Is Signal secure enough for business communications?

Signal's encryption protocol (the Signal Protocol) is technically strong and widely regarded as among the best available for end-to-end encryption of messages and calls. However, 'secure enough' depends on the threat model. For most organisations protecting against opportunistic interception or criminal actors, Signal is appropriate. For organisations in environments where nation-state adversaries with significant technical capability are the threat, endpoint security (securing the devices themselves from compromise) matters as much as the encryption protocol — and Signal is only as secure as the device it runs on.

What is a TSCM-cleared meeting room?

A meeting room that has been swept by a TSCM specialist and confirmed free of covert surveillance devices at the time of the sweep. 'Cleared' is not a permanent status — a room can be clean after a sweep and compromised the next day if an adversary gains access. For ongoing high-security operations, meeting rooms used for the most sensitive discussions should be swept immediately before use, with access-control protocols preventing unauthorised entry in the interim.

How is a secure communications network designed for a corporate environment?

A secure corporate communications network typically involves: network segmentation isolating sensitive communications infrastructure from general corporate traffic; encrypted VoIP for voice calls; enterprise encrypted messaging for written communications; strict device-management policy limiting which devices can connect to the secure segments; and physical security of the network infrastructure including access control to server rooms and regular TSCM sweeps of network hardware. The design should be driven by a threat assessment that identifies what the organisation is protecting against.

How to Secure Office Communications — Practical Guide

The two layers of communications security

Technology can encrypt your messages and calls. It cannot stop a participant from discussing sensitive matters on an unsecured personal device, taking notes in an unsecured location, or conducting a sensitive call with an open window in a café. Effective communications security requires discipline as well as technology — and discipline is harder to deploy and maintain.

The physical layer — securing the space

TSCM sweeps of sensitive rooms

Meeting rooms, board rooms, executive offices, and legal consultation rooms should be subject to periodic TSCM sweeps to detect covert audio and video surveillance devices. A device planted in a meeting room negates all the encryption on your communications platforms. Physical security of the space where discussion occurs is the foundation of communications security.

Meeting room security protocols

Even without covert devices, meeting room discipline matters. Personal devices (phones, laptops, tablets) are RF-capable and potentially compromised. For sensitive discussions: personal device exclusion or Faraday bag storage, no external visitor devices in the room, closed doors and consideration of acoustic isolation where the room layout permits.

The technology layer

Encrypted voice

Standard mobile calls and VoIP calls are not secure for sensitive discussions. Encrypted voice solutions — which provide end-to-end encryption of voice calls — should be used for any call discussing material that would be damaging if intercepted. Enterprise solutions exist that provide encrypted voice across an organisation without requiring individual app management at the user level.

Encrypted messaging

End-to-end encrypted messaging (Signal protocol-based platforms for sensitive external communications; enterprise encrypted messaging for internal) eliminates the interception risk at the network level. Key discipline — ensuring that endpoint security (the devices themselves) matches the encryption standard — must accompany any encrypted messaging deployment.

Network segmentation

Sensitive discussions conducted over VoIP or video conferencing should run on network segments isolated from general traffic, with access controls limiting who can observe the network traffic. Rogue access points and network taps are physical threats that bypass software encryption — a TSCM sweep of network infrastructure complements network segmentation.

The behavioural layer

Need-to-know discipline — not every person in the organisation needs access to every sensitive discussion. Compartmentalise by function and necessity
Sensitive call protocols — define where sensitive calls can and cannot be made (not in public, not in shared transport, not with personal devices that may be compromised)
Information labelling — classification of sensitive information so that staff know which communications channels are appropriate for which content
Visitor management — clear protocols for what can be discussed in the presence of visitors, clients, or unvetted third parties

Mission Support provides technical communications security assessments and TSCM services as components of a comprehensive communications security programme, and can recommend encryption technology solutions appropriate to the client's operational environment and classification requirements.

How to secure your office communications — a practical guide