Microsoft Teams, Slack, Zoom, and Box make it incredibly easy for teams to communicate around the world. But, as with any technology that we rely upon in the workplace, they also present a target to opportunistic hackers. With these apps, employees can communicate quickly in a range of ways. Links, photos, and documents can be shared internally and externally, and with varying degrees of formality.
Many organizations, for example, will have an informal channel to discuss the latest football results or their weekend plans, and a separate, “work only” channel for important business. This diversity of messages and recipients can make it difficult to track where data is being shared and stored, and even more challenging to ensure that it’s being shared securely. So, if an attacker were to gain access to a user’s messaging app, they could potentially have immediate access to critical or sensitive corporate data.
But the problem doesn’t end there – cybercriminals can use compromised communication apps as a base from which they can extend their attack to the rest of the company network. In 2022, Uber reportedly fell victim to an attack that utilized social engineering to gain access to the company’s Slack channel. From here, the attacker was able to log on to the corporate VPN, roam around the network, and locate details of Uber bug bounty reports – these acting as a catalogue of vulnerabilities to hack Uber.
Communication applications also offer extensive access to other employees within an organization. If an account were jeopardized, it could act like a gateway to more senior accounts with greater privileges. In one step, a low-level breach has become a big problem.
In this article, we’ll highlight the top solutions with Integrated Cloud Messaging Security (ICMS) to secure your Slack and Teams accounts. These function in a very similar way to email gateways – they scan inbound files and content to protected users from malware and scan outbound content for DLP purposes.
We’ve decided to focus on Slack and Microsoft Teams, in this article, as these two companies have grown rapidly over the past five years. With nearly 80% of Fortune 100 companies using Slack, and Microsoft Teams recording 270 million users in 2022, they represent a good portion of the digital communications users.
Avanan is a well-established security company, primarily operating in the email and cloud collaboration security sector. Their email solution goes beyond just your mailbox and protects your Slack and Teams accounts with technically advanced security layers to prevent malware distribution, protect your data, and ensure your organization is compliant. Avanan is an all-in-one solution that will regulate your internal communication, whatever form that takes. Avanan was acquired by Check Point in 2021.
Avanan Features:
Pricing: Avanan’s most advanced package, Complete Protect, is priced at $7.20 per user/month, and offers protection for email, Teams, OneDrive, Box, Slack, and Google Workspace. Advanced Protect, priced at $5.50 per user/month, covers all of the same applications, but does not provide DLP or encryption capabilities. Avanan’s Protect solution, $4.30 per user/month, focuses on spam and virus filtering, phishing protection, without the advanced sandboxing or DLP features, but does work across the same applications.
Expert Insights’ Comments: Avanan is a widely adopted solution, which allows it to compile accurate intelligence gathered from millions of mailboxes and messages. This ensures that you are well protected against even unknown or zero-day threats. The solution receives widespread praise for effectiveness, and integration with usual workflow practices. Avanan is an AI-backed solution that is constantly learning – this reduces the instances of false positives over time, ensuring that your network remains secure whilst not impacting your productivity.
Cloudlock is brought to you by San Francisco based Cisco. It is an effective means of securing your third-party messaging applications from intrusion and data loss. Cloudlock identifies sensitive information stored in cloud environments, then uses out-of-the-box and custom policies to protect this data.
Cisco Cloudlock Features:
Pricing: Contact Cisco directly for more information on packages and pricing.
Expert Insights’ Comments: Cisco is a well-established player, with products across the breadth of the cybersecurity sector. As part of Cisco Umbrella, Cloudlock is readily integrated with a suite of advanced tools to protect your organization. Cisco has focused on designing a product that protects larger organizations and governmental agencies – it provides a high level of security, whilst ensuring you remain compliant with relevant regulation.
Founded in 2015, HighSide is relatively new to the ICMS sector, but brings a highly effective and easy to use encryption service to the market. They offer an extension for Teams that encrypts all messages and files with FIPS 140-2 grade encryption – both AES and Triple-DES encryption are compatible with this framework.
HighSide Secure Teams Features:
Pricing: For Business customers, HighSide costs $12/user/month. This plan supports all file formats, allows multi-user file editing, and customizable data retention policies. For $20/user/month, HighSide offers an Enterprise plan. This has all the features of the previous plan, but also offers unlimited storage, sandboxing capabilities, and geolocation-based (RF signals) access controls. There is also a Government plan (POA), which incorporates FedRAMP Moderate (or High) and DoD Impact Level 4, with Impact Level-5 also available.
Expert Insights’ Comments: HighSide provides an advanced level of encryption in a user-friendly and ergonomic design. It is ideal for securing out-of-band communication, though it should be noted that it works solely on Teams, unlike some of the other products featured on the list. Therefore, for organizations who primarily use Teams, this is the ideal solution. The sandboxing and geolocation-based access controls are particular highlights that set this solution apart.
Email security company IRONSCALES announced its integration with Teams and Slack in 2020. IRONSCALES combines machine learning with human threat intelligence to identify suspicious behaviors and to take effective action. Not only does IRONSCALES work hard to keep your accounts safe, but it saves valuable admin time by providing a streamlined dashboard with customizable policies.
