New report finds 'ownership muddle' in managing workforce identity security
Few IT and security leaders believe that human resources professionals should be primarily responsible for managing workforce identity security, despite risks related to it first emerging in hiring, according to a new report.
Findings from Entrust showed an "ownership muddle" when it comes to workforce identity, where the 1,000 IT and security leaders surveyed cannot agree on who should take ownership of it.
"Everyone assumes someone owns workforce identity, but few agree on who," the report read.
Only four per cent of the respondents believed that ownership over workforce identity should be genuinely shared, while 45% said the chief information security officer (CISO) or the security team should hold primary responsibility for it.
Another 22% said the IT team should be responsible for workforce identity, while 20% said it should be the chief information officer (CIO).
"Just 8% say the CHRO or HR team owns it, even though HR runs hiring and onboarding, where the gap begins," the report read.
Workforce identity risks begin at hiring
HR's role in managing workforce identity risks comes as the report pointed out that related issues happen before an individual becomes a part of an organisation's workforce.
Over a quarter of the respondents said they have experienced or investigated candidate fraud in the past 12 to 24 months, with another 30% reporting concerns over identity fraud involving fraudulent new hires.
Just 39% of IT and security professionals also reported confidence in being able to verify an individual's identity during hiring, with the figure rising to 43% during onboarding.
"Identity risk doesn't begin at login, and it doesn't end once access is granted. It follows the employee lifecycle from hiring and onboarding to account recovery, remote access, role changes, and offboarding," the report read.
More than a third of the respondents (34%) said they have already investigated employee impersonation incidents, as the report noted that attackers have found humans to be the "weakest link" when it comes to cyber security.
"Workforce identity risk is a collection of threats exploiting the same blind spot. Assuming that an employee account always belongs to the employee makes it harder to defend," the report read.
Artificial intelligence (AI) deployment also adds to the problem, as the report highlighted that generative AI has "industrialised the forgery of people."
"Deepfaked faces in video interviews, cloned voices calling the help desk, forged documents that pass casual review, synthetic candidates, and executives who never sent that urgent request," the report read.
"Every technique aims at the same target: the manual verification and human judgment that legacy processes still depend on."
Addressing workforce identity risks
In the wake of muddled ownership of workforce identity, the report stressed the need to start addressing the issue as early as the hiring process.
"Verifying identity during hiring and onboarding establishes a trusted baseline before someone ever logs in, closing the earliest and most overlooked gap in the workforce lifecycle," the report read.
It added that identity verification works best when it integrates with existing systems, including HR software, to reduce complexity and minimise tool sprawl.
Dan Schawbel, managing partner of Workplace Intelligence, previously advised organisations that addressing candidate fraud should begin with alignment, as it can involve different teams at work.
"HR leaders who skip that conversation often watch their initiative stall on questions they could have answered up front," said Schawbel on LinkedIn, as he shared an excerpt of his Workplace Intelligence Insider Newsletter.
Talent acquisition teams need to decide which roles require verification, where in the funnel it happens, and what should trigger a manual review.
"The team also needs a workflow for failed verifications and clear language for candidates. If you hire internationally, you must confirm that any vendor supports non-English IDs and character sets, and decide which ID types are acceptable in each region," he said.
