CIS Slack Enterprise Benchmark

This recommendation verifies that approved email domains are configured on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check workspace settings via API:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/team.info | \
  jq '.team | {name, domain, email_domain}'

# Configure approved email domains:
# Admin > Settings > Authentication
# Approved Domains: company.com, corp.company.com
# Disable: Allow invitations by anyone

# Via API (Enterprise Grid):
curl -s -X POST -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.teams.settings.setDefaultChannels \
  -d 'team_id=T1234&channel_ids=C001,C002'

This recommendation verifies that admin accounts follow least-privilege on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List workspace admins:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/users.list | \
  jq '.members[] | select(.is_admin==true or .is_owner==true) | {name: .real_name, admin: .is_admin, owner: .is_owner}'

# Review and minimize admin accounts:
# Admin > Manage Members
# Demote unnecessary admins to regular members
# Ensure at least 2 but no more than 5 Workspace Owners

# Via API (Enterprise Grid):
curl -s -X POST -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.users.setRegular \
  -d 'team_id=T1234&user_id=U5678'

This recommendation verifies that guest account policies are configured on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check guest account settings:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/users.list | \
  jq '.members[] | select(.is_restricted==true or .is_ultra_restricted==true) | {name: .real_name, single_channel: .is_ultra_restricted}'

# Configure guest account policies:
# Admin > Settings > Permissions
# Guest Accounts: Require approval for guest invitations
# Set guest account expiration: 90 days
# Use Single-Channel Guests for external users
# Regularly audit guest accounts:
# Admin > Manage Members > Filter: Guests

This recommendation ensures that SAML SSO is configured and enforced on the Slack Enterprise team communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Slack Enterprise team communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check SSO configuration:
curl -s -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.teams.settings.info?team_id=T1234 | \
  jq '.team.settings | {sso_enabled: .sso}'

# Enable SAML SSO:
# Admin > Settings > Authentication
# SAML Single Sign-On: Enable
# SSO Provider: Configure with your IdP (Okta, Azure AD, etc.)
# SAML SSO URL: https://idp.company.com/saml/slack
# Identity Provider Issuer: urn:idp:company
# X.509 Certificate: Upload IdP certificate

# Enforce SSO (require all users):
# Admin > Settings > Authentication > Require SAML SSO

This recommendation ensures that two-factor authentication is required on the Slack Enterprise team communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Slack Enterprise team communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check 2FA enforcement:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/team.info | \
  jq '.team.prefs | {two_factor_auth_required: .require_at_least_one_email_with_domain}'

# Enforce 2FA for all members:
# Admin > Settings > Authentication
# Two-Factor Authentication: Require for all members
# Session Duration: 30 days maximum

# For Enterprise Grid:
# Org Admin > Settings > Security
# Require 2FA across all workspaces

This setting ensures that session duration is appropriately limited on the Slack Enterprise team communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Slack Enterprise team communication platform is essential for defense in depth.

# Check session duration:
curl -s -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.teams.settings.info?team_id=T1234 | \
  jq '.team.settings.session_duration'

# Configure session duration:
# Admin > Settings > Authentication
# Session Duration: Set to organizational policy (e.g., 30 days)
# Force logout: Enable forced password reset

# Via API (Enterprise Grid):
curl -s -X POST -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.teams.settings.setSessionDuration \
  -d 'team_id=T1234&session_duration=2592000'

This recommendation verifies that message retention policy is configured on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check message retention:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/team.info | \
  jq '.team.prefs | {msg_retention}'

# Configure message retention:
# Admin > Settings > Message Retention & Deletion
# Keep all messages: Or set to compliance period (e.g., 1 year)
# Allow members to delete messages: No
# Allow members to edit messages: Set time limit (5 minutes)

# Enterprise Grid data governance:
# Org Admin > Data > Retention Policies

This setting ensures that file sharing is restricted appropriately on the Slack Enterprise team communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Slack Enterprise team communication platform is essential for defense in depth.

