What UCaaS security best practices reduce data breach risk?

In Microsoft Teams, network communications are encrypted by default. TLS protects the signaling and SRTP protects the audio and video. That covers a call while it crosses the network. Other services publish their own descriptions, so read the one for the product you use.

Transport encryption has a narrow job. It stops someone on the network path from reading the traffic. It isn't the same thing as end-to-end encryption, and it doesn't describe what happens to a call once it leaves for the public phone network. We cover that boundary in whether PSTN calls can be encrypted.

Someone who signs in with a stolen password doesn't have to break any of that encryption. They reach what the account can reach, through the normal interface.

We'd start with administrator accounts, because an administrator can change settings that affect many accounts at once. We'd then extend the requirement to every user account, since a stolen password reaches whatever that account can reach.

Teams shows what a stronger requirement looks like. Its sign-in runs through Microsoft Entra ID, and Entra has a control called an authentication strength. It lets an administrator say which sign-in methods are accepted for a given resource. The built-in phishing-resistant strength accepts a FIDO2 security key, Windows Hello for Business or a platform credential, and multifactor certificate-based authentication. A password followed by a text message or a push notification satisfies ordinary multifactor authentication. It doesn't satisfy that strength.

The difference is in how the methods work. A texted code can be typed into a fake sign-in page and passed along to the real one. Microsoft describes the phishing-resistant methods as requiring an interaction between the authentication method and the sign-in surface, so there's no code for the user to hand over.

Two conditions come with this control. Authentication strengths are part of Conditional Access, which requires a Microsoft Entra ID P1 license. And the policy is evaluated after the initial authentication, so it sets a requirement for reaching the resource and doesn't change the first password prompt. It's a rule about how someone must sign in to get to the admin tools.

Other UCaaS services have their own sign-in systems, and the options depend on the product and the plan. The thing to find out is whether the admin portal can require a second factor, and which factors it accepts.

Meetings bring in people who aren't in your directory, and Teams treats them as different kinds of participant. Anonymous users join from a link without signing in to your organization. External access covers authenticated users from organizations you've chosen to trust. Guest access gives an outside person an account in your tenant, with access to teams, channel documents and chats.

These reach different things. Anonymous access is a way into a meeting, and guest access extends to a team's channels and files. So the two deserve separate decisions.

In Teams, an administrator and an organizer make these choices before a meeting starts. They decide which participant types are allowed at all, who joins directly, and who waits in the lobby. For a meeting where client details will be discussed, sending outside participants to the lobby means an organizer, co-organizer or presenter sees each name before admitting it. If you're setting this up for staff at home, how to set up UCaaS for a remote team covers the rest of the rollout.

A recording outlasts the meeting, and the rules for who can open it are separate from the rules for who could join. In Teams, Microsoft's page on recording storage and permissions says a meeting recording is saved to the organizer's OneDrive. A recording of a one-to-one or group call goes to the OneDrive of the person who selected Record. A channel meeting's recording goes to that channel's SharePoint folder. There are fallback locations as well, for example when the organizer has no OneDrive account.

Permissions follow the location. For a regular meeting, invitees inside the organization get a link automatically, and the organizer has to add external participants. For a channel meeting, access is inherited from the channel's owners and members. So a sensitive conversation recorded in a busy channel can be opened by the whole channel, including people who weren't in the meeting.

A dedicated recording service raises the same questions. Suppose a 40-person accounting firm has set up Atlantech Online's call recording service to record its client calls automatically. The service works with Microsoft Teams and cloud business phone systems. Atlantech's page lists role-based permissions, an audit trail, retention rules and legal holds, with storage in the cloud, on premises or split between them.

The firm has to decide which roles can search and play back calls, and how long a recording is kept before it's deleted. A shorter retention period leaves fewer files to expose if an account is taken over, so we'd set it as short as the firm's record-keeping duties allow. The audit trail gives the firm a record to check after something goes wrong.

A medical practice recording patient calls has further obligations before it turns recording on. We cover those in UCaaS compliance requirements for healthcare organizations.

People leave, and their accounts still hold voicemail, call history, chat and recordings. Disabling a departing employee's account on their last day is ordinary housekeeping. It's a security practice too. The former employee is no longer watching that account, so assign someone responsibility for disabling it and handling its files.

Where the phone system has its own login, separate from the company directory, give it its own line on the offboarding list. Reassign the person's number and deal with the recordings they own. In Teams, a recording saved to a user's OneDrive is handled like any other file there when the person leaves, so decide who takes those files over as part of the same step. Channel recordings stay in the channel's SharePoint folder. Ask how the service handles sessions that are already signed in when an account is disabled, so you know whether disabling it is enough.

Some settings limit what a stolen account can do. Permissions do that for data: an account whose role doesn't include playback can't open those recordings through that role. Toll fraud is a second case, and it's a loss on the bill, not exposed data. Someone gains access to an extension and runs up international calls. Atlantech's business phone service leaves international calling disabled by default for that reason, and turns it on when a customer asks. If your staff never call abroad, leaving it off limits that exposure.