- I don't think it's gonna come as a surprise to anyone,
that business collaboration
requires additional efforts around security.
Now, I'm not a security expert,
and information security as a whole
is an enormous topic.
So for the moment,
we're only gonna focus on considerations
around collaboration.
I think the biggest security consideration
in a collaborative environment
is that of access permissions.
So answer the question,
who needs to be able to see and interact
with specific information?
Of course, easier said than done, right?
This brings us back to having a solid understanding
of the information and audiences,
and who's gonna manage this, and how?
Microsoft Exchange, the backend for any company
that uses Outlook email and calendar,
has security groups that can be used
to grant permissions throughout Office 365,
but the management of those has become
a bit more difficult with the online version of Exchange.
Alternative email and calendar server technologies
may have similar controls
but aren't as popular and may not integrate
with the rest of the network ecosystem.
Do you need to collaborate with people
outside of your company?
Well, that can be done, but it brings other risks.
How can you protect your information
when it's in the hands of a third party?
Many file-sharing and co-editing tools
allow sharing with external partners,
and most of them have the ability
to control the access.
For instance, if you have a SharePoint site
that's externally enabled,
you have a wide range of permissions you can grant,
from view only, without the ability to download,
all the way up to co-edit, and even delete.
But guess what, someone has to make those decisions,
and the policies need to be managed
and kept up to date,
and you don't wanna set up policies
that are too restrictive,
because that means it will be harder
for employees to get their own jobs done,
let alone collaborate.
Now, extend that to all the collaborative tools
in use at your company,
and do you even know what those are?
Did someone over in finance
decide that they'd share a file
with someone using Dropbox,
when the company standard is Box?
And that brings us to kind of a scary fact.
More than half of all data breaches
are caused by user behavior,
rather than any kind of malicious attack.
I'm counting falling for phishing scams
as user behavior, by the way.
Most companies have policies in place
that would prevent phishing,
if only the employees stuck to them.
I guess that's really my point in the end.
Getting users to understand and follow policies
is your single biggest success factor
in any security strategy.
This doesn't mean you can put up a keep-safe poster
or have a mandatory security video and call it good.
I firmly believe that security education
has got to be an ongoing program at any company.
Of course, the information security team
will need to do their part,
including regular patches,
enforcing strong password policies,
and keeping up to date on the state of the industry.
There are new and better tools all the time,
including some slick ones
that use artificial intelligence
to monitor network traffic and identify deviations.
But still, building and maintaining
a robust security awareness program
will be the single biggest factor
in securing your business.