802
edits
Changes
Jump to navigation
Jump to search
Line 43:
Line 43: − + − Employee's are encouraged to use approved software such as Zoom, Google Hangouts, and Slack to collaborate and communicate unclassified information. However there are some privacy issues that need to be recognized before using these applications. It is important to remember that these applications are not to be used for any classified work. + − Some general things to consider for increasing privacy on these applications include: + − + − + − + − + + − ===Slack===+ − When using a paid license of the application, a feature is unlocked that allows HR and management personnel to export ALL chats. Not only can group chats be exported but also chats that are between you and a colleague that is sent in a private chat. This feature cannot be enabled in the free license. It is important to note that Slack does store data regardless of the license, including after 10,000 messages in the free version. − − Slack also retains data such as links, passwords, usernames and chats, however does have options to customize policies on data retention. − ===Zoom=== − Zoom has a feature that tracks attention to the webcam in order to see who is actively in the video chat. If a presenter is sharing their screen and a user minimizes the window or leaves their device, a notification will be sent to the meeting hosts. It should be noted that Zoom does not record activity on the device nor does it capture video with this setting. − − Unless a meeting host is using Zoom's encrypted video chat option, the company could have access to the conference. − − − − ===Google Hangouts=== − While there are no glaring privacy concerns with Google Hangouts, it does require a Google account. It is best to use a work account if possible, to avoid details being linked together exposing private interests, and personal activity online when using that Google account. Details such as names, phone numbers, usernames and other information can be pieced together which can be exposed as a single entity.
Secure Remote Work Technical Considerations (view source)
Revision as of 09:56, 30 March 2020
, 09:56, 30 March 2020→Privacy
*Use CCCS/CSE [https://cyber.gc.ca/sites/default/files/publications/itsp.40.111-eng_1.pdf approved cryptography] when applicable.
*Use CCCS/CSE [https://cyber.gc.ca/sites/default/files/publications/itsp.40.111-eng_1.pdf approved cryptography] when applicable.
==Privacy==
==Home Network Hardening==
Out of the box, most routers have generic passwords, are out of date, and often contain exploits that can easily be used to intercept, manipulate and store network traffic. However, there are a number of actions that you can take to mitigate these security issues at home.
*Enable Auto-Updates on endpoint devices. Not only on laptops and smartphones but also on the router itself.
*Enabling two-factor authentication.
*Disable remote management and administrator function.
*Post/Send things that you do not mind sharing with the employer and employee's.
*Change the routers default password to something that is unique and adheres to the GC Password Guidance.
*Segregate personal applications and work applications.
*Ensure that any web-based management account for the router is also using a strong, unique password.
*Use personal devices for personal applications and work devices for work applications
*Place IoT devices on a separate router or VLAN.
*Double check which device address' are connecting to the router if possible.
For more information, check out this CyberScoop report.
For more information on using Zoom, please see the guide in the references section or [[:en:images/9/90/EN_-_Starter_guide_for_taking_part_in_a_Zoom_call.pdf|click here]].
== References ==
== References ==
