Slack Security and Compliance Overview

According to data by Enterprise Apps Today, nearly 600.000 firms across the world use the Slack app. Of which around 88,000 use the paid version of the app.

Whether you use the paid or the free version of the Slack app, a thorough understanding of Slack’s security and compliance is paramount.

In this article, we will analyze the security and compliance of Slack and answer some of the most commonly asked questions.

Basics of Slack security and compliance

Even if you have state-of-the-art technology in your company, IBM reports that

17% of the breaches were because of a compromised partner.

As a communication partner, how secure is Slack? Let’s find out.

How secure is Slack?

Slack is equipped with cutting-edge technology for data security and protection. It features encryption for data at rest and data in motion. So, whether your data is stored on a device, in the cloud, or is being transported from one node to another on an insecure channel, Slack secures it.

Slack has tools like Slack Enterprise Key Management (EKM), audit logs, and data loss prevention (DLP) for securing your data further. We will discuss these concepts later in this article.

Is Slack GDPR compliant?

The General Data Protection Regulation (GDPR) came into practice in 2018. It is the most comprehensive data protection law for EU residents.

Slack offers all the measures on the product, operations, and contractual levels to help its customers with GDPR compliance. Slack is committed to data privacy and updates itself with the new regulations as and when required.

Is Slack approved for government use?

Slack is approved for handling moderate-level data, not publicly available, for the federal government.

The US government has set very stringent standards for software that can be used to store and transport sensitive data. The Federal Risk and Authorization Management Program (FedRAMP) is a government initiative that provides a standardized approach to security assessment, authorization, and continuous monitoring of cloud products and services.

FedRAMP classifies the information into three categories:

• Low-impact level: given to organizations handling data that has a low impact on its loss. The loss of this data causes limited harm to the agency’s operations, assets, or citizens.
• Moderate-impact level: this level of enterprises is allowed to handle government records that are not publicly available. This type of data is called controlled, unclassified information (CUI).
• High level: FedRAMP high-level certification is for handling highly sensitive unclassified data of the federal government in the cloud environment.

Let’s learn a little more about Slack’s security and compliance procedures.

Key features of Slack security

Slack offers enterprise-grade security settings layered into its software. These security measures are designed to keep the data protected and ensure a secure working environment while keeping the user experience intact.

Layers of security protect Slack to defend against any attack from cybercriminals.

Industry-accepted best practices and frameworks protect your data as well as Slack’s code.

Security features of Slack include:

1 – Identity and device management

Identity and device management features ensure that your account is secured no matter where you access it from. Slack can restrict the use of unapproved devices. It allows access to users according to permissions based on their assigned roles.

SAML-based single sign-on

Security assertion markup language (SAML) is an online security protocol that allows you to use a single set of credentials for multiple applications.

SAML-based single sign-on (SSO) allows you to log in just once by verifying your identity to access multiple applications.

For instance, if you log in to Google Chrome, you don’t need to enter your Slack credentials to log on. Therefore, you need to enter only one set of credentials while securely accessing your applications.

Session duration

Slack allows you to customize the time, after which you will be asked to verify your identity again. This feature is called session duration. You can find it in the ‘Settings and administration’ section of your paid Slack account.

Very much like the auto-lock feature of your car, this feature will lock the access after a specified duration of inaction.

Two-factor authentication

Two-factor authentication (2FA) is an identity verification method using two factors: knowledge and possession. 2FA is based on the assumption that only a legitimate user can corroborate both factors.

First, Slack allows you to identify yourself with a username and password. This is the knowledge factor.

Secondly, it sends you a one-time password (OTP) on your pre-registered mobile number to verify whether it’s you who has entered the first password. This is the possession factor.

User and group provisioning via SCIM

The system for cross-domain identity management (SCIM) standard allows you to onboard and offboard team members. You can control the access to information shared on Slack and define permissions for every member level.

Domain claiming

To set up an enterprise grid account (Slack’s premium tier for large organizations), you can verify and claim your email domain name. You can set up your workspace as the primary organization for Slack Connect.

This means members can only join the conversation with your invite link. It is used to connect with outside partners, vendors, or customers.

2 – Mobile device management

To safeguard users who use mobile devices to access Slack, it offers the following security measures:

Enterprise mobility management (EMM)

EMM lets your team use the organization’s workspace only from permitted devices. You can download EMM for Slack from iOS or Android phones. This feature is available on the Enterprise Grid subscription only.

Secondary authentication

Secondary authentication can be added to your Slack account by enabling 2FA. You will have peace of mind if your password is stolen. You can simply download a popular authenticator app like Google Authenticator, 1Password, or Duo Mobile and turn on 2FA in your Slack settings.

Block message copy and file download

The block message copy and file download feature restricts copying messages and downloading files from all the IP addresses except those specified. It helps you to curb unauthorized downloads of data.

