保护您的商业通讯

马修Destot

2018年7月13日

在考虑安全性的情况下选择协作工具的提示.

Today’s enterprises are adopting a variety of digital collaboration tools to drive employee productivity, 提供具有成本效益的移动性, 并改善分布团队之间的沟通. 使用这些工具, 员工可以很容易地与同事建立Contact, 合作伙伴, 和供应商，不管他们在哪里, 通过简单有效的方式分享他们的工作 在线协作工作空间.

但是，虽然它们的好处是无可争议的, these collaboration and communications tools are introducing a multitude of new security risks to the enterprise.
协作工具容易受到安全威胁

当员工交换信息时, 进行私人谈话, 并在云端之间传输文件和文档, 协作平台为网络罪犯提供了另一种骚扰方式, 利用, 窃听组织, 以及泄露敏感或专有信息.

太频繁, 这些风险还没有被完全了解, 接受, 也没有得到当今企业的适当重视. 在这种情况下, tools that can hold so much promise can end up becoming dangerous and costly instead.

A number of factors make enterprise collaboration apps vulnerable targets for malicious intent. First, these tools are increasingly moving to cloud platforms as enterprises seek ways to expand their accessibility and availability, 同时也降低了成本. 虽然这种方法有很多好处, putting services and applications into the public cloud does introduce new security concerns. There are also issues surrounding the behavior of employees using these applications, many of whom are carrying a myriad of personal devices or inadvertently engaging in activities that might be risky. This can include intentional or unintentional leaks of intellectual property or data theft, 或者设置弱/易于猜测的密码.

趋势科技的最新研究 found that some chat platforms were at risk of being hacked and used as command and control (C&C)恶意软件的基础设施. The report states that the API functionality on popular chat platforms like Discord, Slack, 和Telegram都可能被成功滥用, 有效地将这些应用程序转化为C语言&C servers that cybercriminals can use to make contact with infected or compromised systems. 不幸的是, this is just one of many examples of legitimate services and applications being 利用ed to facilitate cybercriminal efforts.

即使有这些风险, the undeniable productivity gains offered by these tools mean they are here to stay. So, what can today’s enterprises do to protect their users and maintain the confidentiality, 完整性, 以及数据的可用性?

投资于企业级工具
虽然现在有很多协作和通信应用可供选择, 注意在企业中使用个人使用的工具. Organizations are quickly realizing the data privacy risks involved with these platforms, 有些人甚至选择这样做 禁用消费级即时通讯应用 从公司发行的设备，以更好地保护用户数据. 才能在不断扩大的威胁环境中生存, businesses require enhanced security features and controls that are typically only available in enterprise-grade tools, 包括防火墙, 使用TLS加密传输中的数据, 分布式拒绝服务(DDoS)缓解技术.

确保基础设施得到适当保护
It’s critical for enterprises to carefully select a platform where the underlying infrastructure has been designed with security in mind. 这意味着为硬件提供了适当的保护, 软件, 网络设备, as well as the physical security of the data center facilities that operate the services. Ask your service provider if their infrastructure is designed and managed in accordance with cloud security standards and controls, 如 OWASP. Make sure the data center facilities are properly monitored and protected as well; access should be monitored 24/7, 应跟踪授权人员的活动, and fire detection and extinction systems should be in place to prevent data leaks or loss.

保持对应用程序级别安全性的控制
While the service provider should guarantee the privacy and security of the underlying infrastructure and services, it’s important for businesses to make sure they can maintain some control over security at the application layer. 这使他们能够管理与云连接的安全性, 以及用户隐私规则, 身份, 以及应用程序本身的访问控制. 有很多供应商, 这就是众所周知的共享安全责任模型, which allows both the enterprise and the service provider to share the burden of security and take some initiative to protect each user.

多因素身份验证(MFA)是必须的
The best way to ensure that only authorized users or administrators access their accounts and associated resources is to make user authentication a multi-step process. This includes basic authentication (a user signing in with their email address/username and private password), 以及为每个API调用使用签名的web令牌. 作为最佳实践，应该重置而不是恢复被遗忘的凭据. 教育用户使用复杂的密码是至关重要的, 一种包含数字的, 信, 而且特别的特点是很难猜测的.

为新的威胁形势武装自己
Modern collaboration and communications platforms must be built to address the new threat landscape that today’s enterprises are facing. 阿尔卡特朗讯彩虹™是一款企业级产品, highly secure Unified Communication-as-a-Service hybrid cloud solution that enables customers to interface with and deploy custom applications quickly and securely.

To learn more about how the enhanced security features of the 彩虹 platform help to protect the confidentiality, 完整性, 以及企业数据的可用性, 请浏览我们的 彩虹网页. 我们也邀请您在Twitter上与我们Contact @ALUEnterprise 或者看看我们的网站 LinkedIn.