Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Products

    Netskope products are built on the Netskope Security Cloud.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report Go to Products Overview
Netskope gartner mq 2022 sse leader

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform
Birds eye view metropolitan city

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more
Lighted highway through mountainside switchbacks

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more
Lighting storm over metropolitan area

Zero trust solutions for SSE and SASE deployments

Learn more
Boat driving through open sea

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
Wind turbines along cliffside
  • Our Customers

    Netskope serves more than 2,000 customers worldwide including more than 25 of the Fortune 100

  • Customer Solutions

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

We help our customers to be Ready for Anything

See our Customers
Woman smiling with glasses looking out window

Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn more
Netskope Professional Services

Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn more
Group of young professionals working
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Episode 14: Enabling Security from the Top-Down

Play the podcast
Black man sitting in conference meeting

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky

SASE Week

Netskope is positioned to help you begin your journey and discover where Security, Networking, and Zero Trust fit in the SASE world.

Learn more
SASE Week

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
Four-way roundabout
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more
Curvy road through wooded area

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more
Switchback road atop a cliffside

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Group of diverse young professionals smiling

Gig Workers are the Most Dangerous Insider Threat We Aren’t Talking About

May 13 2021

The term “gig economy” refers to the increasingly common use of skilled freelance or otherwise independent workers on a short-term basis—often one project at a time. The availability of these sorts of gig workers has brought massive change to global work culture over the last few years. 

Uber and Lyft drivers are prime examples. There’s no set schedule; the work is done on a ride-by-ride (gig-by-gig) basis. In the early days of the rideshare business, you were either getting into an Uber vehicle or a Lyft vehicle. But today, drivers often drive for both companies simultaneously. This is a very common aspect of the gig world—workers are often engaged by direct competitors at the same time. The ubiquitous availability of remote skillsets allows labor to be spun up or spun down as needed and workers can be hired from virtually anywhere. 

In the past, an employee worked for a single company at a time—and maybe even at a single company for their entire career. There was a great deal of loyalty and longevity. But today,  a contractor or a full-time employee may only stay at a company for 18 months before they move on to other opportunities. Or, even less time than that. According to a 2021 study from IBM’s Institute for Business Value, one in four workers plans to switch jobs this year, an increased pace vs. even a year ago, which was one in five. Of last year’s job switchers, more than half identified as millennial or Gen Z.

Within the technology industry in particular, however, short-term workers present some acute risks to employers—some of which are quite serious. While the business advantages might be clear, high degrees of temporality and transience make the gig economy a huge bomb for security. But no one seems to hear it ticking yet.

How big is the gig economy?

-More than one-third of US workers (36%) currently participate in the gig economy, either through primary or secondary jobs
-More than half (52%) of global workers participating in the gig economy lost their jobs because of COVID-19
-More than 90% of US workers said they would consider freelancing or independent contracting work—and a lot of times this in addition to their full-time job
-The gig workforce is growing 3x faster than the traditional workforce

Source: Foundly.com

Demand drives opportunities—and vulnerabilities

When it comes to the risks that gig hiring can present, there is a great cautionary tale from just a few years ago. “Bob” was a programmer who was outsourcing his coding to China—pulling down a six-figure income while paying about one-fifth of that to Chinese gig workers. Bob spent his days shopping on eBay and watching cat videos while taking credit for top-quality code and high productivity—until his scam was discovered. They found out that he had also sent his security token to the gig workers to circumvent his company’s two-factor authentication! The details make for a memorable story—but the security and intellectual property (IP) implications of this very situation could be quite damaging for the company deploying that code.

Business digitalization is driving the demand for gig workers. Companies are moving faster than ever. The adoption of cloud technologies allows them to be increasingly versatile and agile. And that means that the attack surface is also changing. The gig worker part of digitalization means that the nature of the insider threat has also evolved. 

Insider threats have always been an issue in the security industry. Some of the biggest cases of data loss and fraud that I’ve come across in my career come from insiders because they know the company’s controls and processes and can find ways around them, easily avoiding detection. But the potential risks associated with gig workers are unique from those of common insiders—making threats even harder to detect and defend against.

A new flavor of insider threat

The rapid churn of many gig projects means that background checks are often overlooked. Because the jobs are short-term, workers are also often not required to have the same security safeguards in place that companies would expect of a contract worker—such as using encrypted hard drives, antivirus protection, and/or secure document repositories.

Gig workers typically use their own computers for jobs, storing sensitive research and proprietary information on a local drive or in a personal cloud account. But what happens to all that information once the job is over? Does it get deleted or is stored and vulnerable to theft? Does it get shared or reused with a competitor? How would the hiring company ever know?

