L’avenir du Zero Trust et du SASE, c’est maintenant ! Regarder à la demande

fermer
fermer
  • Pourquoi Netskope signe chevron

    Changer la façon dont le réseau et la sécurité fonctionnent ensemble.

  • Nos clients signe chevron

    Netskope sert plus de 3 000 clients dans le monde entier, dont plus de 25 entreprises du classement Fortune 100

  • Nos partenaires signe chevron

    Nous collaborons avec des leaders de la sécurité pour vous aider à sécuriser votre transition vers le cloud.

Meilleure capacité d'exécution. Le plus loin dans sa vision.

Netskope nommé leader dans le rapport Magic Quadrant™️ 2023 pour SSE de Gartner®.

Recevoir le rapport
Netskope nommé leader dans le rapport Magic Quadrant™️ 2023 pour SSE de Gartner®.
Nous parons nos clients à l'avenir, quel qu'il soit

See our customers
Woman smiling with glasses looking out window
La stratégie de commercialisation de Netskope privilégie ses partenaires, ce qui leur permet de maximiser leur croissance et leur rentabilité, tout en transformant la sécurité des entreprises.

En savoir plus sur les partenaires de Netskope
Group of diverse young professionals smiling
Votre réseau de demain

Planifiez votre chemin vers un réseau plus rapide, plus sûr et plus résilient, conçu pour les applications et les utilisateurs que vous prenez en charge.

Obtenir le livre blanc
Votre réseau de demain
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

En savoir plus sur Netskope One
Abstract with blue lighting
Adopter une architecture SASE (Secure Access Service Edge)

Netskope NewEdge est le nuage privé de sécurité le plus grand et le plus performant au monde. Il offre aux clients une couverture de service, des performances et une résilience inégalées.

Découvrez NewEdge
NewEdge
Netskope Cloud Exchange

Le Netskope Cloud Exchange (CE) fournit aux clients des outils d'intégration puissants pour optimiser les investissements dans l'ensemble de leur infrastructure de sécurité.

En savoir plus sur Cloud Exchange
Vidéo Netskope
La plateforme du futur est Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), et Private Access for ZTNA intégrés nativement dans une solution unique pour aider chaque entreprise dans son cheminement vers l'architecture Secure Access Service Edge (SASE).

Présentation des produits
Vidéo Netskope
Next Gen SASE Branch est hybride - connectée, sécurisée et automatisée

Netskope Next Gen SASE Branch fait converger Context-Aware SASE Fabric, Zero-Trust Hybrid Security et SkopeAI-Powered Cloud Orchestrator dans une offre cloud unifiée, ouvrant la voie à une expérience de succursale entièrement modernisée pour l'entreprise sans frontières.

En savoir plus Next Gen SASE Branch
Personnes au bureau de l'espace ouvert
La conception d'une architecture SASE pour les nuls

Obtenez votre exemplaire gratuit du seul guide consacré à la conception d'une architecture SASE dont vous aurez jamais besoin.

Obtenir l'EBook
Optez pour les meilleurs services de sécurité cloud du marché, avec un temps de latence minimum et une fiabilité élevée.

Découvrez NewEdge
Lighted highway through mountainside switchbacks
Permettez en toute sécurité l'utilisation d'applications d'IA générative grâce au contrôle d'accès aux applications, à l'accompagnement des utilisateurs en temps réel et à une protection des données de premier ordre.

Découvrez comment nous sécurisons l'utilisation de l'IA générative
Autorisez ChatGPT et l’IA générative en toute sécurité
Solutions Zero Trust pour les déploiements du SSE et du SASE

En savoir plus sur la confiance zéro
Boat driving through open sea
Netskope obtient l'autorisation FedRAMP High Authorization

Choisissez Netskope GovCloud pour accélérer la transformation de votre agence.

En savoir plus sur Netskope GovCloud
Netskope GovCloud
  • Ressources signe chevron

    Découvrez comment Netskope peut vous aider à sécuriser votre migration vers le Cloud.

  • Blog signe chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE)

  • Events and Workshops signe chevron

    Restez à l'affût des dernières tendances en matière de sécurité et créez des liens avec vos pairs.

  • Définition de la sécurité signe chevron

    Tout ce que vous devez savoir dans notre encyclopédie de la cybersécurité.

Podcast Security Visionaries

Élections, désinformation et sécurité
Cet épisode se penche sur les aspects de la sécurité électorale liés à l'inscription des électeurs et aux contrôles physiques dans les bureaux de vote.

Écouter le podcast
Blog : Élections, désinformation et sécurité
Derniers blogs

Read how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Lire le blog
Sunrise and cloudy sky
SASE Week 2023 : Votre voyage SASE commence maintenant !

Retrouvez les sessions de la quatrième édition annuelle de SASE Week.

Explorer les sessions
SASE Week 2023
Qu'est-ce que le Security Service Edge ?

Découvrez le côté sécurité de SASE, l'avenir du réseau et de la protection dans le cloud.