# Check file sharing settings:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/team.info | \
  jq '.team.prefs | {file_limit}'

# Configure file sharing restrictions:
# Admin > Settings > Permissions
# File Uploads: Allow in approved channels only
# External File Sharing: Disable unless required

# For Enterprise Grid with EKM:
# Enable Slack Enterprise Key Management
# Use your own AWS KMS keys for data encryption

This recommendation ensures that app installation requires admin approval on the Slack Enterprise team communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Slack Enterprise team communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# List installed apps:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/apps.list | \
  jq '.apps[] | {name: .name, scopes: .scopes}'

# Restrict app installation:
# Admin > Settings > Permissions > Apps
# App Installation: Require admin approval
# App Directory: Restrict to approved apps only

# Review app permissions regularly:
# Admin > Manage Apps > Review installed apps
# Revoke unused or overprivileged app tokens

This recommendation verifies that webhooks are secured and reviewed on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check incoming/outgoing webhook configs:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/apps.list | \
  jq '.apps[] | select(.is_workflow_app==true or .name | test("webhook"; "i")) | {name}'

# Secure webhook integrations:
# Admin > Manage Apps > Custom Integrations
# Remove deprecated Incoming Webhooks
# Migrate to Slack API apps with granular scopes
# Rotate webhook URLs regularly
# Restrict webhook posting to specific channels

This recommendation verifies that bot tokens use minimal scopes on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check bot token scopes:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/auth.test | \
  jq '{user, team, user_id, team_id}'

# Use granular bot token scopes:
# App Management > OAuth & Permissions
# Use Bot Token Scopes (not User Token Scopes)
# Minimum scopes: chat:write, channels:read
# Avoid: admin.*, users:read.email unless required

# Rotate tokens periodically:
# App Management > OAuth & Permissions > Rotate Tokens

This setting ensures that channel creation is restricted to admins on the Slack Enterprise team communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Slack Enterprise team communication platform is essential for defense in depth.

# List public channels:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/conversations.list?types=public_channel | \
  jq '.channels[] | {name, num_members}'

# Configure channel creation permissions:
# Admin > Settings > Permissions > Channel Management
# Channel Creation: Admins only (or Admins + specific roles)
# Private Channel Creation: Allow for teams
# Channel Archiving: Admins only

# Set default posting permissions:
# Channel Settings > Posting Permissions > Specific people only

This setting ensures that Slack Connect external sharing is controlled on the Slack Enterprise team communication platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Slack Enterprise team communication platform is essential for defense in depth.

# Check external sharing (Slack Connect):
curl -s -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.teams.settings.info?team_id=T1234 | \
  jq '.team.settings | {slack_connect_allowed: .allow_shared_channels}'

# Configure Slack Connect restrictions:
# Admin > Settings > Slack Connect
# Approval Required: Yes
# Allowed Organizations: Whitelist specific orgs
# DMs with External Users: Require admin approval
# File Sharing in Connect Channels: Restrict

# Enterprise Grid:
# Org Admin > Settings > Slack Connect
# Set organization-wide policies

This recommendation verifies that information barriers are configured on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DLP settings (Ent Grid):
curl -s -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.barriers.list | \
  jq '.barriers[] | {name: .primary_usergroup.name}'

# Configure information barriers (Ent Grid):
# Org Admin > Information Barriers
# Create barriers between departments:
#   Legal <-> Sales  
#   Finance <-> Engineering

# Enable DLP integration:
# Org Admin > Security > Data Loss Prevention
# Connect: CASB provider (Netskope, Microsoft Defender)

This recommendation verifies that audit logging is enabled and monitored on the Slack Enterprise team communication platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Slack Enterprise team communication platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Export workspace data for compliance:
curl -s -H "Authorization: Bearer $SLACK_TOKEN" \
  https://slack.com/api/team.accessLogs | \
  jq '.logins[:5]'

# Enable audit logging:
# Enterprise Grid: Org Admin > Analytics > Audit Logs
# Configure Audit Logs API:
curl -s -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  'https://slack.com/api/audit.logs?action=user_login&limit=10' | \
  jq '.entries[] | {user: .entity.user.name, action: .action, date_create: .date_create}'

# Export: Admin > Settings > Import/Export Data

This recommendation ensures that device management policies are enforced on the Slack Enterprise team communication platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Slack Enterprise team communication platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check approved device policies:
curl -s -H "Authorization: Bearer $SLACK_ADMIN_TOKEN" \
  https://slack.com/api/admin.teams.settings.info?team_id=T1234 | \
  jq '.team.settings | {devices: .allowed_mobile_platforms}'

# Configure device management (Enterprise Grid):
# Org Admin > Security > Session Management
# Force app updates on mobile devices
# Require screen lock on mobile devices
# Block jailbroken/rooted devices
# Remote wipe capability: Enable

# EMM integration:
# Connect with MDM provider (Intune, JAMF)
# Enforce managed app configuration