Collaboration Platforms May Open the Door to Sensitive Government Information

Unlock Exclusive Cybersecurity Insights

Complete the form below to be redirected to CDW's exclusive proprietary research report on Cybersecurity. Once the form is submitted, you’ll be opted into our Security email stream.

End-to-End Encryption

Roopam Jain, vice president for information and communication technologies at Frost & Sullivan, says state governments should be concerned about unauthorized access and the privacy of data shared in meetings.

“Today’s meeting platforms have come a long way in offering advanced features that assure users and IT managers that their meetings are fully secure and compliant,” Jain says.

Options such as end-to-end encryption, waiting rooms to control who joins the meeting, password protected meetings and two-factor authentication all add an extra layer of security.

“These capabilities ensure that collaboration platforms provide a secure environment for meetings, protect sensitive business information and maintain privacy,” she says.

The Right Security Features

Heidi Shey, principal analyst at Forrester, says while popular tools such as Microsoft Teams, Webex and Zoom are “secure for general-purpose use,” the level of security required depends heavily on how the platform is being used.

“A lot of employee communications could contain sensitive information,” Shey says. This could range from strategic plans to routine coordination, and the sensitivity of that information shapes an agency’s risk profile.

“It comes down to what that use case is and what information is being conveyed and stored within these platforms,” she adds.

Ensuring correct configuration of features, such as MFA or encryption of data at rest, is critical, Shey adds: “That’s the other side of the responsibility of making the best use of what you are purchasing.”

Managing Security Risks

Collaboration platforms carry a range of security risks that state agencies can’t afford to overlook. As data volume grows exponentially, so does the attack surface.

“Too much data makes it harder to detect violations,” Glenn says.

Insider risks — both accidental and malicious — remain a growing issue, compounded by the potential for compromised accounts and external threats such as ransomware.

“Collaboration platforms need to adapt to organizational fluidity,” Glenn says. “Otherwise, sensitive data can end up in front of the wrong eyes.”

If access controls are weak or misconfigured, collaboration platforms can become gateways for data loss, she says.

DIVE DEEPER: Identity and access management’s role is changing in the age of AI.

Complex Threat Landscapes

The collaboration threat landscape is also growing more complex, and state IT officials need to be aware of the evolving risks that come with that.

“Enterprises of all sizes are generating so much data, and attackers are using this to their advantage,” Glenn explains.

Complicating matters, she says, is the issue of “tool overload.” While having the right tools is essential, Glenn warns that many organizations are struggling under the weight of too many disparate solutions.

“This can lead to incorrect configurations, inconsistent policies and just general confusion,” she says. “It opens the door to preventable vulnerabilities.”

Click the banner to sign up for the StateTech newsletter for weekly updates.

Generative artificial intelligence is also reshaping the threat landscape. While GenAI promises efficiencies, it brings real security challenges.

“Malicious prompts designed to exfiltrate or access confidential or regulated data will go up,” Glenn cautions.

Ultimately, AI will improve the quality of phishing and social engineering attacks, increasing the risk of account compromise.  And in some cases, data may not be encrypted appropriately as it moves through the AI pipeline — from source to model to output — creating new points of exposure.

RELATED: AI governance bodies are key to mitigating the technology’s risks.

Best Practices for Security

To boost collaboration platform security, state government agencies should focus on both access controls and data management, Shey says, emphasizing that MFA remains one of the most effective defenses against unauthorized access.

Equally important is information lifecycle management — establishing clear guidelines for what should and shouldn’t be recorded or stored during meetings.

“That’s an easy way to generate a lot of sensitive information that’s not being managed appropriately,” Shey says.

Putting these policies in place early can simplify compliance and reduce long-term risk. This means actively reviewing shared content to determine what needs to be available and what can be retired.

Foundational data hygiene practices are also critical, including discovery, classification, posture and mapping. Glenn touts the importance of tagging data with the appropriate classifications so privacy and security tools can function effectively.

“Make sure the organization understand exactly who has access to what,” she says. “This will help limit insider risks.”