The security and compliance issues related to instant messaging use
- Details
- Published: Friday, 01 September 2017 09:01
Most organizations now allow employees to use IM in some capacity; or their employees use it anyway! And with IT teams under a lot of pressure, the risks of data leakage that come with IM are often forgotten about. Thomas Fischer thinks that IM threats are worth talking about…
The growing popularity of instant messaging (IM) in the workplace is no surprise. Quick, immediate and convenient, IM holds a strong appeal for employees looking to communicate and collaborate in real-time with other co-workers.
Thanks to presence awareness, IM users can instantly see who’s online and available, create group chats and share web links, files, images, sounds and stream content in addition to text and voice messages. All of which makes it quick and easy for people to work collectively, despite being remotely located from one another.
Productivity gains aside, from an enterprise risk standpoint, securing IM platforms is a vital yet often overlooked task. But that’s not all.
The regulatory and legal issues surrounding IM can mean that unmonitored information – that leaves the organization without the knowledge and control of the IT department – will have very serious implications. Indeed, for certain types of data, the very act of sharing via IM may represent a violation of GDPR and other privacy guidelines.
For these reasons, IT teams need to put measures in place to ensure that IM data leakage, compliance and security concerns are appropriately addressed:
Educate employees
With employees using IM in the workplace on a formal and informal basis, it’s vital that they are made aware that a short message sent to the wrong person or containing the wrong information can be extremely damaging.
Training should outline their cyber security responsibilities, especially with regard to the use of non-authorised IM platforms, and the very real protection concerns that these represent to the enterprise’s sensitive data and its networks.
Teaching employees about IM best practices is an important first step to ensuring that everyone follows basic rules and are clear about the guidelines regulators and law enforcement agencies have in place with regard to IM communications. That means employees will need to be informed about usage, content and retention policies.
Put controls in place
Messaging apps represent a vulnerability that can potentially be exploited by malicious insiders looking to leak sensitive data, and there are well documented concerns as to whether messages sent via free public IM platforms are open to interception via encryption backdoors.
To counter these risks, IT teams should put policies in place that restrict which apps can be installed on mobile devices given to employees.
Mobile device management (MDM) software can be used to lock down, control, encrypt and enforce policies on tablets and smart phones. Alternatively, Mobile application management (MAM) solutions enable IT teams to lock down, control and secure specific corporate applications without impacting a user’s personal apps.
Monitor IM transmissions
Many IM services now offer end-to-end encryption which limits the ability of IT teams to track and trace data movements. But with IT teams under pressure to monitor, capture, and keep records of business, employee and customer information under these services, some advanced monitoring software solutions may prove effective in detecting connections to IM services when mobile devices connect to company data networks.
Initiate secure IM services
Some software vendors now offer encrypted corporate versions of their solutions that meet employee messaging needs, while helping IT teams take back control and fulfil security and compliance requirements.
Featuring multi-factor authentication, built in anti-virus and end point monitoring, these platforms enable IT teams to create secure IM networks that meet the needs of today’s enterprise users.
Final thoughts
IM tools can help companies improve productivity, become more responsive and better support mobile and remote workers. But as IM becomes increasingly ubiquitous in the workplace, organizations of any size risk becoming susceptible to compliance breaches, data loss and malware infection without having the proper protection and controls in place.
