Sign Connecticut Banking Business Letter Template Secure

Industry sign banking connecticut business letter template secure

hey everyone my name is brian fong i'm on the enterprise product marketing team here at slack and thank you for joining the session explore enterprise grade security at slack besides myself you'll be hearing from our chief security officer larkin ryder in addition aaron browning senior security engineer at slack they'll be talking about slack security posture discuss some of those recent innovations we've released and give you a sneak peek into our product roadmap and we're very very lucky to have david patton cio of investment banking and capital markets from credit suisse join us david will be sitting down with larkin for a great one-on-one interview to understand david's role at credit suisse along with how he's keeping his teams connected during the pandemic here's the obligatory legal language since we'll be discussing some road map features during today's session so with cover 19 and pandemic organizations are adopting cloud solutions faster than ever to keep their teams connected it's really truncated digital transformation from years to months and so as all these companies are now entangled in this new digital world pushing more into the cloud security is more important than ever cyber security threats are spiking right now with phishing scams and spam bad actors are really taking advantage of covert 19 to attack the remote workforces and the systems that they use so at slack we offer an enterprise grade collaboration solution to help all of you keep your teams connected to drive that productivity increase alignment and act with speed and it needs to be one that's enterprise grade secure so as you're navigating between the office or working at home you need to trust its platform like slack and as we want to learn more about security it's important to hear about the program that slack offers and that's where i'm really excited to introduce the chief security officer at slack lock and rider to tell you more thanks brian what's unique and differentiates slack is that we provide an experience users love while still meeting security and compliance requirements enterprise grade security is built into every aspect of how users collaborate and get work done in slack there are three pillars that define security at slack first compliance we meet or exceed some of the most broadly recognized security standards we offer solutions to help you address your compliance requirements our security program earns top certifications and attestations while also helping you meet specific industry regulations next operations our dedicated security team uses industry accepted best practices and frameworks keeping your data safe we use a defense in-depth risk-based security model with controls to manage the physical technical and administrative risks of our operating environment finally capabilities we understand that every company is different and we provide you with the security features for your control visibility and flexibility to be optimized for example there's no other collaboration solution that gives you the option to bring your own encryption keys we'll be talking more about slack's enterprise key management solution a bit later in the presentation let's dive into each of the three pillars in a little more detail starting first our security program maintains compliance with iso 27001 twenty seven thousand seventeen and eighteen sock two type two stock three we also align with the requirements of the cloud security alliance we help you meet specific industry regulations and international security and data privacy standards that pertain to you including finra hipra hipaa fedramp data residency and gdpr in may slack achieved a ramp agency authority to operate at the moderate impact level issued by the u.s department of veterans affairs to support this fedramp moderate authorization slack maintains compliance with over 300 rigorous security controls u.s public sector organizations now have the ability to run more of their workloads using slack's collaboration platform so what's next well we're currently gathering feedback from potential customers and performing technical scoping as we work towards achieving a fedramp high authorization and itar compliance for organizations who want to store their data at rest in countries or regions outside the u.s they now have the option to do so with our data residency capability since late last year we've launched six data regions in germany france japan australia the uk and canada our dedicated security team uses industry accepted best practices and frameworks keeping your data safe and there are some areas of that effort i want to highlight here first we use encryption at rest and in transit we employ strong cipher suites and appropriate protocols next our network security and server hardening systems are supporting testing and development activities in completely separate networks all of the servers within our production fleet are hardened according to the center for internet securities benchmarks we follow a defined secure software development life cycle this is a robust process and it leverages our own tool we've created available via open source go sdl for administrative access slack employs multi-factor authentication for access to any systems by slack employees including those in our production environment slack limits access and reviews access lists quarterly we monitor all servers and workstations continuously we retain and analyze a comprehensive view of the security state of our infrastructure storing forensic logs in a separate aws account which is accessible only to security personnel slack engages independent entities to conduct application level and infrastructure infrastructure level penetration tests at least annually now i'd like to turn it over to aaron who will cover the capabilities we offer our customers to help them keep their data protected thanks larkin protecting access to internal resources and equipment is even more critical now that many of us work from home slack has