O futuro do Zero Trust e do SASE é agora! Assista sob demanda

fechar
fechar
  • Por que Netskope chevron

    Mudando a forma como a rede e a segurança trabalham juntas.

  • Nossos clientes chevron

    A Netskope atende a mais de 3.000 clientes em todo o mundo, incluindo mais de 25 das empresas da Fortune 100

  • Nossos parceiros chevron

    Fazemos parceria com líderes de segurança para ajudá-lo a proteger sua jornada para a nuvem.

O mais alto nível de Execução. A Visão mais avançada.

A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.

Obtenha o Relatório
A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.
Ajudamos nossos clientes a estarem prontos para tudo

See our customers
Woman smiling with glasses looking out window
A estratégia de comercialização da Netskope, focada em Parcerias, permite que nossos Parceiros maximizem seu crescimento e lucratividade enquanto transformam a segurança corporativa.

Saiba mais sobre os parceiros da Netskope
Group of diverse young professionals smiling
Sua Rede do Amanhã

Planeje seu caminho rumo a uma rede mais rápida, segura e resiliente projetada para os aplicativos e usuários aos quais você oferece suporte.

Receba o whitepaper
Sua Rede do Amanhã
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Saiba mais sobre o Netskope One
Abstract with blue lighting
Adote uma arquitetura Secure Access Service Edge (SASE)

O Netskope NewEdge é a maior nuvem privada de segurança de alto desempenho do mundo e oferece aos clientes cobertura de serviço, desempenho e resiliência inigualáveis.

Conheça a NewEdge
NewEdge
Netskope Cloud Exchange

O Cloud Exchange (CE) da Netskope oferece aos clientes ferramentas de integração poderosas para tirar proveito dos investimentos em estratégias de segurança.

Saiba mais sobre o Cloud Exchange
Vídeo da Netskope
A plataforma do futuro é a Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) e Private Access for ZTNA integrados nativamente em uma única solução para ajudar todas as empresas em sua jornada para o Secure Access Service Arquitetura de borda (SASE).

Vá para a plataforma
Vídeo da Netskope
Next Gen SASE Branch é híbrida — conectada, segura e automatizada

Netskope Next Gen SASE Branch converge o Context-Aware SASE Fabric, Zero-Trust Hybrid Security e SkopeAI-Powered Cloud Orchestrator em uma oferta de nuvem unificada, inaugurando uma experiência de filial totalmente modernizada para empresas sem fronteiras.

Saiba mais sobre Next Gen SASE Branch
Pessoas no escritório de espaço aberto
Desenvolvendo uma Arquitetura SASE para Leigos

Obtenha sua cópia gratuita do único guia de planejamento SASE que você realmente precisará.

Baixe o eBook
Mude para serviços de segurança na nuvem líderes de mercado com latência mínima e alta confiabilidade.

Conheça a NewEdge
Lighted highway through mountainside switchbacks
Permita com segurança o uso de aplicativos generativos de IA com controle de acesso a aplicativos, treinamento de usuários em tempo real e a melhor proteção de dados da categoria.

Saiba como protegemos o uso de IA generativa
Ative com segurança o ChatGPT e a IA generativa
Soluções de zero trust para a implementação de SSE e SASE

Conheça o Zero Trust
Boat driving through open sea
Netskope obtém alta autorização do FedRAMP

Escolha o Netskope GovCloud para acelerar a transformação de sua agência.

Saiba mais sobre o Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Saiba mais sobre como a Netskope pode ajudá-lo a proteger sua jornada para a nuvem.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE)

  • Events and Workshops chevron

    Esteja atualizado sobre as últimas tendências de segurança e conecte-se com seus pares.

  • Security Defined chevron

    Tudo o que você precisa saber em nossa enciclopédia de segurança cibernética.

Podcast Security Visionaries

Eleições, desinformação e segurança
Este episódio analisa os aspectos da segurança eleitoral relacionados ao registro de eleitores e aos controles físicos nos locais de votação.

Reproduzir o podcast
Blog: Eleições, desinformação e segurança
Últimos blogs

Read how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Leia o Blog
Sunrise and cloudy sky
SASE Week 2023: Sua jornada SASE começa agora!

Replay das sessões da quarta SASE Week anual.

Explorar sessões
SASE Week 2023
O que é o Security Service Edge?

Explore o lado de segurança de SASE, o futuro da rede e proteção na nuvem.

Saiba mais sobre o Security Service Edge
Four-way roundabout
  • Empresa chevron

    Ajudamos você a antecipar os desafios da nuvem, dos dados e da segurança da rede.

  • Liderança chevron

    Nossa equipe de liderança está fortemente comprometida em fazer tudo o que for preciso para tornar nossos clientes bem-sucedidos.

  • Customer Solutions chevron

    Estamos aqui junto com você a cada passo da sua trajetória, assegurando seu sucesso com a Netskope.

