STATE OF VERMONT

DEPARTMENT OF PUBLIC SAFETY

VERMONT STATE POLICE

 

Vermont State Police offers recommendations for Zoom meeting security

Suggestions can help improve scheduled Zoom meeting security, prevent disruptive behavior

 

WATERBURY, Vt. (Monday, Nov. 23, 2020) — Ahead of a Thanksgiving when many people will be gathering around the table virtually instead of in person, the Vermont State Police is offering recommendations to help Vermonters set up secure, uninterrupted Zoom meetings.

 

A plethora of settings are available to users when setting up a meeting to reduce the risk of “Zoombombing,” and the following suggestions are not inclusive of all but represent best practices to reduce unwanted or disruptive behavior. These tips can apply to many potential uses of Zoom, from family gatherings to business meetings or public forums.

 

Zoom.us provides its own Security White Paper, available here, last published date October 2020, that can be downloaded and easily referred. The white paper provides several relevant security features of Zoom along with a list of capabilities that meeting hosts have available.

 

When scheduling a meeting, consider these Meeting Options:

• Meeting Password – Meetings requiring a password provide an added layer of security as participants will have to enter a value to access the meeting. It is not recommended that passwords be publicly posted or provided in direct relation to the meeting information, such as on a bulletin board. The password should be shared only with trusted and validated people. For public-forum-style meetings, organizations can ask that participants request the password, which then would be provided separately from the meeting information. When the meeting information and password are shared simultaneously, individuals with malicious intent have increased accessibility, lowering the security of the meeting. Send the meeting information and password in separate emails or letters.

• Disable Join Before Host – This will prevent participants from joining the meeting prior to the host. By requiring a host to be present before participants can join, additional security measures (such as the waiting room) can be then be implemented.

• Use a Waiting Room – The waiting room feature allows the host to control which participants can join a meeting and when. With this feature enabled, participants will remain in the waiting room until admitted to the meeting by a host. While an option to admit all participants from the waiting room exists, this is not recommended unless the host has validated all participants. Zoom also provides hosts with the capability to send participants to the waiting room during a meeting, which would allow for dispelling a disruptive participant quickly without terminating the meeting.

• Allow Only Authenticated Users – This requires participants to be signed into Zoom in order to join a meeting. While this can be problematic for public-forum-style meetings, by requiring participants to be signed in, Zoom's safety team and law enforcement can take quicker action identifying problem participants.

• Automatically Record the Meeting – Besides the benefits to the organization of having a recording of the meeting, if a disruptive event occurs, the recording can be provided to Zoom's safety team and law enforcement for their investigative reviews of the incident. 

 

Once a meeting is underway, Zoom provides additional security options to hosts and co-hosts, found under the security icon in the menu. Note, organizations should familiarize themselves with these options as an administrator can disable a host's or co-host's ability to use them.

• Sharing Screen – By deselecting, participants will not be allowed to share their screens, reducing unwanted images.

• Chat – By deselecting, participants will not be allowed to chat in the chat function, reducing unwanted verbiage.

• Rename Themselves – By deselecting, participants will not be allowed to rename themselves, which provides hosts and co-hosts a level of participant validation.

 

Depending on the nature of the meeting, additional options can be implemented for further security:

• Lock the Meeting – When a meeting is locked, new participants are not allowed to join the meeting.

• Mute Participants– Different options exist for muting participants, which would reduce the ability of a malicious person to broadcast unwanted language. At a minimum, participants can be muted upon entry into the room. From there, meeting settings can allow or prohibit participants from unmuting themselves. If audience participation is wanted during a meeting, organizations should consider muting participants and only allowing interaction through the chat feature. 

 

If a meeting is underway and a participant engages in disruptive behavior, hosts and co-hosts have the ability to immediately Remove and Report a participant. Both can be done through the security icon in the menu.

 

During these unprecedented times, the Vermont State Police remains committed to protecting Vermonters’ security, which includes reducing their virtual vulnerability. Implementing these small strategies will help Vermont organizations and residents continue their open exchange of ideas and productivity without exposure to disorderly behavior.

 

 

MEDIA CONTACT

Sgt. Aimee Nolan will be available for interviews Tuesday, Nov. 24, and Wednesday, Nov. 25. Please send interview requests to Public Information Officer Adam Silverman at adam.silverman@vermont.gov.

 

- 30 -