Secure Use of Collaboration Tools
|Overview and User Considerations||Technical Considerations||Secure Use of Collaboration Tools|
The Government of Canada’s (GC) Policy on the Acceptable Network and Device Use (PANDU) recognizes that open access to modern tools is essential to transforming the way public servants work and serve Canadians. This policy requires that public servants have open access to the Internet, including GC and external tools and services that will enhance communication and digital collaboration, and encourage the sharing of knowledge and expertise to support innovation.
Collaboration tools allow public servants to build and maintain interactive dialogue with the communities they serve. Examples include sites such as Twitter and LinkedIn; online presentation sharing tools such as Prezi or SlideShare; and real-time discussion tools such as Slack, to name a few.
From an IT Security standpoint, connections to external tools and services carry the same risks as other connections to the internet. However, departments should take into account that usage of these sites may require some form of identification of the individual and consequently, their association with an organization (e.g. a GC department or agency).
Departments should consider the following:
permanently recorded. There are no control provisions for any information once posted;
targets for malicious exploitation. These sites are inherently prone to malicious users providing links to malware content that can propagate to a department’s infrastructure;
thus the content along with associated user metadata can be monitored by non-Canadian and /or third party products, services or businesses;
Information and Privacy (ATIP). Public servants must ensure that information related to the mandate of the organisation and/or contains decisions on government activities is properly captured and managed, following information management best practices; and
accordance with the TBS Policy on Information Management. Some externally provided tools will retain your information even after you have deactivated your account