Since this video was recorded, Zoom has issued several security updates. Learn more at the Zoom Security web page and don’t forget to update to the latest version!

Zoom Security Transcript:

Hey, everybody. It’s good to see you back again. Today we’re going to talk about seven steps you can take to lock down your Zoom Security. At this point I have heard from clients everything from seeing naked people showing up in their webinars, incredibly embarrassing, bad for the brand. I’ve seen hacked Zoom accounts. I have seen whiteboards and presentations that have been shared with racial epithets, with everything terrible under the sun.

So, I thought I’d give you some ways to lock your Zoom video conference down. Here we go. I’m just going to show you right on the screen so that you can set these up either as we go or right afterwards. First of all, you’ll notice on the zoom interfaces, which I’m showing you here, that there is now a security tab. It allows you to lock your meeting, so that once you have everybody in that you want and you don’t want a Zoom bomber, somebody who comes in not wearing clothes or shares their screen, you can lock the meeting, so that nobody else can get in. Super important that you use that right there, so I’m going to lock my meeting. Nobody else at this point can get in.

Secondly, you can have a waiting room so that nobody can talk to each other until you come in. This is great for teachers or if you don’t want people discussing anything before the meeting starts before you as the controller of the meeting beginning it. This one’s super important and I’m going to show you how to set these up as your defaults in the second part here, but sharing your screen, this allows the participants to share their screen. We don’t want that on unless you really want them to share because this is how they share everything from the whiteboard where they write … What I’ve seen is is nasty racial epithets on it, or they share their PowerPoint presentation with stuff that you don’t want to see.

So, we do not want them to share the screen by default. Again, we’ll set that up in a minute, but you can turn it on and off here. You can turn chat on and off and renaming themselves. This means that if you kick somebody out, they can rename themselves and come back. So we’re going to take a look at how to change all of those things in your default settings. That’s what’s so important here. So let’s go to the default settings.

The easiest way to set up your defaults for Zoom security is when you start scheduling the meeting, you do it in that interface. So let’s say that we were going to schedule a new meeting here in our software. You bring the software up, the first thing you need to know is you want to generate a meeting ID automatically. You don’t to use your personal meeting ID because once that ID is out, once people know it, it’s on social media or whatever, anybody can join that personal meeting ID. I rarely use this feature unless it’s just for a quick meeting. You’ll also want to start requiring a password on every one of these. This is what keeps your video conference encrypted, it’s what keeps unwanted people out because they don’t have the password. So, we would go ahead and schedule that. I’m not going to do it at this point because I’m on a meeting right now.

And you’ll notice up here in the corner that there is a settings button. That’s where we want to go to set our defaults. When you do that, it brings up a bunch of choices. I’m not going to go through settings that don’t have to do with security or privacy. I’m going to just talk about the ones that have to do with privacy. So down here in the profile section, if you click on view advanced features, that will bring you up. I’m going to close that out now, that will bring you into the settings portion of your online account. And this is where we change all of the default settings. Now understand, Zoom is doing a lot of work to increase security, to have better encryption, which right now is weak and to lock down security. But until then you’re going to have to really pay attention to these default settings.

I turned my host video off from the start because I want to make sure that I know when I’m on that screen and being recorded. I turn it on when I am ready. Okay. Down here, use personal meeting ID when scheduling a meeting. Again, I turn this off by default. I do it for an instant meeting as well. I don’t like to use that generic address. Once it’s out there, anybody can Zoom bomb, they can join, just knowing that address. This is a really important one. Only authenticated users can join the meetings. There’s different ways that you can define down here what an authenticated user is. It could be somebody who has the right email address, it could be somebody based on the fact that they have a Zoom account or not. So this is an important one for security. And the same goes for joining from a web client, you want to make sure that they are an authenticated user, that they have a legitimate Zoom account, not just joining from the outside.

