Sally Security Concerns - PSA

So wait, just to make sure I understand this correctly:

If say Gainsight were to have customer (not employees) from Company ABC added to their internal Slack instance, a Gainsight employee could add Sally to a channel those customers were a part of and share other customers (e.g., Company 123) data?

Does that mean that Gainsight could be exposing customer data to other customers as well? @anirbandutta even if 0 customers use Sally, seems like a potential liability for Gainsight as well no? Can we get a response from security on this?

@bradley exactly. That’s what we did in our testing, with our shared Slack Connect channel with Gainsight. 

I received no response from security on my support ticket. The TL;DR I was told by the support agent was “tell your users not to do that”. 

Copied the response below:

Hello Gunjan, 

The sally bot when it is added to any slack channel(private or public) by a user of your Gainsight Instance for whom Sally is enabled, the commands given by that user in the channel to sally bot, then the bot throws the info as the output irrespective of who are the members of that channel.

So here, we cannot restrict or constraint Sally Bot to display only specific fields into the output. Added to that, when a member of the slack channel who is not a user of your Gainsight Instance and also not have Sally enabled for him/her cannot give commands to sally bot. 

So here, it is up to the users of Amplitude's gainsight instance who have sally access to add the sally bot to a slack channel or not. So considering the above mentioned specifications of the sally bot, I suggested that this can be raised as an enhancement request mentioning that slack workspace admins can restrict or constrain the bot to display only selected fields with data when given command to bot in any channel. 

Now coming to the workaround I suggested in my video, the Amplitude's Slack workspace admin can navigate to Slack App directory and remove the Sally Bot from entire workspace, which eventually Sally Bot gets removed from all the channels of your Slack. Then you can inform your internal users to not add Sally bot in any private or sensitive channels in which Amplitude's customers are present. After informing this information internally, then again Amplitude's Slack workspace admin can re-install the Sally Bot.

It’s use it or lose it. And NO callout of this on the Knowledge Base at minimum, like a warning of how this would work with Slack Connect channels. 

Oooof this is a fabulous/awful call-out!!! 
This is an “accident” waiting to happen

Thank you for documenting this friends… I’m getting attention on this.

Hi Gunjan,

This is Ajay Agrawal (CISO of Gainsight) we acknowledge the concern you raised, it is getting investigated at this moment at highest level, we will come back with update on this in next 24 hours. I am personally monitoring the investigation.

Thank you for bringing this up

Thank you @Ajay Agrawal standing by for further updates. Please note that internally, we have discussed and will be pulling access to Sally tomorrow morning. We are in the process of alerting our security team as well.

@Ajay Agrawal Thanks for looking into this issue, just wanted to make sure you saw my comment as well.

@bradley When I looked at the original post I did see the comment by you, sorry missed to acknowledge that in my earlier post

Thank you 

Thank you for bringing this to our attention! 

This has been the behavior from the beginning of adding Sally in Slack channels and invoking intents so it’s upto the discretion of the admin on where and how they want to invoke Sally. We just discussed this on a call and found out that technically, there is no way for us to restrict information to only a subset of people in the channel because Slack does not support it. We can restrict it to only the person querying but then that beats the whole purpose of Sally. Although, I do agree that this can be called out in support documentation. I will work with our tech comm folks to get this updated. I hope this would suffice for now.

We are also going to evaluate solutions such as warning customers when they add Sally to a public channel however that will be an enhancement. Since there are other org level initiatives which have a higher priority at the moment, I will not be able to commit to when this will get prioritized. 

Thanks!

cc @Abinash @Ajay Agrawal @pallavig @jayaprakash_vunnam @anirbandutta