En savoir plus sur Security Service Edge
Four-way roundabout
  • Entreprise signe chevron

    Nous vous aidons à conserver une longueur d'avance sur les défis posés par le cloud, les données et les réseaux en matière de sécurité.

  • Équipe de direction signe chevron

    Nos dirigeants sont déterminés à faciliter la réussite de nos clients.

  • Solutions pour les clients signe chevron

    Nous sommes là pour vous et avec vous à chaque étape, pour assurer votre succès avec Netskope.

  • Formation et certification signe chevron

    Avec Netskope, devenez un expert de la sécurité du cloud.

Soutenir le développement durable par la sécurité des données

Netskope est fière de participer à Vision 2045 : une initiative visant à sensibiliser au rôle de l'industrie privée dans le développement durable.

En savoir plus
Soutenir le développement durable grâce à la sécurité des données
Penseurs, concepteurs, rêveurs, innovateurs. Ensemble, nous fournissons le nec plus ultra des solutions de sécurité cloud afin d'aider nos clients à protéger leurs données et leurs collaborateurs.

Rencontrez notre équipe
Group of hikers scaling a snowy mountain
L’équipe de services professionnels talentueuse et expérimentée de Netskope propose une approche prescriptive pour une mise en œuvre réussie.

En savoir plus sur les services professionnels
Services professionnels Netskope
Sécurisez votre parcours de transformation numérique et tirez le meilleur parti de vos applications cloud, Web et privées grâce à la formation Netskope.

En savoir plus sur les formations et les certifications
Group of young professionals working

Gig Workers are the Most Dangerous Insider Threat We Aren’t Talking About

May 13 2021

The term “gig economy” refers to the increasingly common use of skilled freelance or otherwise independent workers on a short-term basis—often one project at a time. The availability of these sorts of gig workers has brought massive change to global work culture over the last few years. 

Uber and Lyft drivers are prime examples. There’s no set schedule; the work is done on a ride-by-ride (gig-by-gig) basis. In the early days of the rideshare business, you were either getting into an Uber vehicle or a Lyft vehicle. But today, drivers often drive for both companies simultaneously. This is a very common aspect of the gig world—workers are often engaged by direct competitors at the same time. The ubiquitous availability of remote skillsets allows labor to be spun up or spun down as needed and workers can be hired from virtually anywhere. 

In the past, an employee worked for a single company at a time—and maybe even at a single company for their entire career. There was a great deal of loyalty and longevity. But today,  a contractor or a full-time employee may only stay at a company for 18 months before they move on to other opportunities. Or, even less time than that. According to a 2021 study from IBM’s Institute for Business Value, one in four workers plans to switch jobs this year, an increased pace vs. even a year ago, which was one in five. Of last year’s job switchers, more than half identified as millennial or Gen Z.

Within the technology industry in particular, however, short-term workers present some acute risks to employers—some of which are quite serious. While the business advantages might be clear, high degrees of temporality and transience make the gig economy a huge bomb for security. But no one seems to hear it ticking yet.

How big is the gig economy?

-More than one-third of US workers (36%) currently participate in the gig economy, either through primary or secondary jobs
-More than half (52%) of global workers participating in the gig economy lost their jobs because of COVID-19
-More than 90% of US workers said they would consider freelancing or independent contracting work—and a lot of times this in addition to their full-time job
-The gig workforce is growing 3x faster than the traditional workforce

Source: Foundly.com

Demand drives opportunities—and vulnerabilities

When it comes to the risks that gig hiring can present, there is a great cautionary tale from just a few years ago. “Bob” was a programmer who was outsourcing his coding to China—pulling down a six-figure income while paying about one-fifth of that to Chinese gig workers. Bob spent his days shopping on eBay and watching cat videos while taking credit for top-quality code and high productivity—until his scam was discovered. They found out that he had also sent his security token to the gig workers to circumvent his company’s two-factor authentication! The details make for a memorable story—but the security and intellectual property (IP) implications of this very situation could be quite damaging for the company deploying that code.

Business digitalization is driving the demand for gig workers. Companies are moving faster than ever. The adoption of cloud technologies allows them to be increasingly versatile and agile. And that means that the attack surface is also changing. The gig worker part of digitalization means that the nature of the insider threat has also evolved. 

Insider threats have always been an issue in the security industry. Some of the biggest cases of data loss and fraud that I’ve come across in my career come from insiders because they know the company’s controls and processes and can find ways around them, easily avoiding detection. But the potential risks associated with gig workers are unique from those of common insiders—making threats even harder to detect and defend against.

A new flavor of insider threat

The rapid churn of many gig projects means that background checks are often overlooked. Because the jobs are short-term, workers are also often not required to have the same security safeguards in place that companies would expect of a contract worker—such as using encrypted hard drives, antivirus protection, and/or secure document repositories.

Gig workers typically use their own computers for jobs, storing sensitive research and proprietary information on a local drive or in a personal cloud account. But what happens to all that information once the job is over? Does it get deleted or is stored and vulnerable to theft? Does it get shared or reused with a competitor? How would the hiring company ever know?