Right here, require a password when scheduling new meetings or instant meetings. That should be turned on by default. You will be using a password. That makes it more encrypted and that keeps unwanted users out. I also require passwords when joining by phone because it’s the same thing. You don’t want somebody calling in on a generic number and being able to disrupt your meeting. This one here, requiring cryption for third party endpoints. This is good unless you’re using YouTube to do live broadcasting. If you try and turn that on and you’re broadcasting to YouTube in a live stream, it will not work because YouTube does not work with that form of of encryption. So, if you’re not live broadcasting to Facebook or YouTube or other, you can turn that on, which improves your Zoom security.

Okay, file transfer. I turn that off unless I’m in a meeting where I’m definitely going to transfer documents because if somebody gets on that is not meant to be there, a cyber criminal or a hacker, they can transfer malware using that file transfer capability. So in general, I keep that turned off and I turn it on when I need to transfer a file. This one’s really important. Screen-sharing, who can share? I turn it on because I want to share my screen, but I also note that I’m the only one that can share the screen, not all of the participants. And then in the individual meeting or webinar, I can say, Hey, this particular user can share their screen.” I control that access. This is where Zoom bombing happens, people when screen-sharing is left open, they share photos, videos, presentations that you definitely do not want to be seeing.

So you want to control that. So you turn on screen sharing, but you turn it on for the host only. You can also disable desktop and screen sharing for users. One more tool that lets you totally lock it down. I, of course, do allow some sharing of that so I don’t completely disable it. You don’t probably want to share annotation or whiteboard or remote control of the system. You can do that again on an individual basis when you need it, but setting that as the default allows anybody that’s in your meeting or your conference to share the whiteboard or the annotating services.

This is good here, identify guest participants in the meeting. So, if you didn’t invite somebody but they’re on, they will appear in a separate participant list, so that you know that you’ve got people that you weren’t expecting there. You can either leave them on or you can cut them off.

Let’s go back up to the top real quickly and I want to show you here in the recording section as opposed to the meeting section a couple of best practices. You can give participants the permission to record locally. This is a good privacy setting. You don’t necessarily want everybody to be able to record locally, so I give that out on a very limited basis and understand anytime you record something it will be shared. So, if you’ve got a private board of directors meeting, if you’re discussing intellectual property, if you’re having a conversation or video of any time, you probably do not want that to be recorded. One other thing is I like to record on the local computer, not in the cloud. This takes away some of the ability for Zoom to be able to scan and share or advertise based on the content of your meetings.

Believe it or not, when you sign their data use policy, you are giving them the right to scan what you leave in the cloud. So, I always use a modern enough computer that I can save it right to my hard drive. And finally, the recording disclaimer, this asks participants for their consent when recording. This is a best practice. People need to know that they’re being recorded.

One last thing that I want to go through is what happens if somebody is Zoom bombing, somebody comes into your conference unwanted. I recommend always having a cohost. If you’re doing a webinar or an important meeting, somebody who can watch over, for example, the participant list. So that if somebody came up here that you didn’t want, you could simply click on them. Because I’m the cohost, you can’t do this, but you could click on more, you could have that person forced out of the meeting, to leave the meeting.

It’s a great way if somebody’s causing trouble, but it’s hard to do when you’re actually the one giving the webinar like I am right now to both monitor that, monitor the chat. That’s why I always recommend that you have a cohost along.

All right. Summary. You need to lock your meeting. You need to have passwords. Don’t use that personal meeting ID. Have it be customized for every single one and go in and change those defaults. Read through them. If you don’t understand something, Zoom walks through it on their site, they have videos on it makes it much easier to go through and customize those settings. Start by locking everything down, practice with it, and then back into your preferred settings. I just don’t want you getting out there and having a meeting on something that’s confidential in private that then gets out to to the public.

All right, thank you so much. I hope this helped out. Let me know what you want to see next time. Please like us. Pass us on. Share us. That’s how we let people know what we’re doing. Take care.