Zoom Security: Best Practices

Introduction

UWIT is seeing an increase in news of “Zoombombing” incidents both here and at other institutions where interlopers have disrupted virtual events. Below are tips for managing Zoom meeting participants and protecting your meetings from unwelcome guests. It’s up to you to decide which of these are appropriate, based on how you use Zoom.

In addition to the information provided below, UWIT offers a short self-paced Zoom Security training.

 

Procedure & Recommendations

Start by disabling “Allow participants to join before host” on your Personal Meeting Room

A good place to start is disabling the “Allow participants to join before host” option on your Personal Meeting Room. This prevents others from using your Personal Meeting ID without you. To adjust this setting, follow these steps.

  1. Log in to your Zoom web portal at http://uwyo.zoom.us.
  2. Click Settings > Meeting > In Meeting (Basic).
  3. Deselect Allow participants to join before host.

The three main ways of securing a meeting before it starts is by either enabling that only authenticated users join, enabling a wait room, or requiring a passcode for the meeting. To keep the configurations permanently, set them in the settings tab of the Zoom web portal. If you just want these settings for an individual meeting, then configure these settings when scheduling the meeting.

  • Enable only authenticated users to join*: This option ensures that only Zoom users with email addresses in the specified domains can join the meeting.

    IMPORTANT: Some at UWyo do not yet have a Zoom account, and enabling this setting will prevent them from attending your meeting. To create a UWyo Zoom account, account holders can go to http://uwyo.zoom.us and click Log In.

    When scheduling a meeting, the host can select the allowed email domains. To do this, navigate to Meeting Options, select Only authenticated users can join.

  • Enable waiting room*: A waiting room allows a host or co-host to review who is attempting to join the meeting before it starts. Participants can be admitted individually or all at once. For large meetings or classes, consider assigning the review function to a co-host. This essentially serves the same function as disabling join before the host, and gives you additional control on who is allowed to actually join the meeting.
  • Require a meeting password*: Adding a meeting password means participants can only join the meeting by entering the specified (or auto-generated) password. (Note: This provides little additional security if passwords are included in broadly shared meeting information.)  If you add a Zoom meeting to your calendar or create a Zoom meeting in your calendar using the Zoom Outlook Plug-in, note that the calendar entry may include the Zoom meeting password. If you have set up your calendar so that it is open for colleagues to view the details of your meetings, this can expose the password to anyone who views your calendar. You can protect the password by making the calendar entry private or editing the entry to remove the Zoom meeting password.

Additional security measures before a meeting starts:

  • Disable join before host*: Participants cannot join a meeting before the host joins and will see a message that says, “The meeting is waiting for the host to join.” This must be done through the Zoom web portal.
  • Automatically generated meeting ID: Selecting Generate Automatically for “Meeting ID” generates a random meeting ID instead of using your static Personal Meeting ID (PMI). This reduces the likelihood of meeting room abuse by limiting the lifetime of a given meeting ID.
    • NOTE: this should already be set as your default unless you have changed this setting.

* These settings can be configured for individual meetings or changed to become your defaults for all of the future meetings that you schedule. For instructions, go to How to Change Zoom Meeting Settings (below).

If you will be using Zoom only for class meetings and recordings, you can change your Zoom settings in the web portal to apply to all meetings and recordings. If not, be sure to change settings as you schedule a particular meeting or recurring meetings.

  • Enable only authenticated users to join*: This option ensures that only Zoom users with email addresses in the specified domains can attend your class. Students who have not claimed a Zoom account will have one automatically created by going to https://uwyo.zoom.us/ and clicking Log In.

    When scheduling a meeting, the host can select the allowed email domains. To do this, navigate to Meeting Options, select Only authenticated users can join, and choose an option based on who will attend:

    When selecting option 1 above, the host can edit the list of allowed email domains to enable guests from outside of UWyo to participate. To do this, follow these steps:

    1. Zoom users with UWyo email: Only participants with a @uywo.edu email may join (appropriate for most internal university meetings)
    2. Zoom users anywhere: Anyone with a Zoom account can join (not recommended)
    3. Click Save.
    4. Click Edit under the drop-down menu box.
    5. In the box under View/Edit domains, type an asterisk followed by the domain names you’d like to include.
    6. Separate each domain name by a comma (For example, *uwyo.edu,*csu.edu)
  • Disable “Join before host”*: Deselect Join before host when creating the meeting (or edit settings if already scheduled). This will allow students to connect ahead of time, but they will see a pop-up message that says, “The meeting is waiting for the host to join.” Students won’t be able to join the meeting until after you join.
  • Require a password when scheduling new meetings*: Turn this on. Turning this setting on will auto-generate a password for each future meeting. (Note: This provides little additional security if passwords are included in broadly shared meeting information.) If you add a Zoom meeting to your calendar or create a Zoom meeting in your calendar using the Zoom Outlook Plug-in, note that the calendar entry may include the Zoom meeting password. If you have set up your calendar so that it is open for colleagues to view the details of your meetings, this can expose the password to anyone who views your calendar. You can protect the password by making the calendar entry private or editing the entry to remove the Zoom meeting password.
    • Embed password in meeting link for one-click join*: Leave this on. If you change the password, a new meeting link will be generated and the old one becomes invalid. Note: this is how the Canvas Zoom tool links to password-protected meetings, even if you turn this setting off.
  • Assign one or more co-hosts: The instructor may want to ask a Teaching Assistant (TA), and/or a trusted student in the class to serve as a co-host. They can help mute/unmute students, help monitor the chat for questions and problems, and remove any disruptive attendees. Follow these steps to make someone a co-host:
    1. The host can right-click on a participant.
    2. select Make Co-host.
  • Mute participants upon entry*: All meeting participants will enter with their audio muted and will need to unmute themselves to speak. This can cut down on ambient noise from having many active microphones.
    1. The host can also click Participants on the bottom toolbar
    2. in the pop-up window, click Mute all (at the bottom of the Manage Participants window).
  • Disable “Play sound when participants leave or join”: If the entry and exit chimes are disruptive, the host can turn this off from the drop-down menu at the bottom of the Manage Participants window once the meeting has started.
  • Restrict screen sharing to host only*: To ensure that only the meeting host can screen share, follow these steps:
    1. Click on Host Tools.
    2. Select Advanced > Share.
    3. In the Advanced Sharing Options window, under Who can share?, click Only Host. ​
  • Adjust Recording Settings: Go to Recording Settings online at https://uwyo.zoom.us/profile/setting#tab-recording and turn the settings on or off per the requirements and recommendations.