Let’s say you gig-hire an application programmer to write a parsing routine for your company. It takes the gig programmer three months to write it and it costs $100,000 in labor and process fees. After the job is over, that same programmer gets hired by your main competitor—and they just so happen to also need a parsing routine written. Do you think that the gig worker is going to sit down and re-write that entire parsing routine from the beginning? 

They’re probably going to pull out what they’ve already written and just make a few modifications to fit into the competitor’s system. So your competitor saves $80,000 because the gig worker was in a position to reuse your IP without any interference or consequence. Coders tend to feel that if they write a piece of code, then they own it as part of their toolbox. And when that coder is a gig worker, they bring that toolbox from job to job—even to competitors who didn’t put in the R&D cycles to facilitate that code’s development.

Programming is just one area where this threat might arise. Companies also often hire gig workers as market analysts and researchers, sales account managers, IT database analysts, and litigation support the same kinds of risks apply. Pricing data, market analysis, legal research—all of this information has the potential to be reused by another entity via an enterprising gig worker trying to maximize his earnings and minimize the work he has to do. 

Part of the problem is that our sense of what’s valuable may be behind the times. People often think about a company’s “crown jewels” from the perspective of an outsider breaking in to take valuable data. But in the context of an insider threat, the crown jewels will be different. And so we have to start thinking about everything that’s valuable to the organization today and how it can be exploited. 

It’s not just temporary hires that carry gig economy risks. Full-time employees may also be moonlighting as gig workers on the side for additional income. With a majority of workers now doing their jobs remotely, there’s no one looking over their shoulder to see if they’re working on something on the side or pulling in code from a previous job. 
All told, the level of insider risk has escalated since the start of COVID—and much of that can be traced to the gig economy boom. Most of today’s remote employees do not expect to return to the workplace anytime soon. Without advanced controls in place to detect and protect against misuse of sensitive information, nothing is stopping an employee from re-using proprietary data for the benefit of another company and their own personal gain.

Risk assessment: detect, protect, and respond

With the potential threats that gig workers might pose more clearly defined, it’s now critical to take the next step of calculating the actual risks they present to a business. 

  1. What’s the likelihood of a vulnerability or threat in your company? 
  2. What data does your company actually have at risk in this situation?
  3. And what would be the impact on the company if that data were exploited?

The results of that risk assessment in hand can then inform a protection plan. First, there will be a need for administrative controls. The organization needs policies in place—clear direction from the executive team regarding the appropriate use of both gig and remote workers. Outline the situations where it is acceptable to hire a freelancer and what limitations should be placed to manage these sorts of temporary vendors. With defined policies, the business can then issue contracts to gig workers that clearly illustrate the legal requirements of the job—such as confidentiality via a nondisclosure agreement (NDA), security requirements, restrictions on outsourcing, and indemnification.

Process controls may include new-hire training for gig workers in order to educate them on your company policies and expectations. Internally, business leaders also need to be trained on the risks associated when hiring gig workers. There should also be safeguards in place to prevent bypassing of vendor management—which usually means involving the accounts payable department to ensure that only trained and vetted gig vendors can get paid.

The security technologies that address gig worker risks are a combination of remote worker controls, contractor controls, and Zero Trust Network Access (ZTNA) controls. This may include the use of a virtual private network (VPN), requiring two-factor authentication for access to company applications, and tightening data/file access rules for this type of worker. The core principle of Zero Trust is especially key here, as gig workers exist outside of your traditional security perimeter and you can’t inherently trust the authentication, device, network, or applications they’re using. Next-generation VPN capabilities can provide direct application access so that the gig worker can only access the application they need to do their job and nothing else within the company. Similarly, a Zero Trust architecture can help organizations to create an adaptive trust model that is more agile and can change based on the circumstances of each worker.

The gig economy is here to stay

The gig workforce is growing because of the overwhelming value that it can offer to both businesses and individuals. Organizations should lean in and embrace this global shift. At the end of the day, a gig worker should be treated as another form of contractor. The same rules should apply in terms of contracting, endpoint security controls, cloud monitoring (behavior patterns with regard to system/data access and movement of files), and having a system in place for rapid background checks.

Start by assessing the risk you have in your environment. Then create a roadmap of monitoring and controls. Organizations today need contextual controls that follow data and users. Granular access controls reduce the surface area at risk. This should include:

  • Identity controls that provide strong access authentication and behavioral analytics that cover both user- and device-based risks.
  • Application controls that include adaptive access and activity controls.
  • Data controls with automated discovery and classification, single-pass policy enforcement, as well as data loss prevention (DLP).

If you’re interested in hearing more of my thoughts on securing the gig economy, come to my session at RSA!

author image
James Christiansen
James Christiansen is Netskope’s vice president of cloud security transformation and leader of the Global Chief Strategy Office. He is focused on enhancing Netskope’s global clients understand the challenges and solutions of cloud deployments by helping drive thought leadership in cloud security transformation.

Stay informed!

Subscribe for the latest from the Netskope Blog