Netskope named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge. Get the report

  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,000 customers worldwide including more than 25 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

Still Highest in Execution.
Still Furthest in Vision.

Learn why 2024 Gartner® Magic Quadrant™ named Netskope a Leader for Security Service Edge the third consecutive year.

Get the report
Netskope Named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Service Edge graphic for menu
We help our customers to be Ready for Anything

See our customers
Woman smiling with glasses looking out window
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Learn about Netskope One
Abstract with blue lighting
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Netskope video
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

How to Use a Magic Quadrant and Other Industry Research
In this episode Max Havey, Steve Riley and Mona Faulkner dissect the intricate process of creating a Magic Quadrant and why it's much more than just a chart.

Play the podcast
How to Use a Magic Quadrant and Other Industry Research podcast
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Replay sessions from the fourth annual SASE Week.

Explore sessions
SASE Week 2023
What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn about Security Service Edge
Four-way roundabout
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Leadership chevron

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working

Gig Workers are the Most Dangerous Insider Threat We Aren’t Talking About

May 13 2021

The term “gig economy” refers to the increasingly common use of skilled freelance or otherwise independent workers on a short-term basis—often one project at a time. The availability of these sorts of gig workers has brought massive change to global work culture over the last few years. 

Uber and Lyft drivers are prime examples. There’s no set schedule; the work is done on a ride-by-ride (gig-by-gig) basis. In the early days of the rideshare business, you were either getting into an Uber vehicle or a Lyft vehicle. But today, drivers often drive for both companies simultaneously. This is a very common aspect of the gig world—workers are often engaged by direct competitors at the same time. The ubiquitous availability of remote skillsets allows labor to be spun up or spun down as needed and workers can be hired from virtually anywhere. 

In the past, an employee worked for a single company at a time—and maybe even at a single company for their entire career. There was a great deal of loyalty and longevity. But today,  a contractor or a full-time employee may only stay at a company for 18 months before they move on to other opportunities. Or, even less time than that. According to a 2021 study from IBM’s Institute for Business Value, one in four workers plans to switch jobs this year, an increased pace vs. even a year ago, which was one in five. Of last year’s job switchers, more than half identified as millennial or Gen Z.

Within the technology industry in particular, however, short-term workers present some acute risks to employers—some of which are quite serious. While the business advantages might be clear, high degrees of temporality and transience make the gig economy a huge bomb for security. But no one seems to hear it ticking yet.

How big is the gig economy?

-More than one-third of US workers (36%) currently participate in the gig economy, either through primary or secondary jobs
-More than half (52%) of global workers participating in the gig economy lost their jobs because of COVID-19
-More than 90% of US workers said they would consider freelancing or independent contracting work—and a lot of times this in addition to their full-time job
-The gig workforce is growing 3x faster than the traditional workforce


Demand drives opportunities—and vulnerabilities

When it comes to the risks that gig hiring can present, there is a great cautionary tale from just a few years ago. “Bob” was a programmer who was outsourcing his coding to China—pulling down a six-figure income while paying about one-fifth of that to Chinese gig workers. Bob spent his days shopping on eBay and watching cat videos while taking credit for top-quality code and high productivity—until his scam was discovered. They found out that he had also sent his security token to the gig workers to circumvent his company’s two-factor authentication! The details make for a memorable story—but the security and intellectual property (IP) implications of this very situation could be quite damaging for the company deploying that code.

Business digitalization is driving the demand for gig workers. Companies are moving faster than ever. The adoption of cloud technologies allows them to be increasingly versatile and agile. And that means that the attack surface is also changing. The gig worker part of digitalization means that the nature of the insider threat has also evolved. 

Insider threats have always been an issue in the security industry. Some of the biggest cases of data loss and fraud that I’ve come across in my career come from insiders because they know the company’s controls and processes and can find ways around them, easily avoiding detection. But the potential risks associated with gig workers are unique from those of common insiders—making threats even harder to detect and defend against.

A new flavor of insider threat

The rapid churn of many gig projects means that background checks are often overlooked. Because the jobs are short-term, workers are also often not required to have the same security safeguards in place that companies would expect of a contract worker—such as using encrypted hard drives, antivirus protection, and/or secure document repositories.

Gig workers typically use their own computers for jobs, storing sensitive research and proprietary information on a local drive or in a personal cloud account. But what happens to all that information once the job is over? Does it get deleted or is stored and vulnerable to theft? Does it get shared or reused with a competitor? How would the hiring company ever know?

Let’s say you gig-hire an application programmer to write a parsing routine for your company. It takes the gig programmer three months to write it and it costs $100,000 in labor and process fees. After the job is over, that same programmer gets hired by your main competitor—and they just so happen to also need a parsing routine written. Do you think that the gig worker is going to sit down and re-write that entire parsing routine from the beginning? 

