Videoconference Security Risks: What Remote Workers Need to Know

Videoconferencing: Security Concerns vs. Privacy Concerns

There are two kinds of information at stake in video meetings: One is organizational information, and the other is the personal information of employees. When it comes to company data, the fact that high-level meetings are now done over videoconferencing raises the need for more security.

“Ninety-five percent of conference calls are not confidential,” says Henderson. “In fact, there’s probably a good portion of those that should be an email. But the remaining 5 percent, those range from mildly sensitive all the way up to board-level meetings. If somebody is there listening, that can be catastrophic for a business.” 

While those business stakes are high, so are the personal stakes. During videoconferencing, particularly during remote work, employees are giving each other glimpses of their homes and families. All that information can be ripe for hackers to grab.

“Privacy is almost a tandem track for security in many ways,” says Kulkarni. “A participant in a meeting should be able to join a meeting without having to worry about whether their private information is disclosed.”  

He says he has seen reports of people using applications integrated with Facebook, for example, leading all participants on the call to share some data with the social media giant. A frequent struggle when it comes to security is the issue of convenience: Businesses rely on employees using this technology in order to conduct business, so while it’s important to keep it secure, it’s also important to make it as easy to use as possible. 

“There’s this certain intersection of privacy and security with convenience,” says Henderson. “If you make the most secure conference system in the world, but it’s cumbersome for your sales force to use and it impacts how easily they’re able to close deals, you’re not going to have very good adoption. In fact, your users are going to pivot to their own solution to get around it, and it’s going to be far less secure.”  

MORE FROM BIZTECH: Learn about cybersecurity's increasing role in the future of work.

How Video Authentication Options Can Help Secure Your Next Meeting

Most videoconferencing platforms have measures built in to control who has access to meetings. These range from basic tools like meeting ID numbers and passwords to more intricate services like virtual waiting rooms. 

“In these waiting rooms, a conference organizer basically gets a notification,” says Henderson. “It says that somebody is in the waiting room, it gives their name and they’re given the option of bringing them in or not.” 

These tools work well for most meetings, but there will be times when an extra layer of protection is needed. For things like board meetings or high-ranking government communication, organizations may want to consider encryption. 

“You can imagine what kind of stress those meetings potentially have to endure, because a lot of interesting conversation can be learned by listening in to what the head of states are talking about,” says Kulkarni. “So, those types of meetings would require that you’re using encryption, and that the encryption is solid.”

He says it’s important to make sure the right algorithm is being used and that the right key lengths are used so it’s more difficult to break in. Those keys also have to be managed in a way that’s compliant with other regulations and policies.  “There are all kinds of things you can enable to really guide your users toward making the right choices,” says Kulkarni. 

Cultural Best Practices for Preventing Videoconference Security Risks

The tools may be available, but they’re useless if employees don’t use them. Ingraining these protections into the company culture is the best way to ensure compliance from workers.

“Your policies are only as good as they are able to be used,” says Henderson. “So, don’t lock down every call under the sun and make your conference calls unusable.” 

“Tell them, ‘Would you feel comfortable talking about this in a coffee shop? If you would, would you whisper it? Or would you speak loudly about it and comfortably about it?’ If the answer is either, ‘I wouldn’t talk about it at all,’ or, ‘I’d whisper,’ start thinking about things like using the unique meeting ID for each meeting.” 

Paying close attention when people join meetings is also important. Some workers turn off notifications that alert them when someone joins, as it can be disruptive, but Kulkarni says that’s a mistake.

“You have to make sure you’re meeting and interacting with the right people,” he says. 

One trend that could upend security efforts is employees freely sharing pictures of their meetings on social media.

“They have this tendency of, ‘Oh, I’m meeting with my great colleague, let me take a screenshot of my meeting and post it on social media,’” Kulkarni says. “Well, that screenshot also had a meeting ID. So that person is publicizing that information.”

Making many of these changes the default settings can help ensure compliance, as employees would have to go in and switch their settings themselves to take away the protection. And despite the risks, Henderson says that these systems have been very helpful for businesses.

“Right now, the conference calling systems are the best thing going,” he says. “But I think we can do it in a much more secure, measured way where we start to look at the settings and configuration and situation of conference calls to make sure that you’re taking appropriate steps to keep the information we discuss in them private.”