I have a couple of business partners (supply and trading, shipping) that leverage email heavily, mainly sharing documentation back and forth between themselves and third parties and some deals or agreements are also done over email. These partners would like a secondary communication in the event of email disruption: what other communication methods (email-esque) would you suggest? Also, cybersecurity is nixing other ideas because of concerns, but business is the number one concern, can assume all risk and override cyber though this could lead to consequences. Have any of you experienced this and how have you addressed their concerns?
Slack is certainly a MASSIVE improvement on email, and I'm fully bought-in to the ChatOps culture. Â
I do think it bears mentioning that ChatOps platforms have become an increasingly popular attack vector for malicious actors, given the intrinsic credibility an ATO on Slack gives to a social engineer and the often broad cross-section of different corporate data types shared and stored there.Â
Also, because Slack is often considered an out-of-band comms channel for support when other services go down or get locked, it often is configured with a longer log-in duration than other enterprise services (so you can contact IT when your email is locked).Â
We recently developed an internal standards doc for external data-sharing practices. We host a GCP bucket and a combination of asymmetric encryption, single-use expiring URLs, and granular audit logging (among a few other details) to ensure complete control over sensitive external shares. If you're a cloud-native org make sure you have strong relationships with your Architects who should be able to serve up solutions like this with relative ease.Â
The best solution usually depends on the organization(s) in question. Are they Microsoft O365 shops? Google Workspace? Do they leverage chat-ops heavily? How do they track access control and access requests? What sort of regulatory implications may there be as it relates to data retention and handling? Are there contractual agreements with any vendors or partners regarding how sensitive data must be handled?
As a CISO/CIO in my organizations IT reports into security so the default lens through which we view technology solutions is; "what is the greatest security posture I can cultivate around this process without installing friction for users?"Â
Often times the unlikely best candidate here is whatever cloud storage offering is native to your productivity suite. Both O365 and Google Workspaces have decent default security functionality and offer licensing for fairly robust security capabilities within their ecosystem. Or; they have really great toys to play with but, they don't leave the sandbox. Using a solution like MS OneDrive or Google Drive as a sharing platform for documentation is usually super easy for everyone to use. In addition to ease of use, however, this also makes sure that the documentation exists in an environment where you have granular control over security and audibility. Some basic suggestions with this solution include:
- Configure the default settings so that everything you create starts out private, and you must grant people access.
- Don't allow "share with anyone who has the link." Share with individuals or groups of individuals.
- Set expiration on sharing access so that you don't forget to revoke access later when business is concluded.
- Consider purchasing the native DLP functionality to ensure certain types of sensitive data are not inadvertently shared.
- Create a process to log access requests for external parties so there is an audit trail showing business cause for the access and logging expected access revocation timelines.
If the orgs are newer orgs that are chat-ops heavy (like mine) sometimes creating a collaborative Slack channel and inviting the other parties is best. This, similar to cloud storage, allows some degree of control over the environment security and is probably the "best" business solution in terms of speed-to-collaboration. Similar considerations as above, mostly want to focus on the part everyone forgets; revoking access so there are no hanging permissions.Â
Then there are the more traditional file-sharing services like DropBox and Dropzone. I doubt those need explanation.
IMHO email should be considered the last ditch form of communication for these types of interactions and if email is used it should only be used with a secondary security layer on top- password encrypting shared files and sharing the password through a password management solution like 1Password, for example.
Hopefully this helps, sorry for the lack of brevity 😅