“By default, Slack will retain all messages and files (including audio and video clips) for the lifetime of your workspace. Slack’s data retention is forever by default If I’m a frustrated employee or an attacker taking over an employee’s Slack account, I can easily scrape sensitive information from the company’s Slack workspace by simply searching for files based on sensitive keywords or PII. Files in public channels are accessible by all workspace membersĪny file uploaded by any user to a public channel is now accessible and searchable by all members of the workspace (excluding guests). In reality, organizations have hundreds if not thousands of public Slack channels that their workspace members use daily to push the business forward. Messages or files posted in a private channel can only be searched by members of that channel.” People must be added to a private channel by someone who's already a member of the channel. “Private channels are for conversations that should not be open to all members. Messages or files posted in a public channel can be searched by other members of your workspace.” Any member of your workspace (but not guests) can view and join a public channel, giving everyone access to the same shared information. “Public channels promote transparency and inclusivity. The Slack channel creation wizard sets the channel to public by default unless the user specifies otherwise. Slack allows users to create channels and set their visibility to either private (invite-only members) or public (anyone in the Slack workspace can join at any time, excluding guests). What’s the problem? Slack channels are public by default This blog describes the root causes of this issue. At the same time, its adoption enables technical personas such as software engineers and IT and DevOps personnel to share AWS keys over Slack channels with little or no governance. Slack (and Microsoft Teams) revolutionized the way organizations collaborate efficiently, especially in the work-from-home era. It’s time for security teams to enforce stronger controls over the sharing of AWS keys in Slack. This blog was originally published by DoControl here.

Aws and slack