Secure Your Business Communications

Matthieu Destot
July 13, 2018

Tips for Selecting a Collaboration Tool with Security in Mind.

Today’s enterprises are adopting a variety of digital collaboration tools to drive employee productivity, deliver cost-effective mobility, and improve communication among distributed teams. Using these tools, employees can easily connect with colleagues, partners, and suppliers regardless of their location, sharing their work in simple and efficient ways through online collaborative workspaces.

But while there’s no disputing their benefits, these collaboration and communications tools are introducing a multitude of new security risks to the enterprise.
Collaboration tools are vulnerable to security threats

As employees exchange information, have private conversations, and transfer files and documents to and from the cloud, collaboration platforms are providing yet another way for cybercriminals to harass, exploit, and eavesdrop on organizations, as well as leak sensitive or proprietary information.

Too often, these risks are not fully understood, accepted, or given proper attention by today’s enterprises. And when that’s the case, tools that can hold so much promise can end up becoming dangerous and costly instead.

Woman monitoring computer for blog post

A number of factors make enterprise collaboration apps vulnerable targets for malicious intent. First, these tools are increasingly moving to cloud platforms as enterprises seek ways to expand their accessibility and availability, as well as drive down costs. While this approach offers many benefits, putting services and applications into the public cloud does introduce new security concerns. There are also issues surrounding the behavior of employees using these applications, many of whom are carrying a myriad of personal devices or inadvertently engaging in activities that might be risky. This can include intentional or unintentional leaks of intellectual property or data theft, or setting weak/easy-to-guess passwords.

Recent research from Trend Micro found that some chat platforms were at risk of being hacked and used as command and control (C&C) infrastructure for malware. The report states that the API functionality on popular chat platforms like Discord, Slack, and Telegram can be successfully abused, effectively turning these apps into C&C servers that cybercriminals can use to make contact with infected or compromised systems. Unfortunately, this is just one of many examples of legitimate services and applications being exploited to facilitate cybercriminal efforts.

Even with these risks, the undeniable productivity gains offered by these tools mean they are here to stay. So, what can today’s enterprises do to protect their users and maintain the confidentiality, integrity, and availability of their data?

Invest in an enterprise-grade tool
While there are many collaboration and communications apps to choose from today, beware of using tools that are meant for personal usage in the enterprise. Organizations are quickly realizing the data privacy risks involved with these platforms, with some even opting to ban consumer-grade messaging apps from company-issued devices in an effort to better protect user data. To survive in this ever-expanding threat landscape, businesses require enhanced security features and controls that are typically only available in enterprise-grade tools, including firewalls, encryption of data in transit with TLS, and distributed denial of service (DDoS) mitigation technologies.

Ensure the infrastructure is properly protected
It’s critical for enterprises to carefully select a platform where the underlying infrastructure has been designed with security in mind. This means proper protections are in place for the hardware, software, and networking equipment, as well as the physical security of the data center facilities that operate the services. Ask your service provider if their infrastructure is designed and managed in accordance with cloud security standards and controls, such as OWASP. Make sure the data center facilities are properly monitored and protected as well; access should be monitored 24/7, activity of authorized staff should be tracked, and fire detection and extinction systems should be in place to prevent data leaks or loss.

Maintain control over application level security
While the service provider should guarantee the privacy and security of the underlying infrastructure and services, it’s important for businesses to make sure they can maintain some control over security at the application layer. This allows them to manage the security of their connectivity to the cloud, as well as user privacy rules, identities, and access control within the app itself. With many providers, this is known as a Shared Security Responsibility Model, which allows both the enterprise and the service provider to share the burden of security and take some initiative to protect each user.

Cyber security representational image for blog post

Multi-factor authentication (MFA) is a must
The best way to ensure that only authorized users or administrators access their accounts and associated resources is to make user authentication a multi-step process. This includes basic authentication (a user signing in with their email address/username and private password), as well as the use of signed web tokens for each API call. As a best practice, forgotten credentials should be reset, rather than recovered. And it’s critical to educate users to use a complex password, one that incorporates numbers, letters, and special characteristics and is very difficult to guess.

Arm yourself for the new threat landscape
Modern collaboration and communications platforms must be built to address the new threat landscape that today’s enterprises are facing. Alcatel-Lucent Rainbow™ is an enterprise-grade, highly secure Unified Communication-as-a-Service hybrid cloud solution that enables customers to interface with and deploy custom applications quickly and securely.

To learn more about how the enhanced security features of the Rainbow platform help to protect the confidentiality, integrity, and availability of enterprise data, please visit our Rainbow webpage. We also invite you to connect with us on Twitter at @ALUEnterprise or check us out on LinkedIn.

Matthieu Destot

Matthieu Destot

Executive Vice President, B&A Business Unit at Ingenico Group

Matthieu Destot is Executive Vice President, B&A Business Unit at Ingenico Group. He leads the transformation of the global leader of payment terminals into the most trusted global technology partner in the new world of payment acceptance.

Prior to this appointment, Matthieu was Chief Operating Officer as well as EVP, Global Sales & Marketing at Alcatel-Lucent Enterprise and drove the successful transformation of the ALE Communications Business Division to offer connected platforms. This set the stage to provide business users, and their business contacts, integrated and innovative cloud-based collaborative workplace solutions operated by ALE. With 20 years of experience at ALE, Matthieu held various positions in the sales leadership team, business divisions, and technology acquisitions across Europe, North America and Asia Pacific, and remains a member for the Board of Directors for ALE. 

Matthieu holds a Master of Science in Engineering from the Ecole Centrale Lille and is a graduate of the ESSEC business school in Paris.

About the author

Latest Blogs

a group of people working on a project

Cybersecurity: From A to Z on campus

Institutions need to adopt a ‘trust no one’ cybersecurity strategy that addresses all users, devices and applications.

Energy and utilities OT and IT convergence blog image
Energy & Utilities

Trend watch: OT-IT convergence in energy and utilities

Operational and Information technology convergence is changing how energy and utilities manage their business going forward.

A man working on a computer

Five steps to ZTNA cybersecurity on campus

Zero Trust Network Access (ZTNA) cybersecurity allows academic institutions to realise important benefits across all operations.

A group of young people

Education under siege

A rise in cyberattacks - particularly ransomware - is impacting academic institutions, putting educational goals at risk.