Conference calls and web meetings—virtual meetings—are a constant of modern work. And while many of us have become security-conscious in our online interactions, virtual meeting security is often an afterthought, at most. Who hasn’t been finishing one call when attendees of the next call start joining – because the access code is the same? In the moment it may be annoying, or even humorous, but imagine if you were discussing sensitive corporate (or personal) information. Unfortunately, if virtual meetings are not set up correctly, former coworkers, disgruntled employees, or hackers might be able to eavesdrop. Using some basic precautions can help ensure that your meetings are an opportunity to collaborate and work effectively – and not the genesis of a data breach or other embarrassing and costly security or privacy incident.
So…where to start? Most virtual meeting services have built-in security features, and many providers will give you some basic security suggestions.
Regardless of your provider, here are a few simple options for holding a secure virtual meeting:
- Follow your organization’s policies for virtual meeting security.
- Limit reuse of access codes; if you’ve used the same code for a while, you’ve probably shared it with more people than you can imagine or recall.
- If the topic is sensitive, use one-time PINs or meeting identifier codes, and consider multi-factor authentication.
- Use a “green room” or “waiting room” and don’t allow the meeting to begin until the host joins.
- Enable notification when attendees join by playing a tone or announcing names. If this is not an option, make sure the meeting host asks new attendees to identify themselves.
- If available, use a dashboard to monitor attendees – and identify all generic attendees.
- Don’t record the meeting unless it’s necessary.
- If it’s a web meeting (with video):
- Disable features you don’t need (like chat or file sharing).
- Before anyone shares their screen, remind them not to share other sensitive information during the meeting inadvertently.
This list is not all-encompassing, nor must you use every tool for every virtual meeting. Know your organization’s policies, think about the sensitivity of the topics to be discussed, factor in the logistics of the meeting, and pick the measures that make sense for each situation. Remember to trust your own judgment!
Where highly sensitive information may be shared, talk to a security professional first and take more precautions. Additional steps you should consider include:
|
NIST provides resources to assist employees while teleworking. Those resources are available here.
Jeff Greene, former vice president of global government affairs and policy at Symantec, began a new role as director of the National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) on 3 February 2020.
This article first appeared on 17 March 2020 on CYBERSECURITY INSIGHTS a NIST blog. It is re-posted here with permission from NIST.
