What are the risks from letting users share their own calendars?

Question

I've worked for a variety of technologies companies. In working for startups I've noticed a wide variety of opinions about whether sharing calendars is a security risk. I can imagine that it would be bad if someone learned that sales was having a meeting with Company X. But the risk would be manageable by the individual users and the same info is available through other means.

The downsides of hiding calendars are easy for me to "imagine". Hiding calendar information prevents somebody from sharing it with their spouse or other person that is considered trustable. For me, the biggest inconvenience is that I can't see all of my calendars in one place. It also means I have to go into multiple accounts to be able to update calendar events instead of doing it from one place.

• Are there other expected risks from calendar sharing?
• Are the risks from calendar sharing widely considered to be serious enough to cause the inconvenience that is inevitable?

Answer 1

But the risk would be manageable by the individual users ...

"Would be" is very different from "will be". Users are also capable of choosing strong and unique passwords but they rarely do because it is inconvenient. Similarly it is likely that users will not properly take care of the risks with sharing calendars because it is too much effort.

... and the same info is available through other means.

It is very different if some competitor has fast access to lots of sensitive information about the activity of a company in one place instead of taking the time to dig through lots of information and correlate these. And, if the information is also easily available through other means then you might be doing something wrong. Restricting access to calendars is not the only thing one should do to protect such information.

Hiding calendar information prevents somebody from sharing it with their spouse or other person that is considered trustable.

Hiding calendar information is different from hiding full calendars. It is possible to forward select entries to others. Some systems also allow to share just information about busy vs. free without sharing the details of the events.

Are the risks from calendar sharing widely considered to be serious enough to cause the inconvenience that is inevitable?

Yes. At least in larger companies it is common that full access is restricted to anybody working in the company and maybe even limit access inside the company.

Answer 2

I think one should consider what type of information can be contained in calendar entries. Just as an example, what if there is an internal meeting about a vulnerability report, where the meeting invitation includes the full detailed report of the vulnerabilities. Likewise if there is an internal finance meeting with financials attached. Etc, etc.

Now consider if an organization allowed unrestricted calendar sharing to external entities.

Here are some questions to evaluate (rhetorical in this context): What controls are in place to prevent sharing confidential information via external calendar sharing? What controls are in place to ensure authorization of external calendars to access such information? What controls are in place to authenticate the external calendars? What controls are in place to detect sharing of confidential information via external calendar sharing? What controls are in place to ensure encryption in transit (both to the external calendar - and also from the external calendar)?