Instant messaging has become the lifeblood of teamwork in any modern organization, gaining momentum as a convenient tool to exchange information and files on-the-go. While this aligns with today’s fast-paced business activity, prioritizing convenience over security potentially has become a recipe for disaster.
Today, we must acknowledge that employees will use mainstream free instant messengers such as WhatsApp, Signal, or Telegram for work. With this trend on the rise, many companies face a dilemma where they can neither completely exclude such apps from employees in one fell swoop nor integrate them seamlessly into the organizational IT ecosystems.
Turning a blind eye to this creates security a gap, as none of these consumer-grade tools fits the corporate context in terms of policy compliance and compatibility with enterprise protection products. Furthermore, a lack of centralized update and patch management mechanisms translates into more opportunities for threat actors to exploit critical vulnerabilities in older messenger versions and obtain proprietary business data.
The human piece of the puzzle
Messengers tailored for personal use don’t get along with administrative supervision. As a result, there are hardly any controls in place for companies to reduce human error, a catalyst for cyberattacks through business email compromise (BEC), phishing, and smishing scams.
The February 2023 Reddit data leak, in which phishers obtained an employee’s credentials and stole 80 gigabytes worth of files, demonstrated how detrimental a single click on the wrong link can get.
Likewise, it’s much harder to identify insider threats in a communication environment where IT teams have lax control of sensitive documents and corporate secrets leaving the organization. Pair that with the fact that only four in 10 employees report their colleagues’ unethical behavior they witnessed, and the pendulum swings towards the shady area.
Whether data loss occurs accidentally or intentionally, the repercussions range from industrial espionage and extortion – to regulatory penalties and reputational damage. Therefore, it’s crucial to use the right messaging tools designed with a security-first approach in mind and compliant with data handling and storage regulations such as HIPAA and GDPR.
How to minimize organizational risks
Enforcing the use of an enterprise-grade messaging service across a company’s environment represents a major leap forward in terms of security. However, several criteria define to which extent this shift will harden the company’s resilience in the face of evolving cyberattacks and insider threats. Here are seven important features:
- Local installation. Start by deploying messaging platforms on-premises. This keeps correspondence and files within the organization’s control and prevents them from leaving the secure perimeter.
- Enterprise-class data protection. Make sure the tool comes equipped with advanced security features, such as containerization, role-based policies, end-to-end encryption, and push authentication.
- Cryptocontainer features. Cryptocontainers let administrators remotely restrict actions such as saving data, transferring it to other applications, copying it to the clipboard, or taking screenshots or recordings. It’s an effective barrier for potential leaks caused by internal attackers.
- Integration with corporate information security systems. Corporate messengers should integrate seamlessly with the organization’s existing security products, including antivirus software for file screening, data loss prevention (DLP), and security information and event management (SIEM).
- Archive and retention policies. It’s important to develop and enforce these policies in line with regulatory requirements. This ensures that the company logs the necessary records for future reference while reducing the risk of holding onto messaging-related data longer than necessary, which could pose compliance issues.
- Certification and security audits. Ensure the platform conforms to essential data protection standards and is subject to periodic security audits that test its susceptibility to emerging attack vectors.
- Employee training and awareness. Maintain comprehensive training programs that educate staff about the risks associated with instant messaging and emphasize the importance of secure authentication practices. Make sure the security teams know how to identify phishing attempts, how to report suspicious activity, and how to coordinate steps in the event of a cyber incident.
At the end of the day, a messaging platform – no matter how intrinsically reliable – isn’t a “set it and forget it” type of product. To enhance the security and efficiency of team collaboration rather than being another vulnerability, companies must back it with employee vigilance and interoperate smoothly with the enterprise data protection mechanisms already in place.
David Balaban, owner, Privacy-PC
