Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the standard maintenance and issues that tend to come with any self-hosted stack but the system did work and generated few complaints. From a security perspective, having data in our control and subject to our security standards and controls seems to be a great added bonus. Who knows what kind of sensitive data is floating around in 1:1 chat histories.
The security implications of putting our chat servers, logs, etc. in the cloud with little control should terrify me as a security professional but when I step back and think about everything is transforming and I find myself more and more evaluating new tools that actually do promise the type of security I'd demand out of my own network. This has become a big part of my job-investigating the security implications from going in-house to a managed service.
This is more of a philosophical question to everyone out there who is doing security in a modern company that's trying to provide internal tools that can sometimes only be hosted in the cloud or the best option is to take it out of house. How do you weigh the benefits vs. risks of putting our potentially sensitive information out there to a third party? I have my own assessment methodologies that I've learned over the years but I'm curious what everyone out there is doing, how are you vetting our cloud infrastructure when people want to move things out of your control?