a mature mobile device management model and features so if an employee loses their phone or laptop you can log them out of slack and protect your data we also provide features that work with emm mdm and mam solutions in our mobile apps we offer native blocking of jail broken or rooted devices we also check client app versions and ensure a minimum version is in use we have long provided access management controls like two-factor authentication and domain claiming you can use single sign-on to manage access to slack and you can provision users and groups via tools like scim while you're transitioning between on-prem and virtual offices slack allows you to still host slack on our servers while maintaining full control of your data as larkin mentioned earlier we offer a feature called slack enterprise key management or ekm to help give you extra control and visibility over your data it operates on a zero trust model what that means is slack ecamm allows you to manage your own encryption keys using amazon key management services or kms what's unique about ekm and unlike any other solution in the market is it's designed to maintain all of slack's features and performance and allow administrators to gradually revoke key access enabling your teams to continue working in slack bring your own device is old news now it's all about bringing your own encryption keys while we're on the topic of protecting your data let's also talk about data loss prevention we're frequently asked in fact it's one of the most frequent customer questions we get on the security team do you support data loss prevention services or dlp services and yes we do we have an api that connects with leading dlp solutions that scan content within slack messages and files this helps prevent personally identifiable information like credit card numbers social security numbers etc from being shared within your slack workspaces i'm also excited to share the recent release of slack's integration with splunk you can now feed activity data from slack's audit logs apai directly into splunk you can easily visualize your users actions in pre-built dashboards so you don't have to go through a ton of configuration and these dashboards will showcase logins file actions apps installed permissions shared channel actions and admin actions so what if you want to collaborate with external organizations you can now use slack connect to do this you can move your conversations with partners suppliers industry peers customers and others out of email and into slack the benefits are big faster communication stronger relationships use your reactions more transparency and heightened security unlike email which leaves users open to the risk of spam and phishing when everyone works in channels teams receive messages and files only from verified members no spammers allowed with slack connect admins can maintain control over their organization's data and monitor external access what's more all of slack's enterprise grade security features and compliance standards also extend to slack connect slack's security program is committed to slack's app ecosystem which we believe can be a happy marriage between customizing slack with apps and protecting the integrity and confidentiality of your data with app permissions admins can ensure apps only request and access the minimum amount of information needed we recently released new granular tokens that make it even easier to reduce the access an app must request in our app directory each app's listings contain security and compliance information shared by the app's developer so you know which apps will meet your organization's security standards i'll now toss it back over to larkin who will give you a preview of what's on our roadmap thanks erin so let's move on and talk about what we're planning to release in the near future in the coming weeks slack will offer functionality that allows your organization to set up information barriers within slack these barriers can be configured by slack admins to prevent specific user groups from messaging or calling other groups of users within your organization in practice an investment bank could manage one group for traders in slac and another for investment bankers working in the same slack team the two groups could be configured so that they cannot communicate with each other but can still collaborate with other members of the organization this level of granular control allows admins to meet rules and regulations without blocking organization-wide collaboration we talked earlier about slack connect and we're continuing to invest here to bolster security and eliminate potential phishing scams or spam while enabling your team to collaborate efficiently with partners customers and vendors later this month we'll be allowing teams to pre-approve connections with organizations they specify once the admin has added an organization to the team's pre-approval list future shared channels may be created with that organization without the need for additional admin approval so why is this important well you may have a trusted set of partners or customers with whom you want to set up multiple channels and now you can do that quickly without the overhead of additional approvals streamlining this process allows users to move more quickly and removes extra work for your admins the bring your own device approach to workplace technology puts admins and security teams in a tricky spot employees prefer to keep personal information private and admins have an obligation to keep corporate data secure although admins don't manage an employee's personal device in every instance they need enough access to wipe sensitive data clean if say the employee's personal device is lost or stolen fortunately there are solutions later this year slack will offer support from microsoft intune mobile application management or mam both intune managed and unmanaged devices will be covered users will also be able to copy and paste data between slack and other intune managed and secured applications and now i'm very pleased to welcome our special guest david patton cio of investment