  • Treinamento e certificação chevron

    Os treinamentos da Netskope vão ajudar você a ser um especialista em segurança na nuvem.

Apoiando a sustentabilidade por meio da segurança de dados

A Netskope tem o orgulho de participar da Visão 2045: uma iniciativa destinada a aumentar a conscientização sobre o papel da indústria privada na sustentabilidade.

Saiba mais
Apoiando a sustentabilidade por meio da segurança de dados
Pensadores, construtores, sonhadores, inovadores. Juntos, fornecemos soluções de segurança na nuvem de última geração para ajudar nossos clientes a proteger seus dados e seu pessoal.

Conheça nossa equipe
Group of hikers scaling a snowy mountain
A talentosa e experiente equipe de Serviços Profissionais da Netskope fornece uma abordagem prescritiva para sua implementação bem sucedida.

Conheça os Serviços Profissionais
Netskope Professional Services
Proteja sua jornada de transformação digital e aproveite ao máximo seus aplicativos de nuvem, web e privados com o treinamento da Netskope.

Saiba mais sobre Treinamentos e Certificações
Group of young professionals working

Gig Workers are the Most Dangerous Insider Threat We Aren’t Talking About

May 13 2021

The term “gig economy” refers to the increasingly common use of skilled freelance or otherwise independent workers on a short-term basis—often one project at a time. The availability of these sorts of gig workers has brought massive change to global work culture over the last few years. 

Uber and Lyft drivers are prime examples. There’s no set schedule; the work is done on a ride-by-ride (gig-by-gig) basis. In the early days of the rideshare business, you were either getting into an Uber vehicle or a Lyft vehicle. But today, drivers often drive for both companies simultaneously. This is a very common aspect of the gig world—workers are often engaged by direct competitors at the same time. The ubiquitous availability of remote skillsets allows labor to be spun up or spun down as needed and workers can be hired from virtually anywhere. 

In the past, an employee worked for a single company at a time—and maybe even at a single company for their entire career. There was a great deal of loyalty and longevity. But today,  a contractor or a full-time employee may only stay at a company for 18 months before they move on to other opportunities. Or, even less time than that. According to a 2021 study from IBM’s Institute for Business Value, one in four workers plans to switch jobs this year, an increased pace vs. even a year ago, which was one in five. Of last year’s job switchers, more than half identified as millennial or Gen Z.

Within the technology industry in particular, however, short-term workers present some acute risks to employers—some of which are quite serious. While the business advantages might be clear, high degrees of temporality and transience make the gig economy a huge bomb for security. But no one seems to hear it ticking yet.

How big is the gig economy?

-More than one-third of US workers (36%) currently participate in the gig economy, either through primary or secondary jobs
-More than half (52%) of global workers participating in the gig economy lost their jobs because of COVID-19
-More than 90% of US workers said they would consider freelancing or independent contracting work—and a lot of times this in addition to their full-time job
-The gig workforce is growing 3x faster than the traditional workforce

Source: Foundly.com

Demand drives opportunities—and vulnerabilities

When it comes to the risks that gig hiring can present, there is a great cautionary tale from just a few years ago. “Bob” was a programmer who was outsourcing his coding to China—pulling down a six-figure income while paying about one-fifth of that to Chinese gig workers. Bob spent his days shopping on eBay and watching cat videos while taking credit for top-quality code and high productivity—until his scam was discovered. They found out that he had also sent his security token to the gig workers to circumvent his company’s two-factor authentication! The details make for a memorable story—but the security and intellectual property (IP) implications of this very situation could be quite damaging for the company deploying that code.

Business digitalization is driving the demand for gig workers. Companies are moving faster than ever. The adoption of cloud technologies allows them to be increasingly versatile and agile. And that means that the attack surface is also changing. The gig worker part of digitalization means that the nature of the insider threat has also evolved. 

Insider threats have always been an issue in the security industry. Some of the biggest cases of data loss and fraud that I’ve come across in my career come from insiders because they know the company’s controls and processes and can find ways around them, easily avoiding detection. But the potential risks associated with gig workers are unique from those of common insiders—making threats even harder to detect and defend against.

A new flavor of insider threat

The rapid churn of many gig projects means that background checks are often overlooked. Because the jobs are short-term, workers are also often not required to have the same security safeguards in place that companies would expect of a contract worker—such as using encrypted hard drives, antivirus protection, and/or secure document repositories.

Gig workers typically use their own computers for jobs, storing sensitive research and proprietary information on a local drive or in a personal cloud account. But what happens to all that information once the job is over? Does it get deleted or is stored and vulnerable to theft? Does it get shared or reused with a competitor? How would the hiring company ever know?

Let’s say you gig-hire an application programmer to write a parsing routine for your company. It takes the gig programmer three months to write it and it costs $100,000 in labor and process fees. After the job is over, that same programmer gets hired by your main competitor—and they just so happen to also need a parsing routine written. Do you think that the gig worker is going to sit down and re-write that entire parsing routine from the beginning? 

