Editorial · April 3, 2020
Zoom Meeting Security: Settings That Stop Intruders
Zoom meeting security comes down to five settings and a few habits, and a host can set them all in about ten minutes. Millions of people moved their work and classes onto video calls in March 2020. Some of those calls were joined by people nobody invited. This guide shows what to switch on before your next meeting.
Why this matters right now
A video call is a room with a door. If the link is public and the door is open, anyone who finds the link can walk in. Strangers who join a call can read what is on screen, listen to talk of prices and plans, and disrupt the meeting.
The company behind the service is paying attention. On April 1, 2020, Zoom's chief executive published a message to users. He said the company would pause new feature work for 90 days to focus on trust, safety and privacy. The plan included outside security reviews, a wider bug bounty program, a council of security leaders and a weekly webinar on privacy and security. Those steps will take time. Your own settings work today.
Sources: Zoom, "A Message to Our Users," April 1, 2020 (blog.zoom.us/a-message-to-our-users/).
Settings to switch on before the meeting
Zoom's own message names four protective features: waiting rooms, passwords, muting controls and limits on screen sharing. Use all four for any call that is not a public event.
- Passcode. Ask for a password on every meeting. Share it only with the people you invite. A link alone should not be enough to get in.
- Waiting room. Guests wait on a holding screen until you let them in. Admit people one at a time and check each name against your invite list.
- Screen share. Set sharing to host only. If a guest needs to present, give that person the right during the call, then take it back.
- Muting. Mute all guests when they enter. Turn off the option that lets people unmute themselves if the call is large.
- Random meeting numbers. Do not use your personal meeting ID for group calls. Create a new meeting each time so an old link stops working.
Zoom turned waiting rooms on by default for its K-12 education accounts, and limited sharing to teachers by default. That shows which settings the company sees as most useful for keeping a call under control. Other accounts can turn them on by hand.
Sources: Zoom, "A Message to Our Users," April 1, 2020.
Handle the link with care
The invite link is the key to your meeting. Treat it that way.
- Do not post a meeting link on social media, in a public group chat or on a web page.
- Send invites by email or a private message to named people.
- Send the passcode in a separate message when the meeting is sensitive.
- For a large public event, use a webinar style session where guests cannot share video or audio on their own.
If a link has already been shared widely, do not reuse it. Set up a fresh meeting with a new ID and a new passcode.
Control the room during the call
Good settings help, but a host should still watch the meeting. Open the participant list at the start and compare it with your invite list. If you see a name you do not know, ask who it is in the chat. If there is no answer, remove the person.
Once everyone you expect has arrived, lock the meeting. A locked meeting does not let new people join, even with the link and passcode. You can unlock it if a late guest turns up.
If someone does break in and shares upsetting material, stay calm. Stop all screen sharing, mute everyone, remove the person and tell your guests what happened. Then end the call and start a new meeting with a new link. Keep a note of the date and time in case you want to report the incident to your provider.
Keep the software and the data safe
Settings are only part of the job. In late March, Zoom said it had removed the Facebook software kit from its iPhone app and changed it to collect less device data. It also released fixes for two issues on Mac computers that a security researcher had raised. These fixes only help people who install them.
- Update the app on every phone and computer you use for work.
- Read the privacy settings, and read the company's privacy policy, which Zoom updated on March 29, 2020, to say it does not sell user data.
- Do not talk about passwords, bank details or private client data on a call unless you need to.
- Turn off recording unless you need it. If you record, tell your guests first and store the file where only your team can open it.
Small businesses in Vietnam use video calls to meet suppliers, staff and customers who are far away. A short checklist, used every time, will protect those calls.
Sources: Zoom, "A Message to Our Users," April 1, 2020.
A one minute checklist
Before you click "start," ask yourself these questions.
- Is there a passcode on this meeting?
- Is the waiting room on?
- Is screen sharing set to host only?
- Are guests muted when they join?
- Did I make a new meeting instead of using my personal ID?
- Was the link sent only to the people I invited?
- Will I lock the meeting once everyone is in?
If you can say yes to all seven, you have covered the main ways a call gets hijacked. Review the list each time you set up a new meeting, and share it with colleagues who also host calls.