sb-eu logo
Story image

Slack doubles down on enterprise key management

20 Mar 2019

Slack is offering customers who use its Slack Enterprise Grid an addon that strengthens customer control of encryption keys used to secure files and messages within the Slack workspace.

Slack Enterprise Key Management (EKM) was initially previewed at Slack’s Frontiers conference in 2018, and now it is generally available to all Enterprise Grid customers.  

EKM augments Slack’s existing security features by giving users control of encryption keys, and also provides the security controls of an on-premise tool with the benefits of a cloud tool.

Slack’s chief security officer Geoff Belknap explains more about the tool in a blog. In it he states that EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.

Users bring their own encryption keys to EKM. Those keys are then managed in Amazon’s AWS KMS.

He stresses that users are full control of their encryption keys and when those keys are revoked. What’s more, admins can also revoke access to data or certain channels when necessary.

“Apart from being able to control access very granularly, you can also see how your data is being used.

"Detailed activity logs in Amazon’s AWS KMS tell you exactly when and where your data is being accessed.”

Belknap adds that the idea behind the solution is simply about security data easier without restricting access to features that people rely on to do their work.

“So if there’s a concern, you don’t have to just hit a button and shut down Slack completely, blocking all your different teams and departments from accessing the tool.”

He also says it’s important to remember security basics.

  • Always know who you’re inviting to your Slack workspace
     
  • Make smart decisions about which apps you use and who has permission to add them
     
  • Always review your access logs so that you can look out for any inappropriate behaviors. For example, Slack will notify you if one of your API keys has been exposed. Slack will also tell you when your users log in from new IP addresses. Use that information to protect your users and make good decisions about security."

Slack already encrypts all data in transit and at rest.

Story image
Jamf extends Microsoft collaboration with iOS Device Compliance
Organisations will soon be able to use Jamf for Apple ecosystem management while using Azure Active Directory and Microsoft Endpoint manager to maintain conditional access.More
Story image
Bring Your Own PC security to transform businesses within five years - Gartner
“Prior to the COVID-19 pandemic, there was little interest in BYOPC."More
Story image
High-tech heist: why fending off ransomware attacks is more challenging than ever in 2020
The COVID-19 crisis has unleashed a wave of sophisticated and disruptive ransomware attacks, and the onus is on businesses to ramp up their security measures if they’re to avoid falling victim, writes Attivo Networks regional director for A/NZ Jim Cook.More
Story image
75% of IT execs 'worried' about being targeted in cyber-attack
A new report from ConnectWise has shed light on the widespread concern about cyber-attacks, with 91% of SMB executives considering a move to an MSP if it provided the 'right' solution.More
Story image
Revealed: The behaviours exhibited by the most effective CISOs
As cyber-threats pile up, more is being asked of CISOs - and according to Gartner, only a precious few are 'excelling' by the standards of their CISO Effectiveness Index.More
Story image
CrowdStrike integrates with ServiceNow program to bolster incident response
As part of the move, users can now integrate device data from the CrowdStrike Falcon platform into their incident response process, allowing for the improvement of both the security and IT operation outcomes.More