They’re probably going to pull out what they’ve already written and just make a few modifications to fit into the competitor’s system. So your competitor saves $80,000 because the gig worker was in a position to reuse your IP without any interference or consequence. Coders tend to feel that if they write a piece of code, then they own it as part of their toolbox. And when that coder is a gig worker, they bring that toolbox from job to job—even to competitors who didn’t put in the R&D cycles to facilitate that code’s development.

Programming is just one area where this threat might arise. Companies also often hire gig workers as market analysts and researchers, sales account managers, IT database analysts, and litigation support the same kinds of risks apply. Pricing data, market analysis, legal research—all of this information has the potential to be reused by another entity via an enterprising gig worker trying to maximize his earnings and minimize the work he has to do. 

Part of the problem is that our sense of what’s valuable may be behind the times. People often think about a company’s “crown jewels” from the perspective of an outsider breaking in to take valuable data. But in the context of an insider threat, the crown jewels will be different. And so we have to start thinking about everything that’s valuable to the organization today and how it can be exploited. 

It’s not just temporary hires that carry gig economy risks. Full-time employees may also be moonlighting as gig workers on the side for additional income. With a majority of workers now doing their jobs remotely, there’s no one looking over their shoulder to see if they’re working on something on the side or pulling in code from a previous job. 
All told, the level of insider risk has escalated since the start of COVID—and much of that can be traced to the gig economy boom. Most of today’s remote employees do not expect to return to the workplace anytime soon. Without advanced controls in place to detect and protect against misuse of sensitive information, nothing is stopping an employee from re-using proprietary data for the benefit of another company and their own personal gain.

Risk assessment: detect, protect, and respond

With the potential threats that gig workers might pose more clearly defined, it’s now critical to take the next step of calculating the actual risks they present to a business. 

  1. What’s the likelihood of a vulnerability or threat in your company? 
  2. What data does your company actually have at risk in this situation?
  3. And what would be the impact on the company if that data were exploited?

The results of that risk assessment in hand can then inform a protection plan. First, there will be a need for administrative controls. The organization needs policies in place—clear direction from the executive team regarding the appropriate use of both gig and remote workers. Outline the situations where it is acceptable to hire a freelancer and what limitations should be placed to manage these sorts of temporary vendors. With defined policies, the business can then issue contracts to gig workers that clearly illustrate the legal requirements of the job—such as confidentiality via a nondisclosure agreement (NDA), security requirements, restrictions on outsourcing, and indemnification.

Process controls may include new-hire training for gig workers in order to educate them on your company policies and expectations. Internally, business leaders also need to be trained on the risks associated when hiring gig workers. There should also be safeguards in place to prevent bypassing of vendor management—which usually means involving the accounts payable department to ensure that only trained and vetted gig vendors can get paid.

The security technologies that address gig worker risks are a combination of remote worker controls, contractor controls, and Zero Trust Network Access (ZTNA) controls. This may include the use of a virtual private network (VPN), requiring two-factor authentication for access to company applications, and tightening data/file access rules for this type of worker. The core principle of Zero Trust is especially key here, as gig workers exist outside of your traditional security perimeter and you can’t inherently trust the authentication, device, network, or applications they’re using. Next-generation VPN capabilities can provide direct application access so that the gig worker can only access the application they need to do their job and nothing else within the company. Similarly, a Zero Trust architecture can help organizations to create an adaptive trust model that is more agile and can change based on the circumstances of each worker.

The gig economy is here to stay

The gig workforce is growing because of the overwhelming value that it can offer to both businesses and individuals. Organizations should lean in and embrace this global shift. At the end of the day, a gig worker should be treated as another form of contractor. The same rules should apply in terms of contracting, endpoint security controls, cloud monitoring (behavior patterns with regard to system/data access and movement of files), and having a system in place for rapid background checks.

Start by assessing the risk you have in your environment. Then create a roadmap of monitoring and controls. Organizations today need contextual controls that follow data and users. Granular access controls reduce the surface area at risk. This should include:

  • Identity controls that provide strong access authentication and behavioral analytics that cover both user- and device-based risks.
  • Application controls that include adaptive access and activity controls.
  • Data controls with automated discovery and classification, single-pass policy enforcement, as well as data loss prevention (DLP).

If you’re interested in hearing more of my thoughts on securing the gig economy, come to my session at RSA!

author image
James Christiansen
James Christiansen é vice-presidente de transformação de segurança na nuvem da Netskope e líder do Global Chief Strategy Office. Seu foco é melhorar a compreensão dos clientes globais da Netskope sobre os desafios e soluções de implantações em nuvem, ajudando a impulsionar a liderança de pensamento na transformação da segurança em nuvem.

Stay informed!

Subscribe for the latest from the Netskope Blog