Slack is going from strength to strength as a workplace application. In the hybrid world, it’s being hailed as the backbone of employee productivity – and for a good reason. It’s quick, fast and intuitive to use, enabling employees to communicate with each other instantaneously, without the formality or lag of emails.
However, while Slack is great for efficiency and collaboration, it can be a huge security threat. Here’s why:
Slack: the security risks
1. It’s popular – and that makes it a tempting target
Big companies make for lucrative targets for cybercriminals. In 2019, Slack warned investors that it is being targeted by “sophisticated organized crime, nation-state, and nation-state supported actors.” To add to this, just a few months ago, Cisco Talos released data analysis showing a significant increase in attacks on collaboration platforms, including Slack, since the onset of the pandemic.
If that wasn’t enough, we can’t forget that – back in 2015 – Slack was successfully breached:
While these risks are beyond your control, your company could still be impacted. As the Kaseya and SolarWinds data breaches show, supply chain attacks are increasingly common. If one of your collaboration tools is hacked, the threat actor could ‘island hop’ into your infrastructure. To combat this risk, you need to put in place policies and solutions for incident response and disaster recovery.
- The insider threat could run wild
Forrester’s Predictions estimate that the insider threat will cause 33% of data breaches this year. This kind of threat is nothing new: accidental insiders, disgruntled employees and compromised accounts have long been on the radar of security teams. However, in the new hybrid, cloud-based paradigm, this threat is harder to catch
Suppose you don’t have the right security tools in place. In that case, you won’t have visibility into suspicious logins (as was the case with the EA breach) or an employee uploading a questionable amount of sensitive files to Slack. Luckily, though, there are solutions available to help with. While Slack’s native security capabilities might leave gaps, solutions like Polymer’s DLP can provide the granular visibility and classification abilities you need to keep data safe.
- Shadow IT 2.0
Slack’s quick, easy sharing capabilities can quickly become a data security nightmare if you don’t have the right governance policies in place. Picture this: an employee could upload a sensitive file to Slack, then download it from their mobile-based Slack app onto their personal device – which could be illegal.
Put simply, if you haven’t got the proper compliance framework in place for managing SaaS sprawl, it’s likely that your collaboration tools are a source of data leakage, which could end up in a hefty compliance fine.
Regaining control of Slack
Despite the risks, we’re definitely not advocating that you get rid of Slack. It’s a beloved tool for a reason: productivity, efficiency, communication…
What IT teams need to do is deploy security solutions that complement and secure their employees’ workflow in these applications. This is where data loss prevention (DLP) becomes essential. A next-generation DLP solution will seamlessly integrate into collaboration tools like Slack, offering unparalleled protection that helps you meet compliance standards, reduce data leakage and prevent data theft.
Here’s how DLP for Slack can help you:
- Meet compliance standards
A robust DLP solution is the foundation of data governance. A next-gen DLP solution can act as a virtual compliance officer within your security team. For HIPAA, GDPR and state privacy regulations, you can enforce DLP policies that capture, redact and protect PPI and PHI as it travels through Slack and other collaboration tools.
A best-in-breed solutions also offer AI capabilities, allowing the solution to self-learn the more it is used. This prevents alert fatigue for the IT team, enabling them to be confident that their DLP solution enforces compliance without constant intervention.
- Prevent data breaches
A robust DLP solution is the foundation of data governance. Through data classification, you can inform your DLP solution what data must be protected at all costs. It can detect PII, PHI and trade secrets, preventing them from being unlawfully shared, transported or accessed by unauthorized parties. Moreover, because next-generation DLP works in-app, it doesn’t hinder employee productivity or disrupt the workflow. This means that employees can continue to collaborate as normal.
- Real-time threat detection
Moving beyond data, next-generation DLP solutions are also contextually-aware. This means that they can protect against insider threats by spotting and responding to suspicious activity in real-time. For example, suppose a user attempts to download a folder of trade secrets from Slack. In that case, the DLP solution will block the action and alert the IT team at the same time so they can review it in more detail. Rather than being on the back foot and responding to breaches when it’s too late, your team can become proactive security guardians.
- Nudge employees towards better decisions
Best-in-breed DLP solutions don’t just protect data; they empower employees to make better decisions. Security training is an integral part of any enterprise security strategy, but annual away days rarely have the desired impact. By contrast, our DLP solution offers in-app nudge functionality, which checks in on employees as they make decisions to remind them of security best practices.
- Discover lost data
Unstructured data is a considerable risk to data security – and cloud applications are a jungle of it. DLP, though, can help to get a handle on unstructured data. It offers mining capabilities for SaaS applications. It can automatically scan messages, files, and chats for unstructured data to be secured if needed.
Slack can be secure
Securing data in a cloud-first world is a challenge all organizations are facing. Adding DLP for collaboration tools like Slack is an affordable, effective way to meet compliance standards, reduce data loss and build a security-first culture within your organization.
