Online collaboration technologies may be exposing more than realized

Online collaboration and meeting services such as WebEx, GoToMeeting, Lync and Adobe Connect are extremely popular for conducting online presentations, webinars, training and remote technical support. These collaboration technologies can facilitate communication and information sharing between customer and partner organizations across the globe and save money by reducing travel time and expenses.

While the benefits of externally hosted collaboration technologies are generally acknowledged, there are a number of risks and security threats that are usually neither well-understood nor formally accepted. These technologies are by design intended to support open collaboration across geographical or organizational boundaries and thus are not designed to limit undesired communications or support security controls, monitoring capabilities and data loss and exfiltration prevention. It is critical that organizations understand these often-overlooked security risks, accepting them  based on risk tolerance or appropriately mitigating them to ensure collaboration technologies do not introduce undesired, unintended or unknown risks into the enterprise.

There are three primary use cases for collaboration technology meeting services:

The first and simplest use case is internal-only collaboration where all participants are within a single agency or enterprise network. In this case, risks are minimal if the supporting technology is owned and operated by the organization with communications within the controlled enterprise.

The second use case consists of agency-hosted meetings with participation from external entities. With an appropriate on-premise security architecture and design, the settings and configurations can be controlled by the hosting organization so as to disable undesired capabilities such as remote control or file sharing.  However, the use of a shared cloud infrastructure can result in the exposure of agency’s client systems and networks based on the settings of other organizations using the same collaboration software in the cloud.

In the final use case, agency users attend an externally hosted meeting, training event or other online session. In this third scenario, access to online collaboration meeting services bypasses many agency perimeter security controls and provides an all or nothing capability to participants that cannot be effectively limited, controlled or monitored by enterprise security or IT teams. 

The foundational challenge is that an agency whose users attend externally hosted meeting is at the mercy of the external hosting organization, with little to no ability to technically control what its own users are doing. Collaboration technology vendors generally do not provide participant-level controls that could be enforced by local IT administrators or domain policies. Instead, security settings and features are controlled by the hosting organization. For example, if the hosting organization allows attendees to remotely hand over control of their systems to external participants, there is no technical mechanism for an agency to prevent its own staff from doing so. Not only can this activity not be prevented, but it also cannot even be detected due to the inability to proxy or inspect encrypted communications for most collaboration technology products. 

Connections to online meeting services bypass an agency’s policy-based enforcement controls and give end users the discretion to hand over desktop control to non-validated external entities (including foreign nationals). Because these services can give unauthorized external entities an unauthenticated and unmonitored backdoor into organizational networks, agencies should require strong multifactor authentication for remote access with a secure virtual private network connection.

All it takes is a little social engineering for external users to obtain access to internal organizational systems through collaboration software. Once remote control is established via collaboration software, the external entity would have the same level of access to internal systems, applications and data as the internal user. All activity would be logged as the internal user, with no audit trail of the external entity. The collaboration software can then be used to exfiltrate data that would not be monitored or detected through the encrypted collaboration software communications.

If that is not bad enough, further complicating matters is the use of shared cloud infrastructures for collaboration. While the landing page for a company’s collaboration site may have its own subdomain or subpage, the underlying infrastructure and resources for accessing cloud-based collaboration technologies are shared. Thus, even if you trust that a specific organization hosting an external meeting will not allow or misuse remote control or file sharing, you must inherently trust other organizations (or adversaries) using the same collaboration software in the cloud as well.

If you did not realize the potential exposure collaboration technology meeting services may provide to internal systems and networks and how such technologies could be used to bypass other security controls, you are not alone. These services are extremely popular and offer significant conveniences that often lead to quick adoption with little scrutiny. However, sophisticated and determined adversaries will take advantage of security weaknesses in online meeting services to obtain access to target networks and data. With an understanding of the risks, IT and security leaders can make appropriate risk-based decisions.

Organizations very tolerant of risk  may simply accept the risks, with an understanding that every individual employee or contractor could potentially expose internal system resources either intentionally or inadvertently. The acceptance of such risk must be formalized to include an understanding of the potential loss of control of organizational application, system and data access; a lack of logging and accountability for external user activities; and an inability to prevent or detect when undesired collaboration technology features are used. In the absence of technical controls to limit the risk, mitigation must be based on an agency’s trust of end user’s behavior and compliance with documented policy.

While end user training and awareness is an important part of any security program, a lack of technical controls to prevent undesired behavior, combined with an inability to detect such behavior, is likely not acceptable for most agencies. Because collaboration technology vendors generally do not provide controls or policy enforcement of meeting software capabilities at the client level, other techniques must be used to ensure internal systems or data are not exposed. One technique is to use network segmentation to allow access to collaboration software only from designated systems that are isolated from other enterprise resources and data. While this reduces the exposure, it also reduces the users’ convenience to attend online meetings from their normal work environment where they have access to critical business systems and data.

A more sophisticated approach that balances convenience and security is an outbound virtual desktop infrastructure solution. Instead of exposing internal systems to the potential of file sharing via remote desktop or exfiltration, only the virtual desktop on the outside of the core network would be exposed.  Using this solution, there would be no possibility of remotely controlling internal systems or using the file sharing capabilities of collaboration software; only audio, video and mouse and keyboard movements would be sent between the virtual system outside of the core network and the internal user system. Even if the virtual system is compromised or controlled remotely by an unauthorized entity, it is properly isolated and can simply be wiped and reimaged upon completion of every session. An outbound virtual desktop infrastructure is an ideal solution for reducing the exposure of online collaboration meeting services in addition to many other risky online Internet capabilities such as social media and web-based email.

The risks and threats introduced via online collaboration meeting services can be accepted or mitigated, but it is critical that they are not ignored. The convenience these capabilities offer have led to their use often without the full understanding of the potential exposures to an organization’s internal systems and data.

It is only a matter of time before the use of external collaboration software is linked to a major security incident or breach. Before your organization becomes headline news, be sure you have completely assessed the exposures created by online collaboration meeting services and taken appropriate actions to prevent undesired, unintended or unknown risks into your enterprise.