Default browser control

When you enable the mandatory mobile browser setting for Slack, you can reduce security risks by limiting the types of browsers that users can access Slack with. Currently, Enterprise Grid subscribers can use the default browser controls on Blackberry Access and Microsoft Edge.

The default browser will be used when the users sign in using single sign-on and open external links on the Slack mobile app.

Block jailbroken or rooted devices

Jailbroken iOS devices and rooted Android devices often present security risks. You can enable this setting in your Slack account to restrict users from accessing your workspace on such devices.

Members using SSO will be blocked as soon as they sign in from sketchy devices. In comparison, those signing in via email addresses and passwords or from their browser will be granted access once. This access will be revoked as soon as Slack becomes aware of the device.

Minimum app version

Usually, app developers provide security patches called updates, for known vulnerabilities. Not updating your app or operating system can pose serious security risks.

Slack allows its Enterprise Grid subscribers to disallow access if the app version is not updated. You can enable the setting in your workspace to keep a check on every member of your team. If they don’t update, they will be blocked from Slack.

3 – Data protection

There are two basic types of data. Data in motion and data at rest. Data in motion refers to the data that is in transit between two nodes. While data at rest refers to the data stored on any device or cloud. Protecting both types of data is crucial, and Slack does just that.

All the conversations on Slack have enterprise-grade data protection.

This means that your conversations are secure throughout the messaging journey and also meet your compliance requirements.

The following tools are used to give you control and visibility:

Grid workspace discovery

Slack’s grid workspace subscription plan is also known as Enterprise Grid. It reflects the structure of your organization. It offers flexible workspaces to include different departments, subsidiaries, and contractors.

At the same time, access permissions can be managed at a micro level, thereby securing the files and the messages shared on Slack.

Enterprise key management (EKM) or bring your own key

This is an add-on to the above Enterprise Grid feature. The keys stored on Amazon key management services (AWS KMS) can be used on Slack for encryption.

These keys can be allotted and revoked as per your enterprise’s requirements. The key management won’t affect the overall working of Slack.

Data loss prevention (DLP)

By default, Slack encrypts both data at rest and data in transit. Furthermore, it allows integrations with DLP providers to prevent data loss and monitor it.

DLP is imperative to fulfill governance requirements, including HIPAA, PCI, and GDPR.

Nightfall is a Slack DLP partner that automatically detects and secures sensitive data, such as personally identifiable data (PII) and protected/personal health information (PHI), on public or private Slack channels.

Nightfall will send you an automatic notification through Slack if it detects any sensitive information so that you can take instant steps for reducing security breaches.

Audit logs API

If you want to programmatically check for security lapses on Slack, the Audit logs API is your feature. You can ask your Enterprise Grid IT team or security professionals to monitor the logs API.

App and integration management

Slack allows you to integrate numerous software and apps to make your business management seamless. You can improve your productivity and security through Slack integrations.

4 – Information governance

Slack facilitates your organization’s governance and risk management needs to match increasing expectations and standards.

Global retention policies

Slack allows its paid users to choose their own retention time. For unpaid users, the retention time is 90 days. But if you delete a channel, all the messages and files will be permanently deleted.

If you have an Enterprise Grid subscription, Slack also offers you to choose different settings for different workspaces.

eDiscovery

Some local laws require you to store your files shared via messages on Slack. For example, an appointment letter with personal information shared via Slack might have to be stored for future use.

For Enterprise Grid customers, Slack offers integrations with a third-party data warehouse to store all your messages and files.

Customized terms of service (TOS)

As an Enterprise Grid user, you can customize your terms of service. You can send the terms of services to the new members for agreement.

You can also modify the same at a later date. If you decide to modify the TOS, you can send all your existing team members the updated TOS to agree.

Slack compliance certifications

The Slack security standards meet and exceed the industry-accepted compliance requirements.

Therefore, Slack is certified by the following compliance certificates.

