Slack now lets you control your enterprise-grade encryption keys

slack

Slack, is a business communication and collaboration service which allows for individual messaging, as well as group discussions and more structured rooms where users can join or be invited to chat.

It provides a variety of features that have made it popular with many free clients and has over three million paying clients. The Slack service comes in several versions: the free version allows users to search a limited number of messages. The paid versions with prices per user offer unlimited searches, group calls and some security benefits.

Finally, large companies, departments or other organizations may opt for a dedicated enterprise version.

Enterprise Key Management

Slack, announced the launch of a new product dedicated to its corporate clients: Slack's Enterprise Key Management (EKM) software.

A new tool which allows customers to control their encryption keys in the enterprise version of the communication application. Keys are maintained in the AWS KMS key management tool.

This new product meets the needs of paying customers for Slack who aren't keen on end-to-end encryption, according to a former Slack employee and the company's current chief information security officer.

Geoff Belknap, Chief Security Officer at Slack comments:

"Markets like financial services, healthcare, and government are generally underserved in terms of the collaboration tools they can use, so we wanted to design an experiment that meets their specific security needs."

Slack services currently enable encryption of inactive and in-transit data, but the new announcement of the business tool allows customers to better control the encryption keys used by Slack to encrypt messages and files shared in the application.

This enables encryption management by allowing, for example, revoking access to a single file, a specific channel, a workspace, or an organizational level when required.

Customers must be in control

End-to-end encryption, where users store keys on individual devices, allowing only recipients to read the content of messages, continues to spread on messaging platforms such as WhatsApp and telegram.

However Slack It is not a traditional email program like these. It is designed for companies and workplaces that may want or need to read employee messages, depending on the motherboard.

Therefore, Slack has decided not to have the idea of ​​having end-to-end encryption due to the priorities of its paying customers (those who use a free version can still benefit from end-to-end encryption).

The management of the encryption keys by the company itself is particularly importante, says Belknap, when clients hire people outside the organization, such as contractors, partners or suppliers.

In Slack communications.

"One of the great things about EKM is that in the event of a security threat or suspicious activity, your security team can cut off access to content at any time, if necessary."

Enterprise encryption key management can also help customers gain better visibility activity within Slack via the audit trail API.

"Detailed activity logs inform customers exactly when and where their data is being viewed, so they can be immediately notified of risks and anomalies," said Belknap.

So if a customer discovers suspicious activity, they can block access.

The launch of this new tool which allows Slack customers to control their encryption keys in the enterprise version it will surely be welcomed in some countries where end-to-end encryption is fought, even if Slack is not a traditional messaging tool.

Detailed activity logs can facilitate audits for malicious intent.

In fact, Slack, the messaging app for teams, is used by various companies and organizations on a global scale, such as NASA, newsrooms around the world, a large number of advocacy groups, etc.


Be the first to comment

Leave a Comment

Your email address will not be published. Required fields are marked with *

*

*

  1. Responsible for the data: Miguel Ángel Gatón
  2. Purpose of the data: Control SPAM, comment management.
  3. Legitimation: Your consent
  4. Communication of the data: The data will not be communicated to third parties except by legal obligation.
  5. Data storage: Database hosted by Occentus Networks (EU)
  6. Rights: At any time you can limit, recover and delete your information.