Slack security concerns and how DLP helps overcome them

In recent years, Slack became a de facto standard platform for business communications within business teams. Originally, it was a cloud service designed primarily for developers and IT personnel. However, now it is often the selected means of collaboration amongst most departments in both young startups as well as established companies.

Slack in itself is a very safe platform, and its creators are taking data security and data protection very seriously. This SaaS platform meets all the requirements of data security, such as CCPA, GDPR, PCI, and HIPAA compliance. However, there are certain concerns arising from its popularity, and the one class of tools that can greatly help avoid them is data loss prevention (DLP) solutions.

Worry about users, not hackers

It’s not malicious hackers that pose the greatest threat to Slack security, it’s the users themselves. And while some Slack security concerns are associated with malicious user activity, the biggest potential for losing sensitive data comes from simple human errors.

Therefore, when designing your information security policy to cover Slack workflows, think less of the risk of your Slack instance being overtaken through a network/web vulnerability or a ransomware attack and think more about a non-technical user accidentally sharing sensitive information with the wrong person. Note that this doesn’t necessarily have to be a malicious intruder but just as well with someone who left the company but whose account has not been decommissioned properly.

Your Slack admins are humans, too, and can make mistakes. For example, they may allow guest access to external users, but they may forget to assign suitable permissions to prevent access to certain channels or data. Therefore, your primary focus should be on preventing the serious consequences of human errors.

Phishers are not slacking

Phishing is here to stay, and with the continuous introduction of new technologies, attackers find new classes of potential targets. The popularity of Slack and its accessibility via web technologies (web URLs) make it a perfect target for phishing attempts.

There are many ways in which attackers may use phishing for sensitive information exfiltration via Slack enterprise instances. For example, your employee may fall for a fake Slack request and join a Slack workspace with a name just like your official server. The attacker may also create a fake account on that server using the name of the victim’s direct superior. Then, the attacker, posing as the boss, may ask the victim to share a sensitive file via Slack, and you have a guaranteed data leakage.

Another method that attackers may use to steal information via Slack is by targeting your Slack administrators with phishing attempts. If your Slack admin falls for a fake Slack request, they may allow the attacker to enter the company Slack server and all the public channels. If other users share sensitive information on such public channels, stealing PII is child’s play for the attacker.

With great power comes great responsibility

One of the biggest reasons for Slack success is the fact that it supports integrations with many other popular apps, which greatly enhance the tool’s functionality. This includes not just the most popular software from Microsoft and Google – the Slack API makes it possible to develop your own custom integrations, too. However, the responsibility for the security of these integrations lies on the client side, and mistakes may lead to data being shared with malicious apps.

For example, one of the biggest risks is integration with eDiscovery apps, which can pull messages and files from Slack and store that information in data warehouses. While this is a very effective collaboration mechanism that lets people search and organize information shared earlier via Slack, it also introduces the risk of sensitive data being stored in additional, potentially unsafe environments and/or threatens compliance.

Slack DLP to the rescue!

All the problems mentioned above are easily solvable with the introduction of a DLP system and suitable policies for Slack. DLP tools such as the Endpoint Protector can eliminate many problems by simply not allowing your users to share any sensitive data via Slack.

With the right DLP tool, you can make sure that any copied, and pasted content doesn’t contain sensitive data such as social security numbers, credit card numbers, protected healthcare information (PHI), and other types of personally identifiable information (PII). If the DLP solution suspects that the clipboard contains sensitive information, the user won’t be able to paste that content into Slack channels, and therefore even if a phishing attempt were successful or even if the channel has an external audience, the data cannot be shared by mistake. The same goes for any sensitive file types – a good DLP tool will monitor system use in real-time and make sure that sensitive files will never be uploaded to any Slack instance.

Powerful DLP tools employ automatic data classification and machine learning techniques that allow them to recognize even sensitive data that you haven’t taken into account with your initial configuration. This makes them the most powerful tool to ensure Slack cloud security. And this makes them a must-have for any company that is serious about preventing data leaks via Slack.