How Secure Are Modern Collaboration Platforms?

Password Protection and End-to-End Encryption

Roopam Jain, vice president of the information and communication technologies practice at Frost & Sullivan, says businesses should be concerned about unauthorized access and the privacy of data shared in meetings. “Today’s meeting platforms have come a long way in offering advanced features that assure users and IT managers that their meetings are fully secure and compliant,” she explains.

Features such as end-to-end encryption, waiting rooms to control who joins a meeting, password-protected meetings and MFA all add extra layers of security, she says.

While popular tools such as Microsoft Teams, Webex and Zoom are “secure for general-purpose use,” the required level of security depends heavily on how the platform is used, notes Heidi Shey, principal analyst at Forrester.

DISCOVER: The three collaboration challenges that managed services can solve. 

“Businesses are using these platforms for internal collaboration, so you have a lot of employee communications that could contain sensitive information,” Shey says. This could range from strategic plans to routine coordination; the sensitivity of the information shapes the organization’s risk profile. “A lot of it comes down to what that use case is and what information is being conveyed and stored within these platforms,” she says.

From her perspective, it’s critical to ensure the correct configuration of security features such as MFA or encryption of data at rest.

Managing Security Risks

Collaboration platforms carry a range of security risks that enterprises can’t afford to overlook. As data volume grows, so does the attack surface. “Too much data makes it harder to detect violations,” Glenn says.

Another layer of complexity comes from regulatory requirements. Most businesses, regardless of size, operate across borders or industries with different compliance rules, for example compliance with SOC 2 or HIPAA. “This seriously complicates how data must be handled and secured,” Glenn explains, noting that noncompliance can quickly become both a legal and reputational risk.

Insider risks — both accidental and malicious — remain a growing issue, compounded by the potential for compromised accounts and external threats such as ransomware. “Collaboration platforms need to adapt to organizational fluidity,” Glenn says. “Otherwise, sensitive data can end up in front of the wrong eyes.” If access controls are weak or misconfigured, she warns, collaboration platforms can become gateways for data loss.

That’s why they “need to adapt to organizational fluidity,” Glenn says. “Otherwise, sensitive data can end up in front of the wrong eyes.”

DIG DEEPER: The best AI-driven collaboration tools you might be overlooking. 

The collaboration threat landscape is also growing more complex. Businesses should be aware of the evolving risks that come with that, she says.

For example “tool overload,” struggling under the weight of too many disparate solutions, plagues many businesses. “This can lead to incorrect configuration, inconsistent policies and just general confusion. It opens the door to preventable vulnerabilities,” Glenn says.

Emerging technologies also bring new risks, with one major concern the “harvest now, decrypt later” strategy, in which attackers exfiltrate encrypted data today with the intention of using future quantum computing technology to break that encryption. Generative AI is also reshaping the threat landscape: While it promises efficiencies, it brings real security challenges.

“Malicious prompts designed to exfiltrate or access confidential or regulated data will go up,” Glenn cautions.

Ultimately, AI will improve the quality of phishing and social engineering attacks, increasing the risk of account compromise. However, in some cases, data may not be encrypted appropriately as it moves through the AI pipeline, creating new points of exposure.

Best Practices for Bolstering Security

To boost collaboration platform security, small businesses should focus on both access controls and data management, Shey says, emphasizing that MFA remains one of the most effective defenses against unauthorized access.

Equally important is information lifecycle management, establishing clear guidelines for what should and shouldn’t be recorded or stored during meetings.

“That’s an easy way to generate a lot of sensitive information that’s not being managed appropriately,” Shey says.

Putting these policies in place early can simplify compliance and reduce long-term risk. This requires actively reviewing shared content to determine what needs to be available and what can be retired.

FIND OUT: How can you leverage digital technology to build your modern workspace?

Basic data hygiene practices are also critical, including discovery, classification, posture and mapping. Glenn touts the importance of tagging data with the appropriate classification so privacy and security tools can function effectively.

“Make sure the organization understands exactly who has access to what,” she says. “This helps limit insider risks.”

She adds that IT leaders must understand where their organization stands on the spectrum between security and operational efficiency. That clarity, she argues, is key to knowing where to prioritize security investments.

“For some organizations, keeping business moving is more important than security,” Glenn says. “Your team must understand if the potential fines outweigh the cost of business, and vice versa.