Privacy and Security Concerns Related to Video Conferencing

04/14/20

Ithaca College has been following developments related to the privacy and security of video conferencing, particularly with Zoom, and has taken measures to help our community use these tools safely. This message is intended to outline the concerns, to provide information on measures that Zoom and the College have put in place, and to provide guidance to help video conference organizers determine which settings support their needs, and when Microsoft Teams may be a more appropriate tool.

Concerns have largely been in three categories:

1. Zoom meetings intended for limited groups of attendees being accessed by others.
2. Unauthorized individuals sharing objectionable content during Zoom meetings.
3. Technical security vulnerabilities in the Zoom software.

Both Zoom and Ithaca College have implemented various security improvements and made changes to related settings and meeting defaults. In combination, these significantly reduce the likelihood of unauthorized activity, and we believe Zoom can be appropriate for most video conference needs at IC. Here are a few examples of recent security improvements:

• Some of the changes Ithaca College has made:
  • Since November, all IC Zoom meetings require both a meeting ID and password, greatly reducing the likelihood of meeting credentials being randomly guessed.
  • Attendees are now, by default, not able to join meetings before the host.
  • New meetings now default to having the waiting room enabled, allowing meeting organizers to control when each attendee can join.
  • We’ve provided detailed instructions for meeting organizers on how to best utilize Zoom features to keep meetings safe (see below).
• Some of the changes Zoom has made:
  • A new Security menu in the meeting toolbar allows hosts to quickly adjust common settings, including enabling or disabling the waiting room, screen sharing, and chat, and locking the meeting once all attendees have joined.
  • Fixed an issue that allowed meeting IDs to be brute-force guessed.
  • Various security and privacy issues were mitigated, including an issue with UNC links, disabling the collection of device information when users log in through Facebook, and providing options to limit file types with third-party file transfers.

Meeting organizers should consider which settings are appropriate for their meetings. Take a look at our Knowledge Base Article entitled “How To: Keep Your Zoom Meetings and Webinars Private” (https://ithaca.teamdynamix.com/TDClient/34/Portal/KB/ArticleDet?ID=825). Here are some of our recommendations from that article:

• Do not use your personal meeting ID, so each meeting will have unique credentials.
• Unless you are okay with members of the general public attending/participating in an event or activity you are promoting, do not post meeting IDs and passwords (or meeting links, which are their functional equivalents) on public sites, including Intercom or the IC Events Calendar. Instead, send them to specific attendees via email or post them within Sakai, Teams, or other locations that require a login. Another option is to post a registration link, and utilize the Zoom registration feature to manually approve attendees as they register for your meeting or event. 
• Use the waiting room feature when the number of attendees is limited to a manageable number.
• Disable chat and screen sharing when they are not needed.
• Understand how to remove unwanted attendees using the Participants tab.
• For meetings that need to be secure, consider requiring Zoom authentication.

When is Microsoft Teams a Better Choice? With the security improvements made and additional options for securely managing meetings, we believe Zoom remains a valuable tool for our community.  However, we also fully support Microsoft Teams, which has video conferencing capabilities in addition to its other features. Teams is available to all Ithaca College students, faculty, and staff. Anyone can create meetings for individuals to join.

A key feature of Teams is that meetings can be set up for specific attendees, including those with IC accounts and guests with external accounts. If someone who was not invited to the meeting gets ahold of the link and attempts to connect, they’ll be sent to the “lobby” (to await a host allowing them in), while invited attendees will be allowed in directly. While Teams is not yet integrated with Sakai in the same way that Zoom is, we’re accelerating that integration which was planned for this coming fall.

Please visit our Knowledge Base Articles for more information on hosting a Teams meeting, joining a Teams meeting, and information on Teams features and security.

Please reach out to the IT Service Desk (servicedesk@ithaca.edu, 607-274-1000, or the IT Service Desk Chat Utility) with any questions or concerns.

0 Comments

https://www.ithaca.edu/intercom/article.php/20200414140140362