* These settings can be configured for individual meetings or changed to become your defaults for all of the future meetings that you schedule. For instructions, go to How to Change Zoom Meeting Settings (below)

Most of the in-meeting controls are accessed by clicking on the Manage Participants button at the bottom of the main Zoom window. From the Manage Participants window, the host can lock a meeting, mute all participants, make someone a co-host, and remove an uninvited or disruptive participant.

  • ​Lock Meeting: When all attendees have arrived, the host can lock the meeting by clicking on Host Tools option (located on the bottom toolbar) > enable Lock Meeting. This will prevent new participants from joining.
  • Mute all: A host can mute all by going to Participants > clicking Mute All (at the bottom of the participant window). The host can also stop participants from unmuting themselves and ask them to use chat for questions.
  • Mute a participant: People often leave their microphones on unintentionally, broadcasting their background noise to all participants. The host can mute individual participants by right-clicking on the participant and clicking mute.
  • Stop a participant’s video: If a participant’s video is distracting or disruptive or causing them to have connection issues, the host or co-host can switch it off by right-clicking the participant and clicking stop video.
  • Override unwanted or inappropriate screen sharing: Our default screen sharing settings allow the host to override sharing when someone else is sharing. You can stop them from screen sharing by clicking the three dots next to [Participants Name]'s screen at the top of the meeting's window and clicking stop participant's sharing. 
  • Remove unwanted or disruptive participants: In the rare event that someone joins a meeting who shouldn’t be present, or if they need to be removed for another reason, the host or co-host can quickly remove a participant and prevent them from being able to rejoin by clicking on More next to their name in the Manage Participants window and selecting Remove.
  • Block annotations: When annotations are disabled, participants are prevented from using annotation tools to add information to shared screens.

From the Host control bar, use these in-meeting controls to quickly manage a disruptive or distracting participant.

  • Remove unwanted or disruptive participants: In the rare event that someone joins a meeting who shouldn’t be present, or if they need to be removed for another reason, the host or co-host can quickly remove a participant and prevent them from being able to rejoin by right-clicking on the participant and selecting Remove.
  • Override unwanted or inappropriate screen sharing: Our default screen sharing settings allow the host to override sharing when someone else is sharing. To override someone's screen sharing, the host or co-host can switch it off by right-clicking on the participant and clicking stop video.
  • Limit Chat Options: From clicking the Chat window on the bottom toolbar of Zoom, the host can disable chat, limit to host only, limit to everyone publicly or publicly and privately. This can prevent multiple private chats from occurring during a meeting. (Chat options are No one, Host only, Everyone publicly, and Everyone publicly and privately.)

UWyo has locked these settings at the account level.

  • Allow removed participants to rejoin (Disabled): As host, you have the ability to remove a participant from the meeting for inappropriate behavior, and they’ll be unable to rejoin the meeting using the same login. By default, participants who are removed cannot rejoin. If you wish to change this, go to uwyo.zoom.us > sign in to your account through SSO > Settings in the left-hand menu bar > Meeting > In Meeting (Basic) > Allow removed participants to rejoin > enable.
  • Recording disclaimer (Enabled): Participants will hear a message when they join a meeting that is being recorded and will see a pop-up message to notify them of the recording and give them the option to continue or leave the meeting. This is enabled by default.
  • File transfer (Disable): File sharing between hosts and participants via the in-meeting chat feature can be disabled, but is enabled by default. To fix this, go to uwyo.zoom.us > sign in to your account through SSO > Settings > Meeting > In Meeting (Basic) > Send files via meeting chat > disable
  • Co-Host (Enabled): Allows you to add a co-host who has the same in-meeting controls as you. Your co-host can help you manage participants and settings during meetings.

You can adjust meeting settings for a meeting while you schedule it or change settings for meetings you've already scheduled. You can also change your default meeting settings.

To adjust settings while you schedule new meetings, do one of the following:

To update settings for meetings you’ve already scheduled, follow these steps:

  1. Go to the Zoom web portal at https://uwyo.zoom.us/meeting?ref_from=waffle_my_account#/upcoming
  2. Hover over the upcoming meeting you want to select > click Edit.
  3. Update the setting you wish to change.

To change default settings for all future meetings you schedule, follow these steps:

  1. Navigate to meeting settings in the Zoom web portal at https://uwyo.zoom.us/profile
  2. Click Settings > Meeting from the left menu.
  3. Toggle to enable or disable settings as appropriate.

 

Get Help Managing Your Zoom Settings

If you have questions or need guidance on optimizing these settings, please call the UWIT Service Desk 766-4357, option 1 or contact us at support.uwyo.edu.

Was this helpful?
0 reviews
Print Article