310-553-3055
213-463-2100
Your company interviews someone over video.
They have the right experience.
Their résumé checks the boxes.
They answer the questions.
You hire them.
HR completes the paperwork. IT creates their Microsoft 365 account, gives them access to company systems, and ships them a laptop.
Everything seems normal.
But what if the person you just gave access to your business isn't actually who you think they are?
That might sound like an unlikely scenario.
A recent Justice Department case suggests businesses shouldn't dismiss it so quickly.
More Than 70 U.S. Companies Were Affected
On October 13, the U.S. Department of Justice announced coordinated actions involving alleged schemes in which North Korean IT workers obtained remote jobs at American companies.
According to the DOJ, the workers used stolen or fabricated identities and other methods to make themselves appear to be legitimate remote employees. U.S.-based facilitators allegedly helped support the operation, including by receiving company-issued computers at locations in the United States so workers elsewhere could remotely access them.
The alleged schemes affected more than 70 U.S. companies, and federal authorities seized approximately 187 computer devices as part of the operation.
It's a fascinating story.
But I think there's a much bigger lesson here for businesses.
Cybersecurity doesn't start when someone receives their password. It starts with deciding who should receive one in the first place.
We Usually Think About Hiring as an HR Process
Most businesses have a fairly clear division of responsibilities when someone new joins the company.
HR handles the hiring.
IT handles the technology.
Someone gets hired, and IT receives a request:
Create an account.
Set up email.
Give them access to these applications.
Ship them a laptop.
From IT's perspective, the person has already been approved.
But remote work has changed something important.
The employee may never walk through your front door.
The person conducting the interview may never sit across a table from them.
The IT employee creating the account may never meet them at all.
That means identity verification has become part of cybersecurity.
And HR and IT can't treat those as completely separate responsibilities anymore.
The Laptop Doesn't Tell You Where the Employee Is
One of the most interesting parts of these cases is how the alleged laptop farms worked.
Companies could ship computers to addresses in the United States. Those computers could remain physically in the United States while someone somewhere else accessed them remotely.
Federal investigators say U.S.-based facilitators helped create that appearance for overseas workers.
Think about what that means from a company's perspective.
You may see a corporate laptop.
You may see a U.S.-based connection.
You may see someone logging into the applications they're supposed to use.
Individually, those things can look legitimate.
That's why cybersecurity can't depend on one signal.
You need processes that help you understand who is accessing your environment, what they're accessing, and whether the activity makes sense.
Hiring Someone Also Means Granting Them Trust
When businesses think about cybersecurity threats, they often picture someone trying to break in from the outside.
But hiring someone changes the equation.
You don't make them break in.
You give them access.
Email.
Files.
Customer information.
Internal communications.
Applications.
Source code.
Financial information.
Administrative tools, depending on their role.
The FBI has warned that North Korean IT workers have used legitimate employment access to take company information and, in some cases, attempted to extort employers after being discovered.
That's why the hiring process isn't completely separate from the security process.
Every new account represents trust your business has decided to extend.
Identity Verification Can't Stop at the Interview
For businesses hiring remotely, verifying someone's identity can't be a box that's checked once and forgotten.
The FBI has urged businesses to strengthen the way they verify remote workers, and I think there's a larger lesson behind that guidance.
Look at the entire process.
Does the information provided during the interview remain consistent when the person is onboarded?
Does the person who interviewed appear to be the same person who shows up for onboarding?
If an address, phone number, or payment method suddenly changes, does anyone stop to ask why?
If you're relying on a staffing company to find employees, do you know how they're verifying the people they send you?
None of those questions requires HR to become a cybersecurity team.
But they do require HR and IT to recognize that establishing someone's identity is now part of protecting the business.
Don't Give a New Employee the Keys to Everything
Even when someone's identity is completely legitimate, there's another lesson here.
A new employee should only have access to what they actually need.
That's the principle of least privilege, and it's one of those cybersecurity concepts that sounds technical but is really just common sense.
If someone works in marketing, they probably don't need access to payroll.
If someone works in accounting, they may not need administrative control over your entire Microsoft environment.
If a contractor needs access to one project, that doesn't mean they need access to every project.
The FBI also recommends limiting privileges as part of protecting businesses from this type of threat.
The reason is simple.
If an account is compromised, misused, or turns out to belong to someone you shouldn't have trusted, the damage that account can cause is partly determined by what you allowed it to reach.
Pay Attention After the Person Is Hired
Passing an identity check on day one shouldn't make an account invisible on day two.
Your security systems should be looking for activity that doesn't fit.
Unexpected remote connections.
Logins that don't make sense.
Unauthorized remote-access software.
Large amounts of company information moving somewhere it normally wouldn't.
Those types of behaviors are among the warning signs the FBI has advised businesses to monitor.
This isn't about watching every move an employee makes.
It's about recognizing activity that doesn't match what you'd reasonably expect from that person or device.
Security controls should be able to ask the digital equivalent of:
Does this make sense?
Sometimes that's one of the most useful questions in cybersecurity.
HR and IT Need to Have This Conversation Together
This may be the biggest takeaway for me.
Cybersecurity is often treated as an IT responsibility.
Hiring is treated as an HR responsibility.
But the line between the two isn't as clean as it used to be.
HR may be the first team with an opportunity to spot an identity problem.
IT may be the first team to notice unusual activity after someone is hired.
Managers understand what access an employee actually needs.
Security teams understand what unusual access might look like.
Those pieces need to connect.
Because a company can have great firewalls, endpoint protection, multifactor authentication, and security monitoring and still create a serious vulnerability if it gives legitimate credentials to the wrong person.
Cybersecurity Starts Before Someone Gets a Login
The vast majority of people you hire aren't secretly trying to infiltrate your business.
That's not the point.
The lesson from this case is that the way businesses establish trust has changed.
Remote hiring has enormous advantages.
It also means businesses need processes designed for a world where the person interviewing for a job, the person receiving the laptop, and the person ultimately accessing company systems may never physically enter an office.
So, when your company hires its next remote employee, don't only ask:
"Are they qualified for the job?"
There's another question worth answering:
"Have we verified who we're about to trust with our business?"
Because cybersecurity doesn't begin after someone logs in.
It begins with deciding who should be allowed to log in at all.