They’re probably going to pull out what they’ve already written and just make a few modifications to fit into the competitor’s system. So your competitor saves $80,000 because the gig worker was in a position to reuse your IP without any interference or consequence. Coders tend to feel that if they write a piece of code, then they own it as part of their toolbox. And when that coder is a gig worker, they bring that toolbox from job to job—even to competitors who didn’t put in the R&D cycles to facilitate that code’s development.

Programming is just one area where this threat might arise. Companies also often hire gig workers as market analysts and researchers, sales account managers, IT database analysts, and litigation support the same kinds of risks apply. Pricing data, market analysis, legal research—all of this information has the potential to be reused by another entity via an enterprising gig worker trying to maximize his earnings and minimize the work he has to do. 

Part of the problem is that our sense of what’s valuable may be behind the times. People often think about a company’s “crown jewels” from the perspective of an outsider breaking in to take valuable data. But in the context of an insider threat, the crown jewels will be different. And so we have to start thinking about everything that’s valuable to the organization today and how it can be exploited. 

It’s not just temporary hires that carry gig economy risks. Full-time employees may also be moonlighting as gig workers on the side for additional income. With a majority of workers now doing their jobs remotely, there’s no one looking over their shoulder to see if they’re working on something on the side or pulling in code from a previous job. 
All told, the level of insider risk has escalated since the start of COVID—and much of that can be traced to the gig economy boom. Most of today’s remote employees do not expect to return to the workplace anytime soon. Without advanced controls in place to detect and protect against misuse of sensitive information, nothing is stopping an employee from re-using proprietary data for the benefit of another company and their own personal gain.

Risk assessment: detect, protect, and respond

With the potential threats that gig workers might pose more clearly defined, it’s now critical to take the next step of calculating the actual risks they present to a business. 

  1. What’s the likelihood of a vulnerability or threat in your company? 
  2. What data does your company actually have at risk in this situation?
  3. And what would be the impact on the company if that data were exploited?

The results of that risk assessment in hand can then inform a protection plan. First, there will be a need for administrative controls. The organization needs policies in place—clear direction from the executive team regarding the appropriate use of both gig and remote workers. Outline the situations where it is acceptable to hire a freelancer and what limitations should be placed to manage these sorts of temporary vendors. With defined policies, the business can then issue contracts to gig workers that clearly illustrate the legal requirements of the job—such as confidentiality via a nondisclosure agreement (NDA), security requirements, restrictions on outsourcing, and indemnification.

Process controls may include new-hire training for gig workers in order to educate them on your company policies and expectations. Internally, business leaders also need to be trained on the risks associated when hiring gig workers. There should also be safeguards in place to prevent bypassing of vendor management—which usually means involving the accounts payable department to ensure that only trained and vetted gig vendors can get paid.

The security technologies that address gig worker risks are a combination of remote worker controls, contractor controls, and Zero Trust Network Access (ZTNA) controls. This may include the use of a virtual private network (VPN), requiring two-factor authentication for access to company applications, and tightening data/file access rules for this type of worker. The core principle of Zero Trust is especially key here, as gig workers exist outside of your traditional security perimeter and you can’t inherently trust the authentication, device, network, or applications they’re using. Next-generation VPN capabilities can provide direct application access so that the gig worker can only access the application they need to do their job and nothing else within the company. Similarly, a Zero Trust architecture can help organizations to create an adaptive trust model that is more agile and can change based on the circumstances of each worker.

The gig economy is here to stay

The gig workforce is growing because of the overwhelming value that it can offer to both businesses and individuals. Organizations should lean in and embrace this global shift. At the end of the day, a gig worker should be treated as another form of contractor. The same rules should apply in terms of contracting, endpoint security controls, cloud monitoring (behavior patterns with regard to system/data access and movement of files), and having a system in place for rapid background checks.

Start by assessing the risk you have in your environment. Then create a roadmap of monitoring and controls. Organizations today need contextual controls that follow data and users. Granular access controls reduce the surface area at risk. This should include:

  • Identity controls that provide strong access authentication and behavioral analytics that cover both user- and device-based risks.
  • Application controls that include adaptive access and activity controls.
  • Data controls with automated discovery and classification, single-pass policy enforcement, as well as data loss prevention (DLP).

If you’re interested in hearing more of my thoughts on securing the gig economy, come to my session at RSA!

author image
James Christiansen
James Christiansen is Netskope’s vice president of cloud security transformation and leader of the Global Chief Strategy Office. He is focused on enhancing Netskope’s global clients understand the challenges and solutions of cloud deployments by helping drive thought leadership in cloud security transformation.

Stay informed!

Subscribe for the latest from the Netskope Blog