Standard	Scope	Status
ISO/IEC 27001	Applies to organizations that want to or are formally required to improve their business processes around information security, information asset security, and privacy.
ISO/IEC 27017	This standard provides additional security controls for the cloud environment. It applies to both cloud service providers and cloud service customers.
ISO/IEC 27018	This standard applies to all organizations, including public/private companies, government entities, and not-for-profit organizations that process PII. However, if you are a PII controller, you must follow other legislative guidelines in addition to this standard.
ISO/IEC 27701	This standard is an extension of the ISO/IEC 27001 standard. It implements, maintains, and continuously improves the Privacy Information Management System (PIMS).
SOC 2	SOC 2 audit tests an organization’s security, confidentiality, availability, privacy controls, and processing integrity against: American Institute of Certified Public Accountants (AICPA’s) TSC (Trust Services Criteria), in accordance with SSAE 18. International Standard on Assurance Engagements (ISAE) 3000.
SOC 3	The primary difference between SOC 2 and SOC 3 is the need for details. If your organization doesn’t require a detailed report, SOC 3 is advisable.
Cloud Security Alliance	CSA is a non-profit organization that offers professional cloud security certification.
Schellman’s APEC PRP Privacy Certification	This certificate is given to organizations that fulfill the institute’s requirements as PII processors across borders.
Schellman’s APEC CBPR Privacy Certification	This certificate is given to PII controllers that fulfill the institute’s requirements.
FedRAMP Moderate	This is a standard for cloud computing security for controlled, unclassified information (CUI) for handling US government agency data that is not publicly available.
EU-US Privacy Shield Swiss-US Privacy Shield	This certification applies to the security compliance of the personal data transferred between the EU/Switzerland and the US.
HIPAA	A US government regulation for those who handle sensitive medical records of patients.	Slack supports customers’ compliance with HIPAA.
FINRA	FINRA is a regulatory body that governs registered brokers and broker-dealer firms in the US.	Slack supports customers’ compliance with FINRA.
GDPR	GDPR is a data protection and privacy law for European Union citizens.	Slack supports customers’ compliance with GDPR.
Data Residency	Data residency law requires the data of a country’s citizens to be collected, processed, and/or stored inside the country before being transferred overseas.	Slack supports customers’ compliance with Data Residency.

How does Mio ensure Slack security and compliance when sending messages to other platforms?

You can now link Google Chat to Slack using Mio’s Google Chat Slack connector for genuine message interoperability.

This means you enable cross-platform messaging from Google Chat to Slack (and vice versa).

When you sign up to Mio, you get access to what is effectively middleware that translates messages from Google Chat to Slack.

You, as the admin, do the syncing of channels and enabling of users in the background then let everyone know when they have access to send messages from one platform to another.

They get a one-time notification and action and you sleep better knowing your business no longer suffers from workplace silos or anywhere near as much context switching.

What makes Mio’s Microsoft Slack connector enterprise-ready?

There are two key elements that qualify Mio as enterprise-ready:

1. Security
2. Scalability

1 – Security

Mio keeps customer data secure and adheres to common global compliance standards, giving you peace of mind.

Mio never stores any messages or files you send cross-platform.

Mio works by receiving an API call from one platform, translating the language into the other platform, and delivering the message cross-platform.

For example, Ian sends a Slack message…

Mio receives the message

↓

Recognizes the user or channel you’re sending to is on Google Chat

↓

Translates the message from Slack language to Google Chat language

↓

Mio sends the message to Google Chat

We classify and prioritize data in advance to ensure your sensitive data is securely handled throughout the transaction.

The biggest question that gets asked is “Does Mio store our files and messages?”

No user messages or files are persistently stored. Message metadata is retained by Mio for future reconciliation across platforms. But the underlying messages and files are not permanently retained.

Speaking of metadata, Mio only stores the following metadata:

• Message identifier (ID)
• Time stamp
• Platform assigned user IDs
• Channel IDs

These get stored for the duration of your service or until Mio is asked to destroy them via a hard delete.

Aside from this, we’re independently audited annually for SOC 2 and adhere to the frameworks outlined by GDPR and CCPS:

• Service Organization Control (SOC) 2 Type II
• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)

With regards to scopes, Mio never asks for more permissions than necessary. Just the bare minimum is needed to enable cross-platform messages.

• See which Slack scopes are needed
• See which Google Chat scopes are needed
• Download the Mio Security Whitepaper here

2 – Scalability

When you’re dealing with Slack and Google Chat accounts at scale, there are two key areas where Mio is unique from other workaround solutions…

1. Automatic failover and contingency plans during outages.
2. Automated provisioning and management tools.

Automatic failover and dealing with platform outages

If you look after IT for a large enterprise, you’re responsible for keeping the lights on. And you need your infrastructure and software to do exactly that.

Nobody wants to be held accountable if there’s an outage and you weren’t prepared.

As such, Mio is hosted exclusively in AWS US data centers and uses multi-zone redundancy to maximize availability and uptime. So if AWS fails in one region, another zone is already in tandem.

When things outside of Mio control happen, like if Slack or Google Chat suffers an outage, there are a number of flow controls to maximize message delivery reliability.

All message events received by Mio are delivered to front-end servers distributed over multiple availability zones.

For resilience, event payloads are immediately encrypted and placed into a fault-tolerant FIFO queue for processing by the Mio multi-zone, distributed back-end system.

Should Slack or Google Chat be unavailable, Mio retains the encrypted event in a queue, and will automatically attempt redelivery based on a time-based replay strategy.

Want to learn more about how Mio enables you to send Slack messages to people on Google Chat?

Check out the Mio website.

‍