3 ms·
I'm not sure how much of a security issue there is. What's the threat model exactly? Terminated employees still having access because you don't have SSO? Sure I
by thinkharderdev 6y ago
I'm not sure how much of a security issue there is. What's the threat model exactly? Terminated employees still having access because you don't have SSO? Sure I guess but if there is security sensitive data being posted in any chat app (approved or not) then you've got major problems.
- scarface74 6y agoI logged into an old Google account I hadn’t used since 2009 and realized I still had access to some documents from a company I had worked at back then - and the documents had been updated two years ago. If I send a sensitive document in the approved chat app that uses SSO, once I quit. I don’t have access to it anymore.
- thinkharderdev 6y agoRight, that's a legitimate security concern but the point I was trying to make is that the problem is not so much people using unapproved chat apps but people putting sensitive information in chat apps at all (approved or not). These applications aren't generally designed to have the sorts of access controls required to manage sensitive information. If I post something sensitive in a public slack channel at my work (where we use Slack) then it is available to anyone in the company. I guess it is marginally worse to have it available to everyone in the company plus any former employee who wasn't removed from the slack team, but only marginally.