Device security guidance

Instant messaging is fast, convenient, and enables rich communications between collaborators. However, these communications may contain sensitive corporate or personal data. Without understanding the security of these services, it is impossible to assess the risks to your data from using them.

If users are not given formal guidance on which services to use, they may turn to insecure methods of communication, such as SMS.

Regulated industries and public sector organisations may have additional strictures to comply with, including the need to audit communications between staff, or respond to Freedom of Information requests. If data is held within IM applications that don't permit enterprise audit, you may be unable to comply.

Various features of a messaging service need to be considered before you choose a specific IM service. In particular, you should consider:

• The same things you would consider for any third-party application running on your devices. This includes assessing the reputation of the vendor, the likelihood that the application is insecure or malicious, and the impact to your organisation should it be found to be so.
• The security features provided by the IM service. This includes end-to-end encryption and enterprise single sign on. You may also want to look to see if any independent assessments have been performed on the application or protocols it uses, as well as any historic security issues there might have been.
• What data-loss prevention features do you want from an IM service, if any?
• What enterprise audit and monitoring features are offered by the service? This can improve threat detection and will be needed for business practice monitoring, as well as complying with any regulations you are required to obey.
• Is the information about your use of the messaging service exposed unnecessarily for monetisation or advertising purposes? Look for a clear privacy policy on how your information is used.
• How and where are messages stored during transit? Our Cloud security guidance can help inform your assessment.
• How does backup and recovery of messages work, if devices are lost or stolen?
• If you decide to use or enable built-in messaging services on smartphones, tablets, laptops or desktops, you should think about the implications of using built-in cloud accounts that this may require.

To choose the correct Instant Messaging service for yourself or your organisation, you should:

• Decide on which features are important to your organisation's stakeholders.
• Build a shortlist of IM services that meet your business and regulatory requirements.
• You should use the NCSC Secure Communications Principles to assess potential products.
• Conduct a security assessment of your potential Instant Messaging services, to ensure they comply with your requirements. Use the NCSC Cloud Security Principles or NCSC SaaS Guidance as well as internal reviews and third-party assessments.
• Select, test and pilot an IM service from your shortlist that meets your requirements.
• Develop an acceptable use policy for your chosen IM service, and test it with user community representatives.
• Follow NCSC guidance on deploying third-party applications securely when distributing the applications to your users. In particular, the use of enterprise application catalogues and automatic updates are recommended.

Most enterprise instant messaging products, and some consumer instant messaging products include in-depth documentation explaining how they work. Some are open source. You can use this information to help perform security assessments.

• Mobile Device Management
• Third Party Applications
• Bring Your Own Device