Miro boosts security for its visual collaboration app

Miro has unveiled a set of security tools designed to help businesses protect sensitive data shared on its digital whiteboard application. The new Miro Enterprise Guard includes features to automate detection and classification of sensitive data, manage content for legal audits, and provide IT admins with greater control over encryption.

Visual collaboration is one of the fastest-growing areas of the wider collaboration software market, according to IDC. Digital whiteboard apps provide a shared canvas for coworkers to brainstorm ideas and plan projects, with Miro competing against the likes of Mural, Figma, Microsoft and others.

As with any form of collaboration software, there’s a risk that sensitive content shared in a virtual whiteboard can leak outside of the company. This could include credit card data, social security details, protected health information, or anything else that a business would like (or is compelled by regulators) to protect.

While data governance requirements often involve training for employees, technical controls are important, too, said Mark Strande, Miro’s chief information security officer. “There is always the risk that employees forget their security awareness training and put some information [into a board] that they’re not supposed to, or do it by mistake,” he said.

“You have to have protective measures to prevent you from actually putting [sensitive data] in the wrong place.”

Miro’s Enterprise Guard — available to customers on Enterprise license plans for an “add-on” percentage fee, a spokesperson said — has several components.

Miro

One aspect is the ability to find, classify and secure sensitive content. This includes the ability to automatically label Miro “boards” based on any sensitive data they contain. Based on this classification, “intelligent” security guardrails can then restrict what users can do with a board.

Admins can access a dashboard that provides an overview of all Miro boards that contain sensitive content within their organization, with details of each board’s classification.

This lets designated IT admins “browse and see what type of data is on all of the boards without really reading the information itself,” said Strande. “So administrators can [check]: are the rules correctly adhered to in our organization correctly?”

Second, there are tools to manage the lifecycle of content at scale. This includes the ability to retain and delete Miro boards with a full audit trail, with control over permanent deletion and restoration.

Third, legal discovery and preservation tools include features such as the ability to export boards to PDF with full edit history.

Finally, enterprise key management lets businesses encrypt content “at rest.”

As with all security applications, the challenge for Miro’s Enterprise Guard is to ensure it can “protect the business while not getting in the way of work,” said Wayne Kurtzman, IDC’s vice president of social, community and collaboration.

“Security is the single biggest pain point when selecting enterprise software,” he said. “Miro took this challenge and centralized the process in a way that creates flexibility, while keeping it in the price range of more customers.”

Miro’s approach to enterprise security differs from other vendors, said Kurtzman, applying guardrails both to content generated within Miro and integrated third-party apps. “This includes some popular security applications, improving enterprise flexibility,” said Kurtzman. “Growing this security offering, in my view, will serve Miro well.”