Is the person you interviewed the person you hired? As organizations recognize Cybersecurity Awareness Month, Amy S. Mushahwar and Kathleen A. McGee discuss how increasingly convincing deepfakes are challenging virtual hiring processes and the safeguards companies can implement during interviewing, onboarding, and system access in this episode of the "Cybersecurity Awareness Series."
Speakers:
- Amy S. Mushahwar, Partner; Chair, Data Privacy, Security, Safety & Risk Management
- Kathleen A. McGee, Partner, Data Privacy, Security, Safety & Risk Management
Lowenstein Sandler Cybersecurity Awareness Series
Kathleen A. McGee, partner in the firm’s Emerging Companies & Venture Capital (ECVC) group and White Collar Defense practice, and Ken Fishkin, manager of information security, share what you need to know to protect your organization’s information, how to prepare your company for the possibility of various data breaches, the most common points of entry for intruders, and other cybersecurity concerns that every organization should be aware of.
READ THE TRANSCRIPT
Amy S. Mushahwar: Stop asking whether or not you can spot the fake. In most cases, you probably can't, and neither can your interviewers. Ask a different question, which is the question that we usually are confronted when it is a fraud group. Is the person who started within your organization on Monday the same person that you interviewed earlier last week on Tuesday? Most companies have siloed intake and are not validating identity as they go through the process. Check identity more than once, add an application during an interview, and again before day one. If you do not kind of follow the HR business process and follow the individual, gaps occur.
This all really started as a national security story. We saw federal warnings about workers using stolen identities and U.S.-based helpers to land remote jobs and gain system access. It's now a general fraud issue.
Kathleen A. McGee: Especially with remote work, and particularly because you don't get to see somebody in person, making sure that people only have access to certain levels of your organization on an as-needed basis is an integral component of your organization's safety, both from an intellectual and a cybersecurity perspective.
So you may have felt that you've done a complete vetting of that individual that brought them on board. Bring them on board slowly. Be very careful about what access they have to critical infrastructure and to information and systems outside of what's absolutely necessary for their workplace.
