An Introduction To Slack Security - How To Keep Your Business Safe On Slack

On a daily basis, over 10 million individuals use Slack to communicate more effectively with the various people they work with. Whether it’s internal communication among a department, project discussions within a team, or sending messages to external freelance hires, Slack is a fantastic tool for productivity.

Kicked into popularity due to the pandemic, Slack has risen to become a central business tool that’s used around the globe. In fact, 43% of Fortune 100 businesses pay for premium Slack accounts for their whole enterprise, demonstrating the use that major companies are finding in this communication stream.

While Slack has enterprise-grade security, mainly focusing on the fact that it is an invite-only space, this doesn’t necessarily mean that anyone who uses Slack is free from risk when online. In fact, considering the important information that is exchanged on Slack, whether it be private files or confidential login details, hackers are now targeting this platform due to the valuable data it holds.

IMAGE: UNSPLASH

Shutting Old Employee Accounts

Part of modern business is employee turnover, with the rate of employees leaving job positions in search of a better deal for them being at an all-time high. This increased rate of turnover has led to the attack surface of any business expanding. As you create a new user portal for an employee when they join the team, you’re increasing the potential avenues that a hacker could use to gain entry into your business by one.

While the majority of employees will know all about avoiding phishing links and creating a strong password, it’s actually employees that have already left the company that you should be worried about with Slack. When someone leaves, their accounts are not automatically disabled, leaving user accounts connected to your Slack portals wide open.

If a hacker is able to gain access to one of these accounts that an employee no longer uses, then they’re able to scroll through all the different chats that were previously associated with this Slack profile. That includes main group chats, private conversations, and project discussions. Anything that the account was connected to is now exposed

One surefire way to stop hackers from gaining entry to old accounts is to disable them or delete them from the Slack workplace as soon as that employee leaves. If you’re a large company, with lots of employees regularly leaving and joining, then we suggest that you do this in batches.

Once every week, or every two weeks, you should go through the active employee list, disabling any accounts that are still associated with the Slack workplace. Through this, you’ll lower your attack surface and ensure that only active accounts have access to private conversations within your workspace.

Permissions And Access

Another way to boost the Slack security of your business is to have an Admin account to actively manage the permissions of different accounts. This means that you should go through the accounts connected to your Slack and limit which chats they can see. An unmonitored Slack could leave even executive-level chats open for absolutely any employee to look into.

With this, you’re liable to accidentally expose more information than you originally wanted, creating an unstable workspace where information is a little too transparent. Another worry with this over-access is that, again, if someone were to gain access to one of the accounts, they could then get into any chat they’d like, exposing a range of important company details and private information stored there.

Be sure to give people access to only what they need, ensuring they can get into chats with their team members, and any projects they’re working on.

Personal Information Sharing

Part of what makes Slack such an efficient work tool is that you can instantly message people, getting a message delivered to people’s Slack in seconds. With this, it’s all too easy to enter important or private information into a group chat to have the whole team see the details. While this is effective for speed and productivity, it is a bad practice when it comes to security.

Instead of sharing information in group chats, you should ask your employees to only send information over 1-1 private chats. With this, if someone were to gain access to a certain account, they would only be able to see the private information which was sent to that particular account. This will significantly limit the amount of information that the hacker has access to, boosting the effectiveness of your security system.

Links

Perhaps the oldest mantra in internet security pertains to never opening links from accounts you don’t recognize. If an account that you don’t recognize posts a link into your Slack channels, even if it may seem legitimate, never open it without double-checking that the person who sent it is who they say they are.

While this is less of a problem within Slack than something like email, there is still a big risk. Reducing the possibility of data being breached all starts with ensuring an effective level of common sense when it comes to your employees.

Final Thoughts

Slack, although an effective business tool for modern enterprises, still has a range of potential security risks that your employees may not be aware of. If you’re looking to ensure total security of your Slack workspace, you should educate your team on the various steps they should take when communicating over this workspace.

From never opening links from accounts you don’t recognize to ensuring that the permissions are configured correctly within your user accounts, there are a lot of steps you can take to create a safer Slack environment for all of your team members.