Article published on May 25, 2020, by LeMagIT about the French or open source options for the choice of a secure videoconference, and more precisely the Jamespot solution which relied on SATELLIZ for the Jitsi framework integration on the 3DS Outscale Cloud.
---
The application from the French publisher Jamespot is a videoconferencing alternative powered by the open source Jitsi framework (which is based on WebRTC) and by the ultra-secure infrastructure of Outscale (the SaaS of Dassault Systems).
Jamespot is a French specialist in corporate social networks, competitor of yammer and other Workplace (Facebook). It also offer a "Digital Workplace" solution, a portal that centralizes and manages the applications available to the employees of a company.
Unlike fully "stand alone" applications, its videoconferencing is accessible from this Workplace. It targets organizations looking to hold highly secure meetings, a segment that its "Vault" offer is already targeting.
The target: essential operators, public sector and critical companies.
« [The only videoconference] is possible, but it is in this perspective of Digital Workplace, that means encapsulated in Jamespot - which remains the master solution (for the meta-administration of users) », confirms Alain Garnier, CEO of Jamespot.
In this specific case, the portal will then display only one app (the video one). "Usually our clients have several. But the Physicians Order, for example, uses Jamespot to support internal requests. They only have this support app".
Jamespot had planned to launch its secure videoconference in the second half of 2020. Context requires, it has been available since early May.
Alain Garnier explains to MagIT that this project was born from a double observation: Jitsi has reached maturity and the need of French users is there ("including at the highest levels of certain public bodies").
By users, the CE means essential operators, the public sector, but also mid-sized companies and SMEs in critical sectors needing strong security and ensuring the confidentiality of their exchanges.
Jitsi, the open source Zoom-killer
The application is based on the Jitsi framework (of Alsatian origin which relies among others on NGINX, Prosody and WebRTC). "Jitsi is open source. This was fundamental because it allows you to always keep control over the code" explains Frédéric Jaffrès, co-founder of SATELLIZ, the framework on the 3DS Outscale Cloud. The transparency is there. Possible code audits.
Jamespot also performs to internal and external audits audits with a trusted third-party, BSSI, certified by ANSSI.
The other key point in Jitsi's choice is the dynamism of the community around the project. For Frédéric Jaffrès, "Jitsi is shaking up the market".
Up to now for example, Jitsi has handled well up to 50 or even 60 attendees. "A new version will allow many more people to be held simultaneously" says Frédéric Jaffrès.
Better, while Jitsi doesn't allow end-to-end encryption (which remains a weakness), the community is actively working on a solution for the close future. "The browsers need to improve, but the Insertable Streams feature is already in beta on Chrome and will allow it to be done" predicts the expert.
"It will be as if we had one flow encapsulated in another. The first stream is decrypted and routed by the server, but the second will remain encrypted, with the keys in the hand of the only users".
Jitsi has therefore gone from a "half-baked" alternative to a mature base. And tomorrow, the open source framework could well overtake proprietary solutions.
« We can imagine a Jitsi becoming the best of breed in video without installation. This is our bet". Alain Garnier, CEO of Jamespot
"We chose Jitsi because we can see that there is so much going on. We control what is happening and it is going on the right direction" confirms Alain Garnier of Jamespot. "We can imagine a Jitsi which becomes the best of breed video without installation. This is our bet".
The big part of the added value of Jamespot is to encapsulate Jitsi and to operate it so that the user experience is (even) more pleasant, all on a secure (read below) and well-sized infrastructure. "And here we are competitive in both functionality and price" says the CEO of the publisher.
Jitsi by Jamespot doesn't have to be ashamed either in terms of ergonomics compared to a Zoom or in terms of price compared to a Cisco - even if he doesn't name these competitors.
"There is an interest [in our solution] on sovereignty and emancipation, but there is also this reason for the portfolio", he laughs. Even if, as he himself admits, security comes at an additional cost. In particular, the choice of the Outscale cloud.
A SecNumCloud infrastructure
Jamespot video conferencing is not (yet) end-to-end encrypted. However, from a sovereignty point of view, this point is less problematic than for American solutions (or hosted on American infrastructures) which are subject to the Cloud Act and the Patriot Act.
The publisher has in fact chosen Outscale, the IaaS of Dassault Systems and the first infrastructure to be dubbed by ANSSI, which labeled it "SecNumCloud" in December 2019.
"This is a real guarantee of security for essential operators and for the State" insists Alain Garnier. The attacks on clear points being a priori more difficult on a cloud of this type.
Being on a French cloud would also resolve many issues related to GDPR and the movement of data outside of Europe.
“The chain of trust is an assembly of all the components (infrastructure, deployment, code). [On 3DS Outscale], the drives are encrypted, access [to the data center] is secure and limited to certain people” confirms David Chassan, Director of Strategy for 3DS Outscale. "For companies that have strategic activities or who want to make conferences in an extremely confidential and secure way, they now have an option on this infrastructure".
“The chain of trust is an assembly of all the components (infrastructure, deployment, code)". David Chassan, Strategy Director of 3DS Outscale
On the side of Jamespot, this SecNumCloud label from its partner allows it "to accelerate the trust processus" says Alain Garnier, that means it prevents a CISO from re-auditing the underlying infrastructure of the videoconferencing application "which would take a long time to certify that our solution corresponds to its level of security".
In the end, the requirements of the Jamespot application make it a good candidate for certification by ANSSI. But “the process is long”.
"It's in our plans, but we don't commit to a date. We have chosen to work with service providers who are approaching us of the certification ... while waiting to have the stamp one day" concludes its CEO.
Access and registration management
On the functional side, Jamespot's videoconferencing allows you to call directly within a company, by clicking on a user's "bubble" via the portal.
It is also designed to invite external people (service providers, partners, customers, etc.) into “rooms” whose IDs “are deliberately offended” and complex, “so that they cannot be found by brute force”.
Jamespot also gives the possibility to protect them with a password. "But in this case, it must be sent by another channel", remind Alain Garnier for who security is a whole.
Meeting recording, which can be a weakness in this type of solutions, is not enabled. “We took a prudential option. This recording functionality exists in Jitsi but it is not implemented in Jamespot, which prohibits replay by anyone. "
Conclusion
Jamespot offers an attractive alternative for essential operators and essential service operators as well as for organizations looking for videoconferencing sheltered from US laws. It all makes even more sense from a secure Digital Workplace perspective.
For the less critical needs, Jamespot has also entered into a partnership for several years with the Bretons of Apizee.
“They do a lot of telemedicine and we are health data host (HDS) approved, with a lot of needs around health" says Alain Garnier. "We are also working on the verticals because we believe that there is the 'everyday video' and the one adapted to each profession. From my point of view, this is the future of these tools".
Source : LeMagIT