Over the last several years, there has been a recent increase in video teleconferencing (VTC) hijacking incidents, specifically “Zoom Bombing.” These incidents involve unwanted individuals accessing a VTC meeting, sharing inappropriate or hateful content, and engaging in other disruptive behavior. VTC hijacking incidents occurred frequently at the start of the COVID-19 pandemic, as workers unfamiliar with the platform were unaware of the proper security and privacy settings. Zoom’s popularity and wide use may make it a more common target for individuals to take advantage of weaknesses in the platform’s default security and privacy settings; however, other platforms are also targeted.

VTC cybersecurity best practices:

• Require a passcode for all meetings and securely share that passcode only with your invited guests. Once set, guests must enter the passcode in order to enter the meeting. This safeguard will prevent unauthorized individuals from joining a meeting.
• Use waiting rooms and require approval for external participants. Waiting rooms allow the meeting host to verify those attempting to gain access to the meeting. External participants are those with email addresses outside the organization’s email domain.
• Do not share your meeting IDs. These IDs are unique to individual users and could be used to determine when a meeting is currently in progress.
• Do not reuse meeting IDs or passcodes. Using new IDs and passcodes for each meeting reduces the risk of an unauthorized individual obtaining information needed to access to a VTC session.
• Send meeting links directly to individuals and do not publicly post meeting links. Publicly posting meeting links could allow unauthorized individuals to access your meeting, particularly when other security settings are not in place.
• Disable participant screen sharing or file sharing and disable or limit audio sharing. Disabling these features will prevent your meeting from being hijacked by others and prevent the sharing of inappropriate content.
• Lock meetings once everyone has joined. Locking meetings prevents unauthorized users from gaining entry while the meeting is in session.
• Avoid posting photos of your meetings. Posted photos could provide threat actors with the associated meeting ID and information on meeting participants.
• Disable the “allow removed participants to rejoin” option. If an unauthorized participant is identified and removed, disabling this option will prevent them from regaining access to the meeting using the same account.
• Where possible, do not use dial-in numbers for your meetings. Anyone with the dial-in number and meeting PIN can join the meeting, and the individual’s phone number identifier makes participant verification more difficult.
• Keep all remote learning/VTC platforms updated. Enhanced security and privacy features may be implemented.
• Enable multi-factor authentication (MFA) for all accounts that offer it. MFA will prevent account compromise resulting from an individual gaining access to or guessing a user’s password.

Additional Guidance 
Securing Zoom Meetings
Security Guide for Microsoft Teams
Webex Security and Privacy
Google Meet Security & Privacy