Gig Workers are the Most Dangerous Insider Threat We Aren’t Talking About

The term “gig economy” refers to the increasingly common use of skilled freelance or otherwise independent workers on a short-term basis—often one project at a time. The availability of these sorts of gig workers has brought massive change to global work culture over the last few years. 

Uber and Lyft drivers are prime examples. There’s no set schedule; the work is done on a ride-by-ride (gig-by-gig) basis. In the early days of the rideshare business, you were either getting into an Uber vehicle or a Lyft vehicle. But today, drivers often drive for both companies simultaneously. This is a very common aspect of the gig world—workers are often engaged by direct competitors at the same time. The ubiquitous availability of remote skillsets allows labor to be spun up or spun down as needed and workers can be hired from virtually anywhere. 

In the past, an employee worked for a single company at a time—and maybe even at a single company for their entire career. There was a great deal of loyalty and longevity. But today,  a contractor or a full-time employee may only stay at a company for 18 months before they move on to other opportunities. Or, even less time than that. According to a 2021 study from IBM’s Institute for Business Value, one in four workers plans to switch jobs this year, an increased pace vs. even a year ago, which was one in five. Of last year’s job switchers, more than half identified as millennial or Gen Z.

Within the technology industry in particular, however, short-term workers present some acute risks to employers—some of which are quite serious. While the business advantages might be clear, high degrees of temporality and transience make the gig economy a huge bomb for security. But no one seems to hear it ticking yet.

Demand drives opportunities—and vulnerabilities

When it comes to the risks that gig hiring can present, there is a great cautionary tale from just a few years ago. “Bob” was a programmer who was outsourcing his coding to China—pulling down a six-figure income while paying about one-fifth of that to Chinese gig workers. Bob spent his days shopping on eBay and watching cat videos while taking credit for top-quality code and high productivity—until his scam was discovered. They found out that he had also sent his security token to the gig workers to circumvent his company’s two-factor authentication! The details make for a memorable story—but the security and intellectual property (IP) implications of this very situation could be quite damaging for the company deploying that code.

Business digitalization is driving the demand for gig workers. Companies are moving faster than ever. The adoption of cloud technologies allows them to be increasingly versatile and agile. And that means that the attack surface is also changing. The gig worker part of digitalization means that the nature of the insider threat has also evolved. 

Insider threats have always been an issue in the security industry. Some of the biggest cases of data loss and fraud that I’ve come across in my career come from insiders because they know the company’s controls and processes and can find ways around them, easily avoiding detection. But the potential risks associated with gig workers are unique from those of common insiders—making threats even harder to detect and defend against.

A new flavor of insider threat

The rapid churn of many gig projects means that background checks are often overlooked. Because the jobs are short-term, workers are also often not required to have the same security safeguards in place that companies would expect of a contract worker—such as using encrypted hard drives, antivirus protection, and/or secure document repositories.

Gig workers typically use their own computers for jobs, storing sensitive research and proprietary information on a local drive or in a personal cloud account. But what happens to all that information once the job is over? Does it get deleted or is stored and vulnerable to theft? Does it get shared or reused with a competitor? How would the hiring company ever know?

Let’s say you gig-hire an application programmer to write a parsing routine for your company. It takes the gig programmer three months to write it and it costs $100,000 in labor and process fees. After the job is over, that same programmer gets hired by your main competitor—and they just so happen to also need a parsing routine written. Do you think that the gig worker is going to sit down and re-write that entire parsing routine from the beginning? 

They’re probably going to pull out what they’ve already written and just make a few modifications to fit into the competitor’s system. So your competitor saves $80,000 because the gig worker was in a position to reuse your IP without any interference or consequence. Coders tend to feel that if they write a piece of code, then they own it as part of their toolbox. And when that coder is a gig worker, they bring that toolbox from job to job—even to competitors who didn’t put in the R&D cycles to facilitate that code’s development.