Let’s say you gig-hire an application programmer to write a parsing routine for your company. It takes the gig programmer three months to write it and it costs $100,000 in labor and process fees. After the job is over, that same programmer gets hired by your main competitor—and they just so happen to also need a parsing routine written. Do you think that the gig worker is going to sit down and re-write that entire parsing routine from the beginning? 

They’re probably going to pull out what they’ve already written and just make a few modifications to fit into the competitor’s system. So your competitor saves $80,000 because the gig worker was in a position to reuse your IP without any interference or consequence. Coders tend to feel that if they write a piece of code, then they own it as part of their toolbox. And when that coder is a gig worker, they bring that toolbox from job to job—even to competitors who didn’t put in the R&D cycles to facilitate that code’s development.

Programming is just one area where this threat might arise. Companies also often hire gig workers as market analysts and researchers, sales account managers, IT database analysts, and litigation support the same kinds of risks apply. Pricing data, market analysis, legal research—all of this information has the potential to be reused by another entity via an enterprising gig worker trying to maximize his earnings and minimize the work he has to do. 

Part of the problem is that our sense of what’s valuable may be behind the times. People often think about a company’s “crown jewels” from the perspective of an outsider breaking in to take valuable data. But in the context of an insider threat, the crown jewels will be different. And so we have to start thinking about everything that’s valuable to the organization today and how it can be exploited. 

It’s not just temporary hires that carry gig economy risks. Full-time employees may also be moonlighting as gig workers on the side for additional income. With a majority of workers now doing their jobs remotely, there’s no one looking over their shoulder to see if they’re working on something on the side or pulling in code from a previous job. 
All told, the level of insider risk has escalated since the start of COVID—and much of that can be traced to the gig economy boom. Most of today’s remote employees do not expect to return to the workplace anytime soon. Without advanced controls in place to detect and protect against misuse of sensitive information, nothing is stopping an employee from re-using proprietary data for the benefit of another company and their own personal gain.

Risk assessment: detect, protect, and respond

With the potential threats that gig workers might pose more clearly defined, it’s now critical to take the next step of calculating the actual risks they present to a business. 

  1. What’s the likelihood of a vulnerability or threat in your company? 
  2. What data does your company actually have at risk in this situation?
  3. And what would be the impact on the company if that data were exploited?

The results of that risk assessment in hand can then inform a protection plan. First, there will be a need for administrative controls. The organization needs policies in place—clear direction from the executive team regarding the appropriate use of both gig and remote workers. Outline the situations where it is acceptable to hire a freelancer and what limitations should be placed to manage these sorts of temporary vendors. With defined policies, the business can then issue contracts to gig workers that clearly illustrate the legal requirements of the job—such as confidentiality via a nondisclosure agreement (NDA), security requirements, restrictions on outsourcing, and indemnification.

Process controls may include new-hire training for gig workers in order to educate them on your company policies and expectations. Internally, business leaders also need to be trained on the risks associated when hiring gig workers. There should also be safeguards in place to prevent bypassing of vendor management—which usually means involving the accounts payable department to ensure that only trained and vetted gig vendors can get paid.

The security technologies that address gig worker risks are a combination of remote worker controls, contractor controls, and Zero Trust Network Access (ZTNA) controls. This may include the use of a virtual private network (VPN), requiring two-factor authentication for access to company applications, and tightening data/file access rules for this type of worker. The core principle of Zero Trust is especially key here, as gig workers exist outside of your traditional security perimeter and you can’t inherently trust the authentication, device, network, or applications they’re using. Next-generation VPN capabilities can provide direct application access so that the gig worker can only access the application they need to do their job and nothing else within the company. Similarly, a Zero Trust architecture can help organizations to create an adaptive trust model that is more agile and can change based on the circumstances of each worker.

The gig economy is here to stay

The gig workforce is growing because of the overwhelming value that it can offer to both businesses and individuals. Organizations should lean in and embrace this global shift. At the end of the day, a gig worker should be treated as another form of contractor. The same rules should apply in terms of contracting, endpoint security controls, cloud monitoring (behavior patterns with regard to system/data access and movement of files), and having a system in place for rapid background checks.

Start by assessing the risk you have in your environment. Then create a roadmap of monitoring and controls. Organizations today need contextual controls that follow data and users. Granular access controls reduce the surface area at risk. This should include:

  • Identity controls that provide strong access authentication and behavioral analytics that cover both user- and device-based risks.
  • Application controls that include adaptive access and activity controls.
  • Data controls with automated discovery and classification, single-pass policy enforcement, as well as data loss prevention (DLP).

If you’re interested in hearing more of my thoughts on securing the gig economy, come to my session at RSA!

author image
James Christiansen
James Christiansen is Netskope’s vice president of cloud security transformation and leader of the Global Chief Strategy Office. He is focused on enhancing Netskope’s global clients understand the challenges and solutions of cloud deployments by helping drive thought leadership in cloud security transformation.