Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: If your company cares about security, why does it use Slack?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 71 posts

Re: Ask HN: If your company cares about security, why does it use Slack?

#31

Post by jph »

TLDR we chose Mattermost over Slack because of security. https://www.mattermost.com

We recently evaluated many chat systems for a large tech consulting project that includes security needs.

Slack was the frontrunner because of ubiquity, ease of use, plentiful third-party integrations, openness to free areas, and helpful in-person meetings with the Slack staff.

We picked Slack for our informal connections with external developers for non-confidential discussions.

For our own teams' use, I really like Ryver. The security is better (IMHO), the team-oriented features are stronger, and the billing is much clearer. The Ryver team is fully open to discussions about how to grow the platform and improve the security.

Ultimately the security team chose self-hosted Mattermost. We liked the combination of intranet deployability, plus a ramp toward security compliance capabilities that we do need for a few projects.

Re: Ask HN: If your company cares about security, why does it use Slack?

#32

Post by nzoschke »

falcolas wrote: post #7
dstroot wrote: post #3

Umm... why do people always assume "hosting it yourself" is more secure and not less? Do you have Slack's security expertise and budget? In my experience when small to mid-size companies attempt to manage security themselves they do a passable job but are convinced they are doing an excellent job - until they get hacked. Larger companies usually have the budget, tools and expertise. But even then there are lots big c…

Corollary question: Why do you assume that Slack's security expertise and security budget is greater than your own? All we can do is assume that Slack cares about security enough to be sufficient. Last I checked, they didn't have any form of compliance certification, yet HIPPA, PCI, etc. compliant clients use them without reservation.

I happen to know a few people on the Slack security team from a prior job. SalesForce, another SaaS business people trust to manage all their data.

There's no question that Slack's budget is greater than my own. They have a large, full-time security team. I have a bit of attention from myself or a colleague when setting a system up.

There's also no question their expertise is better. These are life long security professionals with direct experience at other SaaS companies.

Re: Ask HN: If your company cares about security, why does it use Slack?

#34

Post by falcolas »

count wrote: post #13
falcolas wrote: post #7

Earlier quoted context omitted.

Corollary question: Why do you assume that Slack's security expertise and security budget is greater than your own? All we can do is assume that Slack cares about security enough to be sufficient. Last I checked, they didn't have any form of compliance certification, yet HIPPA, PCI, etc. compliant clients use them without reservation.

You should look again: https://slack.com/security

OK: Slack is not currently a PCI-certified Service Provider.

I was also a bit surprised what they consider out of scope for their bug bounty program: https://hackerone.com/slack

Re: Ask HN: If your company cares about security, why does it use Slack?

#35

Post by zzalpha »

stusmall wrote: post #16

You should assume that chat logs can become public at anytime, if you host it yourself or not. Don't put sensitive/embarrassing unencrypted information in chat or email. People forget this is still data at rest.

Yup.

At minimum, in the case of a lawsuit, they will be subject to document retention and subpoena.

Re: Ask HN: If your company cares about security, why does it use Slack?

#36

Post by sgehly »

linkregister wrote: post #21
sgehly wrote: post #17

Earlier quoted context omitted.

and what about if your network is compromised? For most small-medium businesses, that's more likely than Slack being compromised.

Slack already had a public compromise. Most small businesses haven't been publicly compromised. I'm not saying it's safer to self-host. There are a ton of foot-guns with operating your own IRC server.

It mostly depends on if you're a target. I must have missed when Slack was compromised, but I'm willing to take the risk of Slack being hacked, as I'm not a target. Im a fan of the methodology that bigger company = more secure, although that's obviously not always the case.

Re: Ask HN: If your company cares about security, why does it use Slack?

#37

Post by fweespeech »

dstroot wrote: post #3

Umm... why do people always assume "hosting it yourself" is more secure and not less? Do you have Slack's security expertise and budget? In my experience when small to mid-size companies attempt to manage security themselves they do a passable job but are convinced they are doing an excellent job - until they get hacked. Larger companies usually have the budget, tools and expertise. But even then there are lots big c…

> Umm... why do people always assume "hosting it yourself" is more secure and not less? Do you have Slack's security expertise and budget? In my experience when small to mid-size companies attempt to manage security themselves they do a passable job but are convinced they are doing an excellent job - until they get hacked.

I'm not exposing it to the WAN, just the LAN. :\

I don't think people really appreciate how massive of a security difference that is. It doesn't matter how big your budget is if you sit on the WAN all day. Someone will _always_ tag you eventually.

LAN with hardened VPN/SSH setups are virtually impossible to get into in a software-is-at-fault kind of way. And even if they did, they'd then have to launch the attack from someone's workstation at which point you've already been compromised anyway.

Oh, and then to get to the chat service they'd still need to break the security of an open source chat service which is non-trivial.

Re: Ask HN: If your company cares about security, why does it use Slack?

#38

Post by count »

falcolas wrote: post #34
count wrote: post #13

Earlier quoted context omitted.

You should look again: https://slack.com/security

OK: Slack is not currently a PCI-certified Service Provider. I was also a bit surprised what they consider out of scope for their bug bounty program: https://hackerone.com/slack

I can't begin to fathom a use case for slack where you would put card data in the system...

Re: Ask HN: If your company cares about security, why does it use Slack?

#40

Post by falcolas »

oneplane wrote: post #20
falcolas wrote: post #7

Earlier quoted context omitted.

Corollary question: Why do you assume that Slack's security expertise and security budget is greater than your own? All we can do is assume that Slack cares about security enough to be sufficient. Last I checked, they didn't have any form of compliance certification, yet HIPPA, PCI, etc. compliant clients use them without reservation.

HIPPA, PCI, etc. compliancy doesn't actually mean you are secure, it just means you are compliant. Take ransomware attacks for example, most of the bigger companies that get hit and have no working plan to continue their business are compliant to all sorts of things, hell complete governments are in that category... Compliancy only tells a story about management and how many MBA's you have, it doesn't actually mean y…

You're correct - it doesn't mean you're secure. It does, however, point out that you're putting some thought and effort into security. PCI requires remediation plans or justifications to pass, as does HIPPA.

And, for better or worse, you need your service providers, including chat, to be compliant. If your company were to leak PII via Slack, your company would be in pretty hot water for putting PII on a non-certified service provider.

At least if it were certified, you could say "we've done our due diligence to protect people's PII". Perhaps only important to leadership and lawyers, but still important.

Post reply on HN