The Gig economy is a phenomenon that goes well beyond ride sharing and package delivery – it is redefining the enterprise workforce. This year, more companies have relied on non-employee workers than ever before. Estimates put the percentage of gig economy workers in the U.S. at 43% for 2020. This increased reliance on freelancers and third-party workers comes with new insider threat risks.
According to Deloitte, 87% of companies have experienced an incident with a third party that disrupted their operations. Why? Gig workers, contractors, service providers, and consultants often require remote access to sensitive corporate resources to do their work. Yet many companies don’t apply the same security principles to third parties as they do to internal employees. This increases exposure to organizations – particularly if proper controls are not put into place to protect from insider-led security breaches..
Here are three things you need to know about insider threats in the gig economy.
1. Most Insider Threats Are Accidental
Not every insider threat is malicious. According to Ponemon, 61% of insider threats are initiated by employee or contractor mistakes. However, gig economy workers may not have visibility into the company’s security policies. Everyone at the company, including contract workers, should understand the cybersecurity policies that apply to their work.
Even so, restrictive cybersecurity policies aren’t the answer. Hybrid teams of employees and contractors need to access cloud-based solutions and other critical systems to do their jobs effectively. Too many restrictions can make people work around the rules, which can lead to even greater risks. Instead, security teams should focus on building a comprehensive insider threat management program (ITMP). But we’ll talk more about that later.
2. Insider Risk Varies by Role
Contract workers help companies add specialized talent without the overhead costs of salaries and benefits. The risks of these workers may vary depending on the department, as well as by responsibilities and level of access. For example, a contract database administrator has the keys to critical infrastructure that could result in a major security breach if credentials are misused. An expert consultant may have access to sensitive intellectual property or proprietary product plans. A design contractor for the marketing department, however, is considerably less risky.
Each department should understand the specific risks of the contract workforce. Security teams should be extra vigilant of third parties with privileged access. In addition, all workers should be aware of and follow security best practices specific to their role. For example, the database administrator referenced above might use rotating credentials to reduce the risk of an accidental compromise.
3. Visibility into People and Data is Key
As referenced above, a comprehensive ITMP should cover people, processes and technology. Many of the people and process recommendations above can proactively protect organizations from risk. From a technology perspective, organizations need visibility into both third-party user and data activity. This approach helps security teams:
- Understand the context around a user’s motives
- See where the data is moving and why
- Distill valid signals from noise within security alerts.
Learn More About Mitigating Insider Risk
A modern workforce requires a modern approach to managing insider risk. Our latest eBook gives deeper insight into insider risks by department, and how to mitigate them with better visibility. In addition, teams can learn from several recent third-party contractor incidents in the news.
Want to learn more about managing insider threats in the gig economy?
Subscribe to the Proofpoint Blog