Friday, April 10, 2020

Prioritizing Security When Selecting A Video Conferencing Solution...

Originally posted at the EMA blog site. You can find it here.

Before the recent CoVID -19 pandemic, most companies have looked at unified communications and collaborations (UC&C) solutions as a “nice to have” technology, often used by sales and marketing teams as part of their process and certainly not a critical part of the business infrastructure. With Work From Home (WFH) becoming the mandated norm, businesses have come to look at their UC&C solution as a mission critical tool, allowing managers and leaders to communicate with their employees, and allowing employees to try to conduct some semblance of normal business.

All things being equal, businesses would do well to use or augment their existing infrastructure for video conferencing. Those licenses have likely been purchased, and it makes sense to continue to use products that people are already trained to use.

But things are not equal.

In the past weeks since the pandemic has spread, and the various states have mandated stay at home orders, there have been plenty of news reports demonstrating that not all of the UC&C solutions are created the same. Which isn’t to say that some of the solutions are “bad”, but I believe it is fair to say that some have differing priorities when it comes to what is most important in their software lifecycle.

For businesses and enterprises looking for a unified communications and collaboration solution, security should be the starting point in which enterprise and productivity applications are built upon.  For complete transparency – these are the criteria I have personally used in my previous IT and security roles before becoming a security researcher.

Functionality / Features

This may be the most obviously important factor, but it is also the “table stakes” criteria. The solution needs to be able to connect and host video conferences, without failures, latency, and delays (this was a significant problem for many, if not most, of the providers immediately after the WFH and virtual classes began). Call recording, screen share and recorded chat are all necessary, as are presenter controls and dial-in options. From there, the sky is the limit, though virtual lobbies, third party integrations (with Outlook and video systems) and virtual whiteboards are differentiators.

Usability / Interface

A good video conferencing solution must be easy to use on pretty much any device. The interface should be intuitive, and a client should be available for any / every platform. Most of the solutions will claim they can be used on every kind of device through their web portal. This is likely true, but most solutions require a client to take advantage of all of the solution features, and there may be security concerns with a web-based or web-only solution.

Cost

There are generally two types of pricing: free and licensed cost. The licensed solutions run the gambit in pricing, based on number of meeting participants, geographic scope (paying for international dial-in numbers), length of meetings and number of enterprise users. Many of the licensed solutions offer a free or trial, with limited functions, participants, meeting length and very little in the way of support. 

Security

Last on this list is the security of the UC&C solution. Security is the foremost consideration in choosing a UC&C solution, after moving past the standard feature checklist (in which the top solutions nearly all have in common).

Finding a UC&C solution that protects your employees and enterprise is the best way to narrow down the list:

- Secured Out of the Box: Many of the UC&C solutions on the market concentrate on the user experience and interface at the expense of security. And when they “discover” security as a priority, it comes from bolt on fixes and patches, requiring updates and procedural changes. Look for a solution that has a track record as a security leader in the industry, with a platform of millions of secured installs and a commitment to focus on security first.

- Support is Critical: Many of the UC&C solutions provide little in the way of support, and the free solutions generally providing none.  An enterprise ready UC&C solution should have proven and dedicated support, able to respond to requests. When considering the mission critical nature that the UC&C solutions have become, examine the company’s ability to respond to vulnerabilities and response times to resolve their security gaps. 

- Addressing Data Privacy: How is the data transmitted and communicated within a session stored, maintained, and used? Are the chats kept private? Is the information encrypted when stored? Is the session encrypted? Can anyone just “boom” an open session? As information technology professionals, we are all aware of the necessity of maintaining data security and data privacy, and many enterprises have engaged in data privacy projects and campaigns before the pandemic outbreak. Enterprises cannot abandon their data privacy efforts because of the pandemic, and must ensure that their UC&C solution is aligned to their data privacy goals.

- Newer is NOT Better: There are plenty of UC&C solutions on the market today, but some are literally in their infancy as far as install base and working out the bugs, while several have been the leaders in the industry – in some cases before there WAS an industry. Those solution that have an established track record of success and stability are always worth considering when making an investment in mission critical infrastructure. Plus, it gives comfort to management and executives knowing that they are selecting a proven solution.

Never has there been a time when a Unified Communications and Collaboration solution has been so critical to the success of the enterprise. Understandably, there is an immediate need to select and deploy this type of solution to meet the business need and for companies to keep their doors open during this crisis. But IT and security managers would do well to choose their UC&C solution carefully, focusing on the security that the solution provides instead of the shiny bells and whistles.