The challenge of effectively securing collaboration tools [Q&A]

The COVID-19 pandemic has forced many more organizations to adopt remote working. This in turn has led to a boom in the use of tools like Teams and Zoom to help employees communicate.

Securing those tools though presents some serious challenges ensuring that, for example, they aren't used, inadvertently or on purpose, to leak sensitive information.

To find out more about how organizations can address these issues we spoke to Devin Redmond, CEO and co-founder of Theta Lake which has recently secured more than $12 million in funding to develop its collaboration security and compliance solutions for Cisco Webex, Microsoft Teams, RingCentral, Zoom and more.

BN: How much more interest in this technology have you seen as a result of the pandemic?

DR: We started with a focus on financial services, primarily with that intersection of compliance requirements, such as the FCA and a need to have tight visibility and supervision of regulated employees and how they're communicating with the public. Protecting consumers that way around scenarios of GDPR, where you're worried about sensitive information being exchanged, or in the US increasingly things like CCPA.

As a result of the pandemic the focus on those highly regulated organizations shifted very quickly as we started dealing with education, state and local government, and enterprise customers in all industries where they had a plan with endpoint security and network based visibility and physical workplaces, and lots of investment in that type of security perimeter and infrastructure. You erase all the borders on that put everybody at home, employees on platforms like Microsoft Teams and Cisco as fast as you can, and let them just start communicating. If you've been using these platforms as much as I have, it is easier to share information on a Teams session or a WebEx call and share anything that's on your laptop or PC network, anything that's available via the web or any cloud based apps, you can share it instantly to anybody that you're communicating with in that environment. That is much more powerful than attaching Excel spreadsheets to emails which is typically where people are looking for things like PII in perimeter-based security platform. That reality is starting to catch up with most organizations where they realize that they've turned on an information superhighway.

BN: How does this cope with multi-platform use, where you might be using Teams, Slack, Skype or other platforms through the working day?

DR: In a channel like email your organization typically has an email service -- it could be Exchange or 365 or Google -- but it is one email, you have one email address, if the organization sets up to protect that for security and data loss you have full coverage. But in the world of collaboration it's heterogeneous, just like you said everybody's got multiple tools. The larger the organization, the more likely it is to have more tools, not less. In that scenario our strategy was always to work very closely with the platforms themselves, so that we can integrate with all of the leading platforms that are out there and in fact if you look in the app marketplace for Microsoft or Zoom or Cisco and you look under security and compliance, you will see a listing for us. What that essentially means is, any of our enterprise or business customers in any vertical can enable us, use our integrations with those platforms, simply turn us on with their Microsoft Teams, with their Cisco WebEx and do all of that simultaneously. Then, any channel that that user is going on as a business channel that is owned by the company can be inspected for risk in that environment and we can do all of that simultaneously.

BN: Is there an overhead associated with that protection?

DR: We're a cloud based security platform, so all of our engineering was built around being able to do tight integrations with those platforms. Being able to consume things like chat digests out of Teams or video recordings, or phone calls out of Teams Calling or Cisco environments. One of the things we're most proud about is the fact that we've been working very closely with the Cisco collaboration team, you just did a piece around them talking about privacy in the remote workplace, part of their strategy around that was our partnership. Our ability to provide those kind of deeper capabilities and do that very seamlessly so the user experience for you as an employee of the firm is totally transparent. We connect to Cisco WebEx as an example and then we consume content directly from that platform and analyze it in our environment.

BN: So that would include things like uploading files?

DR: We're looking at the entire communication, so we capture that file. If you and I were talking inside Teams and you want to share something with me, maybe we're internal employees, and you send me a SharePoint link to that document. It's actually the wrong link and it goes to a file that's got customer credit card numbers in it, or customer account numbers and names. We would see that link, analyze the file and let you know that there's risk inside that content, the compliance team knows that there's risk inside that content as well. But also if I were to, say, open Salesforce and share that in my screen we would actually detect that Salesforce is being shared, and if any PII showed up in what I was sharing we would actually detect that it was shown on screen inside of that meeting, and then flag that for review.

BN: How does this tie in with the concept of zero trust?

DR: The reality in these types of communication is anybody has access to everything at all times. The burden of proof is really proving something didn't happen and the reality of that means you have to set up infrastructure to deal with it, to be able to do recordings of your video conferences. Because anybody on a Teams call can just simply click through and do a screenshot or turn on their own personal recorder or maybe turn on a recorder that's sitting next to your phone and capture all the information. You are at a disadvantage being able to prove that something didn't happen where anybody else who was party to that who decided to take that screenshot, or capture that audio can prove that it did.

Collaboration software is definitely a powerful, positive business enabling tool that is the right technology for this very difficult time. The challenge that it introduces is a whole new set of security and privacy and data protection issues that organizations need to reconcile with all things that they had in their remit before.

BN: Sounds like Theta Lake was in the right place at the right time for the COVID effect too?

DR: Yeah, you can't buy that kind of timing. It was totally unplanned but, frankly, good timing in some scenarios -- aside from the terrible world environment -- but in others it happened so fast that even as a startup we felt we were moving faster than we should.

Image credit: fizkes / Shutterstock