As workforces continue to evolve and adapt to the Covid-19 pandemic, the door is open for organizations to hire workers from anywhere around the country to offer their skills remotely as needed, often as a freelancer or gig worker. While this outgrowth of the burgeoning gig economy stands to benefit many businesses in need, it’s important that you assess your risk of utilizing gig workers and freelancers.
The “gig economy” refers to the trend of workers becoming independent contractors who freelance who use their skills to work for different companies at one time. The growth in online platforms and the acceptance of corporate remote workers makes it easier than ever to work for multiple companies at the same time. The gig economy represents a big change in the way we think about and manage remote workers. Research by the University of Hertfordshire showed that 10 percent of working-age adults worked though gig economy platforms such as Uber, Deliveroo or Upwork at least once a week in 2019. This compared to just 5 percent in 2016. It also found one in seven (15 percent) respondents said they had undertaken gig economy work at some point. This would be equivalent to nearly 7.5 million people if extrapolated across the economy.
The entire world is wondering what the “New Normal” will look like, but most agree that we won’t see 100 percent of staff return to the office environment. Given the acceleration of remote workers and the growth of the gig economy demands a change in your data protection strategy.
Think about Uber, which uses algorithms to match gig workers with riders. Uber created an entirely new industry sector using gig “freelancers” to comprise the workforce. These independent contractors (currently under dispute in California) set their own schedules and use the Uber platform to connect with riders. This caused a fundamental shift in workers from full-time taxi drivers to an army of part-time Uber and Lyft drivers.
Changing concerns about access and control
How does the gig economy differ from the contractors we have today? From an access and controls perspective, there may not initially seem like a lot of difference. Or is there?
In the past, we have hired contractors from a contracting firm where we vet the firm and require background checks on the contractors. Unlike regular vendors or contractors, who we require to have endpoint security controls in place such as endpoint detection and response (EDR), encrypted hard-drives, patch management, strong passwords, and use encrypted tunnels to access our systems, the new gig economy workers often do not have these controls on their systems. This is because they’re using their own personal device to work for multiple companies, which don’t adhere to any of the security requirements and cause headaches for security teams.
In the gig economy, workers have flexibility with their schedule and workload, and organizations can benefit from the expertise of skilled workers in our fast-paced business digitalization environment. However, there are several unique security concerns and challenges to consider, such as: How much access do freelancers have to sensitive information? Are they accessing necessary data securely? How do security teams monitor threats for workers that may also be working for their competitor?
Freelancers are likely working with many different companies at one time. With each of these companies and projects they may store sensitive information on their systems. If they are a specialist that you hire, they can reuse research, programming ideas, marketing concepts, etc., for another company, maybe even your competitor. This trend of utilizing gig economy workers is on the rise, and the pandemic has only accelerated things.
Freelancing on company time
In another twist it’s possible your full-time employees may be participating in the gig economy as well. As you combine the gig economy workforce with the growing remote workforce, a new threat vector emerges. When staff members are working in a traditional office there is a natural barrier to working on other company projects during the day. The LAN network security controls will limit their ability to access an external company’s systems. In open concept offices having a conversation with another employer is difficult. But if they are working from home then how do you know whether they are working for other organizations or possibly even your competitor? Back to my earlier example, Uber drivers frequently also drive for Lyft too, direct competitors.
The growth of the gig economy where freelancing has become the norm begs the question, how will companies understand what their staff is working on at home? A true contractor will work from a BYOD device and the appropriate controls will be put around their access and abilities to access sensitive data. But what about the full-time employee that decides to make some extra money at home by doing freelance work? How do you detect that an employee is now spending a large percentage of their time working on another company’s projects?
The gig economy represents a new threat to the systems that are running in the remote work environment. How can you ensure that company secrets or intellectual property are not accidentally or purposefully being used to enhance other company’s products and services?
Securing your information in the gig economy
There isn’t a perfect strategy but certainly some essential capabilities to manage the security for the gig economy workers is Zero Trust Network Access (ZTNA) and active inline cloud monitoring and data protection. With ZTNA you can manage the access to key resources and adjust privileges based on behavior, device, location, and sensitivity of the data. With inline real time cloud monitoring and user behavior analytics it is possible to detect changes in usage and prevent movement of sensitive data. Implementing a cloud access service broker (CASB) solution with advanced data leakage prevention (DLP) will provide the required visibility and protection of your sensitive data.
It is time to revamp your insider threat program. Expect that you will have freelance gig workers on your sensitive projects with access to your sensitive data and they will be doing work for your competitor. Change the way your gig workers access and manipulate data by limiting access to your cloud collaboration systems. Establish tightly bound controls around your sensitive information. Restrict editing, creating, and copying within the corporate approved cloud collaboration system. Do not allow downloading.
I’m interested to hear ideas on how to detect a freelancer that may be using your sensitive information on other company projects, and how to protect your sensitive data for this unique type of user.
Neil Thacker, CISO EMEA and LATAM, Netskope
