Online collaboration technologies may be exposing more than realized

 

Connecting state and local government leaders

Sophisticated and determined adversaries can take advantage of security weaknesses in online meeting services to obtain access to agency networks and data.

Online collaboration and meeting services such as WebEx, GoToMeeting, Lync and Adobe Connect are extremely popular for conducting online presentations, webinars, training and remote technical support. These collaboration technologies can facilitate communication and information sharing between customer and partner organizations across the globe and save money by reducing travel time and expenses.

While the benefits of externally hosted collaboration technologies are generally acknowledged, there are a number of risks and security threats that are usually neither well-understood nor formally accepted. These technologies are by design intended to support open collaboration across geographical or organizational boundaries and thus are not designed to limit undesired communications or support security controls, monitoring capabilities and data loss and exfiltration prevention. It is critical that organizations understand these often-overlooked security risks, accepting them  based on risk tolerance or appropriately mitigating them to ensure collaboration technologies do not introduce undesired, unintended or unknown risks into the enterprise.

There are three primary use cases for collaboration technology meeting services:

The first and simplest use case is internal-only collaboration where all participants are within a single agency or enterprise network. In this case, risks are minimal if the supporting technology is owned and operated by the organization with communications within the controlled enterprise.

The second use case consists of agency-hosted meetings with participation from external entities. With an appropriate on-premise security architecture and design, the settings and configurations can be controlled by the hosting organization so as to disable undesired capabilities such as remote control or file sharing.  However, the use of a shared cloud infrastructure can result in the exposure of agency’s client systems and networks based on the settings of other organizations using the same collaboration software in the cloud.

In the final use case, agency users attend an externally hosted meeting, training event or other online session. In this third scenario, access to online collaboration meeting services bypasses many agency perimeter security controls and provides an all or nothing capability to participants that cannot be effectively limited, controlled or monitored by enterprise security or IT teams. 

The foundational challenge is that an agency whose users attend externally hosted meeting is at the mercy of the external hosting organization, with little to no ability to technically control what its own users are doing. Collaboration technology vendors generally do not provide participant-level controls that could be enforced by local IT administrators or domain policies. Instead, security settings and features are controlled by the hosting organization. For example, if the hosting organization allows attendees to remotely hand over control of their systems to external participants, there is no technical mechanism for an agency to prevent its own staff from doing so. Not only can this activity not be prevented, but it also cannot even be detected due to the inability to proxy or inspect encrypted communications for most collaboration technology products. 

Connections to online meeting services bypass an agency’s policy-based enforcement controls and give end users the discretion to hand over desktop control to non-validated external entities (including foreign nationals). Because these services can give unauthorized external entities an unauthenticated and unmonitored backdoor into organizational networks, agencies should require strong multifactor authentication for remote access with a secure virtual private network connection.

All it takes is a little social engineering for external users to obtain access to internal organizational systems through collaboration software. Once remote control is established via collaboration software, the external entity would have the same level of access to internal systems, applications and data as the internal user. All activity would be logged as the internal user, with no audit trail of the external entity. The collaboration software can then be used to exfiltrate data that would not be monitored or detected through the encrypted collaboration software communications.

If that is not bad enough, further complicating matters is the use of shared cloud infrastructures for collaboration. While the landing page for a company’s collaboration site may have its own subdomain or subpage, the underlying infrastructure and resources for accessing cloud-based collaboration technologies are shared. Thus, even if you trust that a specific organization hosting an external meeting will not allow or misuse remote control or file sharing, you must inherently trust other organizations (or adversaries) using the same collaboration software in the cloud as well.

If you did not realize the potential exposure collaboration technology meeting services may provide to internal systems and networks and how such technologies could be used to bypass other security controls, you are not alone. These services are extremely popular and offer significant conveniences that often lead to quick adoption with little scrutiny. However, sophisticated and determined adversaries will take advantage of security weaknesses in online meeting services to obtain access to target networks and data. With an understanding of the risks, IT and security leaders can make appropriate risk-based decisions.

Organizations very tolerant of risk  may simply accept the risks, with an understanding that every individual employee or contractor could potentially expose internal system resources either intentionally or inadvertently. The acceptance of such risk must be formalized to include an understanding of the potential loss of control of organizational application, system and data access; a lack of logging and accountability for external user activities; and an inability to prevent or detect when undesired collaboration technology features are used. In the absence of technical controls to limit the risk, mitigation must be based on an agency’s trust of end user’s behavior and compliance with documented policy.

While end user training and awareness is an important part of any security program, a lack of technical controls to prevent undesired behavior, combined with an inability to detect such behavior, is likely not acceptable for most agencies. Because collaboration technology vendors generally do not provide controls or policy enforcement of meeting software capabilities at the client level, other techniques must be used to ensure internal systems or data are not exposed. One technique is to use network segmentation to allow access to collaboration software only from designated systems that are isolated from other enterprise resources and data. While this reduces the exposure, it also reduces the users’ convenience to attend online meetings from their normal work environment where they have access to critical business systems and data.

A more sophisticated approach that balances convenience and security is an outbound virtual desktop infrastructure solution. Instead of exposing internal systems to the potential of file sharing via remote desktop or exfiltration, only the virtual desktop on the outside of the core network would be exposed.  Using this solution, there would be no possibility of remotely controlling internal systems or using the file sharing capabilities of collaboration software; only audio, video and mouse and keyboard movements would be sent between the virtual system outside of the core network and the internal user system. Even if the virtual system is compromised or controlled remotely by an unauthorized entity, it is properly isolated and can simply be wiped and reimaged upon completion of every session. An outbound virtual desktop infrastructure is an ideal solution for reducing the exposure of online collaboration meeting services in addition to many other risky online Internet capabilities such as social media and web-based email.

The risks and threats introduced via online collaboration meeting services can be accepted or mitigated, but it is critical that they are not ignored. The convenience these capabilities offer have led to their use often without the full understanding of the potential exposures to an organization’s internal systems and data.

It is only a matter of time before the use of external collaboration software is linked to a major security incident or breach. Before your organization becomes headline news, be sure you have completely assessed the exposures created by online collaboration meeting services and taken appropriate actions to prevent undesired, unintended or unknown risks into your enterprise.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.