NSA: Webex best-in-class in secure collaboration guidelines.

NSA: Webex best-in-class in secure collaboration guidelines.

Guidelines for a safe, secure and compliant collaboration ecosystem

The National Security Agency (NSA) released a set of guidelines for “Selecting and Securely Using Collaboration Services for Telework.” The guidelines which evaluated 17 collaboration service providers identified a dozen critical criteria for cybersecurity functionality and security assurance to help employees and organizations make informed decisions when selecting a collaboration service for their needs. The goal is to help users “reduce their exposure to risk” when conducting business throughout their workday.

The pandemic brought about a new hybrid nature to the way we work. This radical change has raised new compliance issues that did not necessarily exist in the past when work was done on an organization’s premises and on secure internal networks using the organization’s devices. Today, IT administrators must be concerned about data protection and compliance while expanding the technology footprint to include personal and external devices.

Breadth and depth for security in collaborative services

Whether in the office, at home or roaming, CISCO’s approach to protecting devices, content, applications, data and users is holistic and 360-degree in nature.

Customers have entrusted Cisco Webex with their collaboration, meetings, messages, calls, and mission-critical data. They look to Webex to protect their data, help them comply with privacy laws and regulations, and reduce the risk of exposure to competitors, private or confidential data becoming public, unwanted press, and bad reputation. Webex provides an enhanced collaboration platform that helps keep customer data secure by making privacy and security the top priority in the design, development, implementation and maintenance of our networks, platforms and applications. Webex employs multiple technologies, procedures and teams to ensure that the collaboration platform meets privacy and security requirements and provides customers with a region option to store their user content.

CISCO assesses and corrects vulnerabilities on an ongoing basis and monitors networks and systems for outages, service latency, and unusual and unauthorized activities and events.

Secure throughout the ecosystem

The Cisco Webex ecosystem addresses basic security criteria such as multi-factor authentication, control over how collaboration invitations are shared, and end-to-end encryption.

CISCO systems ensure that user and organizational data is secure in all areas.

User and device protection

Webex has automated user onboarding and offboarding (SCIM or AD Sync), single sign-on with the customer’s chosen identity provider, multi-factor authentication via Cisco Duo or HTTP Authenticator, OAuth 2.0 standard-based authorization, anonymous user identities, role-based role access control and delegated administration.

When we use Webex, we also protect the user’s devices. All content created in Webex is encrypted end-to-end, including cached content. Our built-in MDM capabilities through Webex Control Hub ensure secure access for devices, including PIN locking to launch the application, administrator controls for file sharing and disabling message notification previews so no one can eavesdrop on messages on a locked screen, and the ability to remotely wipe Webex messages in the event of device loss or theft.

Securing content and meetings

End-to-end encryption keeps all Webex content secure, including searches. Organizations also have the option to store their encryption keys on-premises, giving them maximum control. With the end-to-end encryption option for meetings, customers have sole control of the meeting encryption keys, and Cisco and no one else can access their meeting content. We’ve been doing this for more than 12 years and have just announced a new standards-based approach to end-to-end meeting encryption that also provides end-to-end verified identity and support for conference room devices.

Data Loss Protection (DLP)

At Webex, we’ve designed our ecosystem to help prevent users from making mistakes before they happen. Through our data loss prevention (DLP) capabilities, organizations can prevent important information from being maliciously or accidentally shared in meetings or messages. Organizations can track meeting content, messages and files posted to rooms, track users added to rooms and meeting attendees, monitor unwanted users in rooms, and prevent accidental or deliberate sharing of sensitive information and data. Webex is the only collaboration solution that allows customers to use their existing DLP tools and policies for meeting recordings and transcripts.

Integrated compliance

With Webex Control Hub, organizations can define their data retention policy for meetings and messaging, including transcripts, highlights, recordings and messaging content.

Expansion of security capabilities

To extend Webex’s security capabilities, best-of-breed integrated solutions can be quickly deployed to protect an organization’s data, as well as the data of its partners. They prevent sensitive data leakage and provide anti-malware protection and multi-factor authentication.

To ensure users comply with compliance policies, Cisco Cloudlock provides visibility and control over sensitive information stored in Webex messaging with more than 80 existing policies and the ability to create new policies. Cloudlock can automatically delete files or messages when policy violations are discovered, notify administrators, and remove users from spaces.

To help combat malware attacks, Cisco TalosClamAV scans all uploaded files for Trojans, viruses, malware and other malicious threats. All files shared on Webex and designated by an organization are scanned and remediated, even if they are uploaded by external users. Infected files will be clearly marked and end users will not be able to download them on both organization-managed and personally managed devices. Cisco TalosClamAV scans one billion files daily for more than 10 million users, with 7.2 billion attacks stopped each year.

Remote worker safety

Securing the remote user and their data will continue to be a prime directive in the new hybrid work model. Whether users work from home, in shared coworking offices or in remote offices, the same security coverage inherent to on-premises work must be extended to these workers in the hybrid model. To further enhance remote worker security, Webex has created a suite of cost-effective solutions for enterprises and SMBs alike. With Cisco Webex secure remote work solutions, services such as meetings, messaging, and calls are secure. But that security coverage extends to endpoints, multifactor authentication, DNS protection, and malware defense for inbound email.

Source: see the complete original article. Published: April 20, 2021 09:00 AM PDT