Why Worker Impersonation Is Exploding - The CyberVault with Bojan Simic

Welcome back to another episode of The Cyber Vault. Today I am very excited to be joined by Boy on Symmet, Boy on his co-founder and CEO of Hyper. And Hyper's a company helping organizations build real trust in digital identity. Boy has been working on this challenge for years and he's looking at how we prove who we are online, how that proof can be used safely and securely. There's lately been a growing threat that hits a bit closer to home, fake workers, stolen identities and even nation-state groups posting as legitimate employees. In this episode we're going to talk about how worker impersonation is becoming a real issue, why groups like North Korean IT operatives targeting Western companies, how HR teams unexpectedly become part of the security defence and what it really means to verify a person's identity in today's digital world. But before we unpack all of that, Boy on, it's such a pleasure to have you here with me today. Thank you for joining. Why don't you give us a high level introduction to yourself? Thank you for having me. As you said, I'm Boy on Symmet, live in New York City, co-founder CEO here at Hyper and I've been running this company with my co-founder since 2014. So it's been a really fun and interesting journey working in this identity security space and now the worlds of traditional IT, HR and security are quickly colliding and it's all being mixed in with the prominent use of AI in companies. It's creating a whole new set of threats that we have to worry about from a cyber security perspective, from our risk perspective and from a hiring perspective. So I'm looking forward to this discussion. Awesome. I suppose over the past decade you've probably seen so much change in transformation within the space, specifically identity because I think, you know, identity has been a part of the market that wasn't always taken super seriously. It's now becoming embodied in pretty much, you know, every single solution out there. People are really recognising how important it is. But I think what we're going to impact today is a part of our identity that people don't always think about and it's definitely become more prominent over the past kind of few years post COVID, really. But I mean, let's start simple. Let's start at the beginning because when we talk about worker impersonation, I mean, what do we actually mean by this? You know, what are you seeing happen in the real world here? So it can mean a few different things. It can be sometimes an individual is just interviewing on behalf of another one to help them get a job. Other times it is individuals who are outsourcing their jobs to people in other countries, you know, so they can collect multiple streams of income, so to say. It can be nation-state adversaries such as North Korea, China, Russia, who have state-sponsored programs that specifically try to get more money for their regime or their government, or they use worker impersonation to steal intellectual property or otherwise get a foothold within organizations. So it's a number of things and some of these are in the news more than others, especially the North Korean ones, I'd say. Absolutely, and I think, you know, something that, can you mention the multiple different avenues or words there? And I suppose a lot of people don't even realise that this is something that's going on, but definitely something we're seeing a lot more of. And I think as well dependent on roles, so many remote-based roles now are kind of allowing this opportunity to open up a bit more. I mean, you obviously just referenced that. We're not seeing all, basically, we're not seeing it exposed in the stories of how much this is maybe happening, but we are definitely hearing a little bit more about now, I think more specifically about fake job applications, you know, even with restaurants, kind of nation-state groups going through the hiring process. I mean, why do you think this is starting to become something that's really on the forefront of, hey, this is actually a pretty big widespread problem? There's really a few causes and it's kind of a perfect storm right now. The first is there's more people working remotely now than ever. That's primarily due to the pandemic. So depending on which source you read, but somewhere between 35 and 40% of jobs are now permanently remote. And companies have seen benefits of this, and they're also seen some of the negatives. So now it makes more sense to execute a worker impersonation type of attack, because there's just so much more opportunity to do it. Two is it's easier than ever before to do it to accomplish such a task. So now we have AI deep fakes where, you know, if I'm a man in Southeast Asia, I can look like a woman in England on a Zoom call. And so being able to impersonate individuals in the western part of the world, from the eastern part of the world and others is easier than ever as well. And it's really the confluence of these two things that's making it much easier to perpetrate these attacks. And then the third one, which has kind of been simmering over the last few years is, you know, every few weeks or months, we read some new story about some major security breach that resulted in hundreds of thousands or millions of identities being stolen. Well, what happens is these stolen identities find their ways into the dark web. And then these identities become really, really cheap to purchase. And so when we think about, you know, security controls or HR-related controls, such as the I-9 processing at states or whatever onboarding process you may have as an organization or on the world, it's pretty trivial for hackers to buy identities on the dark web that are vetted that can pass a background check that have all the documentation necessary. So a lot of times, HR teams in particular feel like, you know, the the I-9 process or the background check process is a defense. And it really isn't to anybody who's even the least specificated at executing one of these attacks. And I think that's definitely something that will have to unpack later, because actually there's there's a really big difference there between obviously when we're looking at things like