IRONSCALES Features:
Pricing: IRONSCALES offers three pricing options for their email security solution, with Teams coverage being a feature of only their most advanced offering: Complete Protect. This is priced at $8.33 per mailbox / per month and offers BEC, phishing, malware, and credential theft protection, as well as security awareness training and cover for third-party applications like Slack, Teams, Microsoft 365, and Google Workspace.
Expert Insights’ Comments: IRONSCALES is widely praised for its email capabilities, with users saying it is a highly effective tool with an impressive ability to detect malicious and phishing attacks. The company’s service in communication security is equally successful. Having messaging visibility extended from your email inbox to every way that you communicate is key to preventing network attacks from a variety of angles.
NetSkope is primarily a Cloud Access Security Broker (CASB) provider that secures your online apps such as Teams and Slack. With NetSkope, admins gain visibility of messages, snippets, posts, and files. The solution will also detect anomalies and non-compliant behavior across a range of messaging applications. NetSkope automatically audits traffic to create a detailed risk profile, with risk-scores associated to different applications, thereby giving you intelligence on security posture and allowing you to make informed decisions.
Netskope For Managed Cloud Applications Features:
Pricing: Contact NetSkope for detailed information on pricing.
Expert Insights’ Comments: NetSkope offers an impressive number of integrations. Beyond Slack and Teams, it works well with Microsoft 365, Box, DropBox, and Salesforce – the list goes on. This wide range of integrations is useful as it allows admins to have complete oversight of the network, thereby decreasing any vulnerabilities. Being able to access this information regarding your whole network from one dashboard saves time and reduces the chances of critical information being overlooked.
The broad coverage options and the granular insights provided make NetSkope a good option for larger organizations, or organizations who are looking to expand their environment by incorporating more applications.
Proofpoint is a cybersecurity organization whose background is rooted in the email sector, but which also offers effective secure for other digital communication channels. Proofpoint’s CASB solution addresses a number of vulnerabilities that arise from the use of cloud services – it manages DLP, extends visibility, and uses adaptive policies for higher risk users. Any DLP policies made within Proofpoint CASB will be shared with other Proofpoint products in your security stack, ensuring that standards are enforced across your network.
Proofpoint CASB Features:
Pricing: Contact Proofpoint for more information on pricing.
Expert Insights’ Comments: As well as integrating with Slack and Teams, Proofpoint CASB works well with Box, DropBox, Google Drive, and OneDrive. This level of visibility makes managing your network as a whole much easier. Proofpoint describes their solution as “people-centric”, as it aims to mitigate the effects of social engineering-based attacks. This is an important perspective as, all too often, staff are manipulated into giving out critical information or allowing unauthorized access.
Symantec, now a subsidiary of Broadcom, is a cybersecurity provider with an established history in the security sector. Their CloudSOC is a CASB that employs user analytics and adaptive risk analysis to keep your network secure. For Slack, the solution even allows you to define policies based on channel type (public, private, and direct message), amongst other attributes. The solution assesses file reputation, carries out antivirus scanning, and sandboxes content when required to give you a high level of confidence that content is safe.
Symantec CloudSOC Features:
Pricing: Symantec’s CloudSOC is only available for purchase through partners – contact one of these for detail on pricing options available.
Expert Insights’ Comments: Symantec has a long history in the cybersecurity space, making their CloudSOC product a trusted and highly functional solution. The solution offers a host of features – such as shadow IT identification – which go beyond securing your communications channels to keep your organization secure. CloudSOC readily integrates with Symantec’s broader product suite, making it an effective solution for organizations looking for Teams or Slack security as part of a comprehensive security stack.
Attackers are always on the lookout for ways to gain access to our networks and sensitive data. Today, with an increase in hybrid working, organizations are increasingly using communication tools to hold important – financially sensitive – meetings, share access codes, and connect with other employees. While most employees see these applications as productive, attackers see them as an opportunity.
When using a communication application, it is easy to assume that it is a closed network. If you receive a message, we assume it is legitimate, and are likely to comply with what it says. However, we do not know if this account has been compromised. It could be that an attacker has gained access to one account and is connecting with nearby employees to try and increase their level of privilege.
By implementing a communications security tool, unusual, suspicious, and anomalous behaviour can be identified and flagged. These tools can highlight if a user is acting in a way that they wouldn’t normally act, and therefore suggest if their account has been compromised.
Integrated Cloud Messaging Security (ICMS) tools work by analysing behaviour to build a baseline understanding of a user. This baseline will include records of who they usually connect to, the frequency and type of messages that are sent, the types of files that are shared, even common work hours and geographical locations. Taken together, this information creates a comprehensive picture of a user.
This user profile will be compared with current behavior, and anything suspicious can be flagged. If an ICMS tool detects unusual behavior, they may require the user to use MFA to log in or escalate the issue to an admin account. This allows the valid user to use their MFA linked account to log in and prevents a fraudulent user from retaining access.
Alex is an experienced journalist and content editor. He researches, writes, factchecks and edits articles relating to B2B cyber security and technology solutions, working alongside software experts. Alex was awarded a First Class MA (Hons) in English and Scottish Literature by the University of Edinburgh.
Laura Iannini is an Information Security Engineer. She holds a Bachelor’s degree in Cybersecurity from the University of West Florida. Laura has experience with a variety of cybersecurity platforms and leads technical reviews of leading solutions. She conducts thorough product tests to ensure that Expert Insights’ reviews are definitive and insightful.