Preventing Security Risks from Unofficial Communication Channels
Preventing Security Risks from Unofficial Communication Channels
In today's business landscape, we’re seeing an increasing number of security threats that stem from unauthorised or unofficial communication channels. While employees have access to various internal tools like Slack, Teams, and email, cybercriminals often exploit new, unapproved channels to bypass these secure systems. Below, we'll outline some key points on this issue, along with ways your business can protect itself.
Common Risks and Scenarios
One growing threat involves an individual impersonating an employee and introducing an unauthorised communication channel such as a new phone number, SMS, WhatsApp, or an external email address. This may seem like an innocent request to communicate, but it could easily lead to phishing, fraud, or data loss.
For example, a scammer might send a message pretending to be a staff member, using WhatsApp or another unfamiliar method, claiming to need urgent help. The person could request sensitive information or even make financial demands, posing a serious risk to your business.
Why Official Channels Matter
When communication happens over authorised platforms like Slack or email, there’s a clear chain of accountability. These platforms are under company control, which means all conversations can be audited, and user identities are verified. In contrast, WhatsApp and other uncontrolled tools lack these safeguards.
For instance, imagine an employee negotiates with a client over WhatsApp, then leaves the company. There's no way to retrieve the conversation or confirm the agreements made, which could lead to issues in accountability and transparency.
Data Loss Prevention (DLP) Considerations
Using unapproved communication tools like WhatsApp for business purposes also raises concerns around Data Loss Prevention (DLP). Sensitive business data shared over personal, unmanaged apps can be difficult to track and recover. Without control over these channels, there’s a greater risk of data leakage.
Verifying Suspicious Communications
It’s crucial that any unusual or urgent request, especially when involving money or sensitive information, is verified through a trusted and established communication channel. For example:
- Suspicious Text or WhatsApp Messages: Verify by sending an email or Slack message to the person who supposedly sent it.
- Strange Emails: Call the sender directly to confirm their identity or reach out through a separate, trusted platform.
- Odd Phone Calls: If you receive a phone call from an unknown number, or even from a familiar number asking for unusual actions, such as buying supplies for an unfamiliar event, always send an email to verify.
With modern technology, voice or even video can be manipulated easily. AI tools can now clone someone's voice with just a few seconds of audio, so it’s more important than ever to be cautious and verify communications across multiple channels.
Guidelines for Approved Use of WhatsApp
If your business decides to allow the use of WhatsApp or similar apps, establish clear guidelines to minimise risk. For example, WhatsApp may be suitable within established groups for non-sensitive, informal communications, but it should not be used for discussing confidential business matters. Make sure employees are aware of the potential risks and always advise verifying requests made over these channels through another method.
Payment and Financial Verification
A high-risk area is financial transactions. Be sure that any payment requests or authorisations are cross-checked between at least two official communication channels. For example, if an invoice or bank account details are sent over email, verify them through a phone call or Slack message. Introducing a new payment account should never be done based on a single communication channel, as this is a common tactic used by fraudsters.
Conclusion
To protect your business, it’s essential to have strong policies in place regarding the use of unofficial communication channels. Ensure employees are well-trained to recognise potential threats and always verify unusual requests through multiple channels. By using secure, authorised platforms and setting clear guidelines for communication, you can significantly reduce your risk of falling victim to these schemes.