banking and capital markets from credit suisse hello david hi larkin thank you for having me today sorry we can do this in person i guess i i'm sorry about that in every aspect of my life but next year we'll plan for it okay so explain to those who are not familiar with credit suisse what the company does sure so um i guess credit suisse um is a global bank we offer wealth investment banking and financial services um i'm actually part of our uh ib capital markets business is actually now through a recent re-org um called capital markets and advisory so i had technology um i'm based in new york i'm actually at connecticut at home now but but normally i'd be in the new york office and uh as i i'm sure all of us are aware new york has been doing a great job managing their situation um i'm uh i'm a little bit jealous i think california's had some challenges um all of that of course is informing the work we're doing every day the way we're working every day the fact that we're now distributed um tell me about your top priorities this year as a cio so i think um you know really um covid reshaped those priorities in march i think like for any large enterprise um you know all bank you know the kind of the things we were reacting to really started to kind of set a different track in terms of what we wanted to prioritize the rest of the year and go forward and i think arguably you know disrupted some of the traditional approaches um to the workforce um i guess the the two sort of points where we're you know now prioritizing is is really around that sort of um kind of catalyst all that movement into the cloud um as part of digital transformation then the second of course is um is collaboration itself and you know we're challenged i think like with everyone almost overnight working to a fully remote model both internally and then you know more recently trying to adapt to a new normal with um with how we operate with our clients as well so i don't necessarily think it's it's sort of um you know reshaped where we're trying to get to if anything it's just accelerated what we're seeing um as a as a kind of modern work workforce so again it's been a very very dynamic um very dynamic few months and i think um you know again with our partnership with with slack amongst other companies and we're really helping rethink what that workforce looks like and we think you know our approach to our approach to public plan yeah the acceleration of digital transformation is something i've heard from a lot of slack customers of course but security still has to be top of mind while you're making these kind of big structural changes i'm interested to know how you work with your own security team to ensure that as you're moving to more cloud services you're staying secure and compliant so i think you know whether we host kind of on-prem or um you know as part of a public cloud service that we own or a sas service you know we're still operating to the same bar whether it's data privacy um compliance and just our general kind of security posture so those levels are still there and i think um you know as we're now accelerating the use of cloud you know we're really starting to um you know look at a lot of these situations case by case you know i think what we find is that you know a lot of our cloud providers that we work with the vendors we work with um you know off uh you know relatively kind of bespoke ways of ensuring security presenting their security posture and of course depending what the services we have the relatively bespoke requirement of what we want that service to do but i think all in all um you know we are seeing kind of sort of common requests and um you know common sort of standards in security i think you know earlier you touched on things like you know bring your own key and enterprise key management i mean there are things that you know really help us um you know get confidence around the data privacy model and a security model overall yeah that's something i've heard consistently especially from financial services um the difficulty in going to the cloud is definitely supported by a bring your own key model of course that's something that that slack has offered for a while now and and i know is quite valuable to our financial services organizations um i'm curious beyond that though when you're purchasing cloud software where what are some of the top security requirements vendors need to meet you mentioned that you know you feel like you have some bespoke requirements this is uh this is your chance you know tell the vendors out there who aspire to work with you what kinds of things they need to be sure and check the box on sure um well i think that the kind of the typical range again i don't think these are going to be necessarily surprises to folks out there but you know if we look at a new sas product i mean first of all um you know that kind of level of kind of confidence around the security compliance really is the opening questions you know we have i think you know if we can't get that right um you know it really does start to challenge using the capability itself um the the challenge on top of that actually you know just from my experience having been on a few attempts over the last few years is is kind of achieving and getting to some of the security standards without actually compromising the capability itself you know it's very easy to kind of fully lock down and fully encrypt at rest and put all these you know you know large kind of control measures in place but if you're starting to compromise the capability or you're putting onerous complexity around how you would manage that and compromising security elsewhere then you're sort of losing the reason of why you look at the the agility and that in that sas product to start with i do think you know if you were to categorize the themes that that we that we call the lenses we look at this through i mean first of all data privacy um and data management is is key you know just making sure that we have security to our level and controls around the data and the um and how that data is managed and kind of who