Top videoconferencing attacks and security best practices

Videoconferencing has become a routine part of everyday life for remote workers, students, and families. Yet widespread adoption of this technology has also attracted nefarious characters whose motivations can range from simple disruption to full-out espionage. It’s important to understand these threats and how secure configuration of videoconferencing systems can improve the overall security of an organization and individual everyday users.

Common videoconferencing attacks

Making sure your videoconferencing technology is set up securely can help prevent these attacks from being successful. There are several types of attacks that can be executed through videoconferencing platforms; here are some that have been recently observed:

• Meeting bombing: In this type of attack, an uninvited guest joins a videoconferencing meeting either to listen-in on the conversation or to disrupt the meeting by sharing inappropriate media.
• Malicious links in chat: Once attackers gain access to the meeting room, they can trick participants into clicking on malicious links shared via the chat, allowing attackers to steal credentials or attempt to install malware.
• Stolen meeting links: Reusing meeting links makes it easy for attackers to use them, too.
• Host privileges transfer: In this type of attack, a participant can wait until the end of the meeting, and if the host leaves before all the attendees, the participant can become the host.

A combined effort to create best practices

The significant growth in remote working environments, combined with the very public problems that occurred with the Zoom platform earlier in 2020, prompted the Center for Internet Security (CIS) team to provide comprehensive security guidance for videoconferencing. This new guidance takes two forms:

• A CIS Benchmark for Zoom with detailed security configuration recommendations.
• The CIS Videoconferencing Security Guide describing the shared responsibilities and configuration recommendations for individuals and IT departments, regardless of which specific platform is used.

The process to create the CIS Videoconferencing Security Guide began with research to determine the common set of security best practices that apply to a wide range of videoconferencing systems. Each product may have distinguishing features, but there is typically a core set of capabilities that is common across all systems.

The CIS Benchmarks team wrote an initial draft based on this research and solicited feedback from internal CIS experts and key external CIS Benchmark Community contributors as well.

Learn more about participating in CIS Benchmarks Communities.

Secure videoconferencing configuration

The CIS Videoconferencing Security Guide provides prescriptive guidance that is applicable to a wide variety of videoconferencing systems in use today. Examples include Cisco WebEx Meetings, Microsoft Teams, Zoom, and BlueJeans.

The recommendations are mapped to the CIS Controls Implementation Group 1 (IG1) safeguards for basic cyber hygiene, and discusses the shared responsibility between individual remote workers and company IT departments.

Key areas include:

• An overview of the impact of a remote workforce on organizational security
• Prescriptive guidance for videoconferencing system configuration and use for:
• Meeting setup: Participant authentication, meeting room types, how participants join, and meeting encryption
• During a meeting: Attendee verification, participant ejection, use of video, screen sharing, and chat
• Meeting recording: Retention policy, recording protection, and more

This guide is primarily written for the individual remote worker, since to a large extent they are responsible for the security of their individual remote work environment. Of course, the company’s IT organization will be involved as well and can use this guidance to support its staff.

Many of the included security recommendations are based on best practices, but the specific recommendations an organization decides to implement will depend on its confidentiality needs and risk tolerance.

Secure your videoconferencing systems today

Download the CIS Videoconferencing Security Guide today to provide a common reference for the organization and the individual remote workers to jointly maintain the security of videoconferencing, the confidentiality of communications, and ultimately the organization’s intellectual property.