Can we trust our online project management tools?
Credit to Author: Pieter Arntz| Date: Fri, 06 Jul 2018 15:00:00 +0000
How would you feel about sharing confidential information about your company on Twitter or Facebook? That doesn’t sound right, does it? So, in a corporate life where we keep our work calendars online, and where we work together on projects using online flow-planners and online project management software, it might pay off to wonder whether the shared content is safe from prying eyes.
What are we looking at?
From the easy-to-use shared document on Google Drive to full-fledged Trello boards that we use to manage complicated projects—basically everything that uses the cloud as a server is our subject here. When evaluating your online project management tools, it is important from a security standpoint to have an overview of:
- Which online project management platforms are you using?
- Which data are you sharing on which platforms?
- Who has access to those data?
Once you know this, you can move on to the main question:
- Is the data that should stay confidential shielded well enough?
What are the risks?
The risks of using online project management tools are made up of several elements. Once again, a list of questions will help you gage this, including:
- How secure is the platform you are using?
- Do the people that have access to the data need to have access? And are they given access to see all the information that is shared, or just a portion?
As you can see, we are not just worrying about outsiders getting ahold of information. Sometimes, we must keep secrets, even from our own co-workers. Not every company has an open salary policy, for example, so the information how much everyone makes might not be allowed outside of HR.
But the threat of a breach is the most important one. Having the competition know about the latest project your design team is working on can be deadly in some industries. And of course, any project that contains customer data and is not secured can be breached by a cybercriminal. Knowing this, it’s our job to help you find the safest possible tool to perform your job.
Does it make sense to share online?
Are we sharing information online because we need to do it online or just because we can? Sometimes being the cool kids that use an online project management platform that has all the bells and whistles is more a matter of convenience than it is strictly necessary. But if you are:
- employing remote workers
- cooperating between offices around the world
- heavily relying on a BYOD strategy
then online tools maybe the only way to realize your project management goals.
Every ounce of prevention
What you don’t share can’t get lost. And control over what you do share (and with whom) is adamant.
- Limit the amount of privileged information you are sharing. Make sure that only the information needed for the project is being shared with the appropriate team members.
- Change the login credentials at a regular interval, and do this in a non-predictable way. Going from “passwordMay” to “passwordJune” at the end of the month will not stop nosy co-workers from digging. Do not post the new credentials on the platform, either.
- Use 2FA where and if possible to enhance login security.
- Update and patch the software as soon as possible. This limits the risk of anyone abusing a published vulnerability in the platform.
- Keep tally of who is supposed to have access at all times, and check this against the connected devices when and if you can.
Breach management
Hardening your online tools against breaches is usually in the hands of toolmakers themselves—the software provider or the cloud service provider with whom you’ve partnered. Therefore, it makes sense to look into the project management tool’s reputation for security, as well as its ability to serve your company’s needs. While you can’t control the security of the tool itself, you can limit the consequences of a mishap, should it occur, by doing the following:
- Don’t try to keep it a secret when credentials have been found in the wrong hands. Making participants aware of the situation helps them to change passwords and follow up with other appropriate actions.
- Make sure there are backups of important data. Someone with unauthorized access may believe in burning the bridges behind them.
- In case of a breach, try your best to find out exactly how it happened. Was there a vulnerability in the tool? Did a team member open up a malicious attachment? This will assist you in preventing similar attacks.
Controlling the risks
Working in the cloud can be useful for project management, but sometimes we need a reminder that there are risks involved. If you set up an online project management tool or other cloud-based project, it’s good to be aware of these risks and give some thought to the ways you can limit them.
When you’re working on a project for your company—whether it’s leading a team or participating in the project’s development—it’s important to make data losses as rare as possible, to learn from your mistakes, and to handle breaches and other security incidents responsibly.
Stay safe out there!
The post Can we trust our online project management tools? appeared first on Malwarebytes Labs.