background checks and actual like identity verification. But I want to touch base on something that you talked about a little bit about earlier. And that's because, you know, one of the things that we've definitely heard about a lot is the talk of specifically North Korean IT workers like posing as remote employees. And obviously we've already kind of referenced the fact that it's obviously not just North Korea. There's other different kind of countries that are doing this as well. But I mean, how real is this problem? You know, is it pretty widespread? Is it more just the fact that it's publicised a lot more than I suppose? Other things and therefore we're just seeing it. You know, kind of how big is this issue? Yeah, the reason the North Korean side of it is so publicised is because at least in the United States, it's illegal to do work with the North Korean government. And so the FBI and other state and government agencies actively look for companies that are either intentionally or unintentionally working with the North Korean government. And so when they catch it, it gets publicised. But other countries yet know how many others are on the world where these worker impersonation attacks are coming from. There's many, many more of those than North Korean ones. But we don't hear about them because it's not necessarily illegal. And so I think we've all seen it where an HR team will publish a job online. And you know, three, four years ago, they might get 100 applicants, but now they get 1500. And it's a really uncomfortable situation because a lot of these are bots and a lot of these are impersonators. And it's one of the situations where they really don't have to be right all the time. They just need to be right a couple of times. And it leads to a big payout. And I think that's definitely one of the biggest challenges that we can kind of look at. And there's so much to unpack there. But I'm curious to you, I mean, you know, when we look at kind of, why is this happening? You know, what are these groups trying to achieve? Is it about stealing money? You know, is it about data? Is it something else entirely that I suppose is kind of the motivation behind why they're trying to do this? Through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right, and they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. You know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries. But, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies, and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have four or five different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have 4, 5 different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money through their employment, right? So this could be requiring them to do point in time, identity verification checks throughout their employment, especially in those early phases, where we've seen companies find situations where those employees will then outsource their jobs to individuals in other countries, right? We've seen many instances where a single individual will have 4, 5 different jobs across different companies, right? And they're essentially outsourcing their jobs to individuals in other countries, but, you know, they're sitting at their computer desk in the United States with 5, 10 laptops around them from 5, 10 different companies and making a lot of money. They're really, really insightful, and I think you guys are obviously doing some super interesting, but ultimately, critical things that, as opposed companies are now going to be taking very much seriously, especially as we're seeing higher and ramp up on that remote level, and arguably globally, you know, people are really trying to get that global reach when it comes to having their teams based on kind of all over the world. So, I mean, this has been a fantastic episode. You know, so much to unpack here. I reckon we could talk about this subject for quite some time, but I think to kind of close out on, for any of the leaders listening, whether they're HR, CSOs, founders, whatever it may be, what's one simple step that you would recommend that they could take right now to protect their companies from worker impersonation? I think the simplest thing you can do right now is implement a identity verification process that ties the identity of the document that was provided at onboarding to the actual person and doing so in a audit type of fashion. So, we're seeing companies doing this, especially for their remote worker and contractor populations first. So, what they can do is, is they can do this in a, essentially, as an audit where they just provide the list of employees, and what they can do is, at least what we do is, we take them through this verification process and then provide a report at the end of it. And so, this at least helps establish a baseline for businesses so that they have a fundamental understanding of who's who at our organization. And then they can start implementing some of these other controls, you know, ahead of the interview process or as part of the recruitment process to ensure that anybody knew that they're bringing into the organization is also who they say they are. Awesome. Well, what a great piece of advice to close out on is something that's definitely actionable straight off the back of the podcast. But Boyam, thank you so much for joining me here today. Honestly, it's really eye-opening to think about the hiring process itself becoming a really major security front and like we say, with the fact that these teams are now on the forefront of that front line when it comes to protecting the process. So, I mean, it's exciting to see that there's really innovative kind of technology coming forward, like what you guys are doing over a high-perse. So, thank you so much for sharing all of that with us. To our listeners, as always, don't forget to subscribe, make sure to share this episode with your security peers, or your HR and talent acquisition peers. Make sure to get connected with us on LinkedIn and as well make sure to connect with Boyam and the team over at Hyper as well. But that's it for today. So, thank you so much for tuning in and I will see you next time for more conversations shaping cyber. Thank you for having me.