information. Relying on passwords to secure all these accounts has led to critical security issues because we don't know the person behind each login attempt. The issue has become so severe that data breaches cost each business an average of $1.07 million per incident, as per an IBM report.

Identity needs to be verified to improve security, and passwords must be eliminated and replaced with an identity-based authentication approach. This means reinforcing authentication with an identity-proofed login so that administrators, for the first time, will know, with 100% certainty, who is accessing corporate IT networks. This differentiation will verify every user (including contractors and vendors) with identity-based biometrics at each access request, eliminate passwords, improve security and deliver an authentic passwordless experience. 

To perform identity verification, contractors, vendors (and employees) prove their identities by scanning their government-issued credentials, like a passport, driver's license, or national ID, in an application that can verify their document's validity with the issuing authority. Then, they can enrol their live biometrics or "live selfie" in the same application that will match their biometrics to their government-issued documents. This way, the user's device is bound to their validated identity, and the user's identity can be used to access applications without user names and passwords. The captured PII data must be encrypted and placed under the user's control for privacy controls.

Physical as well as non-physical forms of identity can be used for these digital identity wallets. The advantage of this is that you can also assign assurance levels. This defines identity assurance as the number of factors that prove you to be the person you claim to be, as validated by a trusted authority, like a government. Your identity assurance level goes up for each additional government credential like a driver's license, a passport, a Telco ID, or Corp ID. If you lose one of those, the technology can dynamically detect that you have lost possession of one of your assurance levels.  

We automatically adjust downward, ensuring that the identity-based authentication remains true to the current fact and is continuous. This approach can be deployed for any application or service, including an SSO system like Okta. In practice, anytime users log in to an SSO, instead of entering the username and a password, they would authenticate using their live biometrics. A credential like a username and a password would never be needed again. 

It's time for organisations to ditch passwords and verify the real identity of their contractors and vendors every time they log in. Complex passwords will unburden users, and organisations will be less susceptible to contractors' security risks.