Programming is just one area where this threat might arise. Companies also often hire gig workers as market analysts and researchers, sales account managers, IT database analysts, and litigation support the same kinds of risks apply. Pricing data, market analysis, legal research—all of this information has the potential to be reused by another entity via an enterprising gig worker trying to maximize his earnings and minimize the work he has to do. 

Part of the problem is that our sense of what’s valuable may be behind the times. People often think about a company’s “crown jewels” from the perspective of an outsider breaking in to take valuable data. But in the context of an insider threat, the crown jewels will be different. And so we have to start thinking about everything that’s valuable to the organization today and how it can be exploited. 

It’s not just temporary hires that carry gig economy risks. Full-time employees may also be moonlighting as gig workers on the side for additional income. With a majority of workers now doing their jobs remotely, there’s no one looking over their shoulder to see if they’re working on something on the side or pulling in code from a previous job. 
All told, the level of insider risk has escalated since the start of COVID—and much of that can be traced to the gig economy boom. Most of today’s remote employees do not expect to return to the workplace anytime soon. Without advanced controls in place to detect and protect against misuse of sensitive information, nothing is stopping an employee from re-using proprietary data for the benefit of another company and their own personal gain.

Risk assessment: detect, protect, and respond

With the potential threats that gig workers might pose more clearly defined, it’s now critical to take the next step of calculating the actual risks they present to a business. 

1. What’s the likelihood of a vulnerability or threat in your company? 
2. What data does your company actually have at risk in this situation?
3. And what would be the impact on the company if that data were exploited?

The results of that risk assessment in hand can then inform a protection plan. First, there will be a need for administrative controls. The organization needs policies in place—clear direction from the executive team regarding the appropriate use of both gig and remote workers. Outline the situations where it is acceptable to hire a freelancer and what limitations should be placed to manage these sorts of temporary vendors. With defined policies, the business can then issue contracts to gig workers that clearly illustrate the legal requirements of the job—such as confidentiality via a nondisclosure agreement (NDA), security requirements, restrictions on outsourcing, and indemnification.

Process controls may include new-hire training for gig workers in order to educate them on your company policies and expectations. Internally, business leaders also need to be trained on the risks associated when hiring gig workers. There should also be safeguards in place to prevent bypassing of vendor management—which usually means involving the accounts payable department to ensure that only trained and vetted gig vendors can get paid.

The security technologies that address gig worker risks are a combination of remote worker controls, contractor controls, and Zero Trust Network Access (ZTNA) controls. This may include the use of a virtual private network (VPN), requiring two-factor authentication for access to company applications, and tightening data/file access rules for this type of worker. The core principle of Zero Trust is especially key here, as gig workers exist outside of your traditional security perimeter and you can’t inherently trust the authentication, device, network, or applications they’re using. Next-generation VPN capabilities can provide direct application access so that the gig worker can only access the application they need to do their job and nothing else within the company. Similarly, a Zero Trust architecture can help organizations to create an adaptive trust model that is more agile and can change based on the circumstances of each worker.

The gig economy is here to stay

The gig workforce is growing because of the overwhelming value that it can offer to both businesses and individuals. Organizations should lean in and embrace this global shift. At the end of the day, a gig worker should be treated as another form of contractor. The same rules should apply in terms of contracting, endpoint security controls, cloud monitoring (behavior patterns with regard to system/data access and movement of files), and having a system in place for rapid background checks.

Start by assessing the risk you have in your environment. Then create a roadmap of monitoring and controls. Organizations today need contextual controls that follow data and users. Granular access controls reduce the surface area at risk. This should include:

• Identity controls that provide strong access authentication and behavioral analytics that cover both user- and device-based risks.
• Application controls that include adaptive access and activity controls.
• Data controls with automated discovery and classification, single-pass policy enforcement, as well as data loss prevention (DLP).

If you’re interested in hearing more of my thoughts on securing the gig economy, come to my session at RSA!