has access to it i mean that's probably you know one of the leading kind of discussions and evaluations we have the second again you you mentioned earlier in some of the slides um you know extending that if you look at the granularity of information barriers and data management within that so even within our organization how do we ensure that we're upholding um walls between you know private and public side and so on um i think you also touched on um identity as well um you know that is not just important for the security efficacy and and how we extend identity within our organization but it's also important to get it right from a convenience perspective like how does that use uh um you know when they're on the go on a mobile device you know be able to access slack quickly without putting in you know ten forms of authentication how do we know the um the factors of authentication they've got are good enough as well so i mean those are very typical things and then i think you know like we have traditionally you know lots of considerations around um you know data retention and visibility management and just the operational stability of the service itself so again i think many of these things we're seeing a lot of commonality around how they're being tackled um there's obviously nuances between that and i think even within credit suisse different departments may have different levels of data privacy requirement as well so it is that you know again as i said earlier it's very typically a case by case but i think you know as we are an industry i think we're becoming more organized around what we're asking for and what we expect from uh from a cloud-based provider yeah i loved your example of the user on the go needing to be able to access the data directly from their phone um certainly uh the whole point of having a collaboration platform is to enable the ability of your user base enable them to be more agile enable them to have a more seamless experience uh and as you're pivoting into the cloud and looking for services that provide that capability a collaboration platform like slack certainly has to be at the forefront of the ability to do that because if you can't contact your employees if your employees can't engage with each other that becomes a sincere impediment um and somewhat related to that having that collaboration platform be a focal point for how data is shared across your business having interconnected applications i'm curious how that creates security challenges for you it can be very enabling for the user but it can create security challenges for the organization or maybe it's part of the security solution sure i think it's i mean first of all i think when we look at slack or you know just just kind of thread-based channel-based communication generally it is a different paradigm to traditional email and i think where you draw the analog or the comparables in terms of security has been you know typically one of discussion but um you know the key thing for us and again this is something that you'd highlighted as well i think being able to manage and maintain and audit you know the kind of the flow of activity and correspondence within the platform and who has access to what i think you know those are really the fundamentals that that um you know for internal collaboration that are key to kind of getting um getting comfortable now i think if you look at what you know a platform like slack offers you know arguably it almost like levels up some of the control and the distribution management and some of the addresses some of the security challenges you have with with traditional email and rights management content and so on so you know i think you know when we look at slack we see a very strong opportunity to to kind of change that security paradigm or at least change that kind of control lens but but but enhance it um compared to some of the traditional tools as well yeah i couldn't agree more and i'm looking forward to how that that collaboration model and that security paradigm will eventually be able to extend beyond the walls of the organization um with some of the new features that we're offering i think people view that as complicating their security model but having a consistent security model i think really benefits teams um and bringing that channel-based communication paradigm to the relationships you have outside your organization i think you'll get all the benefits of the oversight that you were alluding to earlier and i must you know just to add i think i you know we talk about collaboration i think earlier i referenced collaboration you know i you know out of the gate in march um internal collaboration was was a was a management focusing how do we make the distance kind of model the distance working model work how do we allow our teams to better collaborate and the kind of the second order or the secondary requirement that came shortly after that was extending that into external partners and clients and so on and um you know the difference there is of course you start to see demand coming in where you know we're being asked to join into communities or conversations that are over over slack and so i think as you mentioned there's something like slack connect really does help sort of start to extrapolate that into um you know external conversation as well and you know as we know we're we're currently exploring that at credit scores also but that does present an opportunity not just as a new thing to have but a new way to kind of operate and and um converse with our external parties as well wow thank you so much for those insights david i think we um are going to have to leave it there i wish we had so much more time to talk but as you said uh hopefully next year we'll be able to do it uh face to face thank you again for your time and insights thanks for having me well thank you again larkin and david for a great q a we'll now open up the floor for any questions please use that chat box to ask anything that you haven't asked during the session and thanks again for attending this frontier session hope you found it valuable talk soon