Protect Your Zoom: Guidance for Securing Internal and External Virtual Meetings

It’s time to check your Zoom settings – your meetings may be vulnerable to unwelcome, even malicious guests. Pandemic-era Zoom bombing incidents, where unidentified individuals join meetings and display offensive content, are on the rise again.

Members of the campus community are encouraged to take the following steps before scheduling a meeting, familiarize themselves with Zoom settings, and if needed, make the recommended changes.

UC Davis Zoom meeting & event guidance

Step 1: Identify your audience

Not every meeting needs to be locked down, but some may benefit from extra security. Doing a quick assessment of your audience and their needs will help you determine the type of meeting and security settings.

• Internal – Within your unit or department.
• UC Davis – Users with @ucdavis.edu email. You may require registration and authentication (recommended).
• UC Campuses / Public – Users with UC emails or other domains. Consider using Zoom Webinar and require registration. (Request a Zoom Webinar license through the Service Catalog.)

Step 2: Determine what you want your participants to be able to do

• For internal or UC Davis meetings, Zoom Meeting will usually work just fine (unless you have more than 300 attendees). Zoom Meeting provides the ability to allow participants to show their video, share their screen, or unmute themselves. It also provides the Host controls to lock down meetings and remove participants, if needed (see instructions below).
• For UC Campus-wide or public meetings, we recommend not allowing users to share their video, unmute themselves or share their screen. Zoom Webinar offers the highest levels of controls. Check with the IT professional in your unit on availability of this option.

Step 3: Check your settings

The following options are controlled in Zoom Settings through the web portal. Log in to your UC Davis Zoom account at: https://ucdavis.zoom.us/. Once you make a change in your Zoom profile, it will impact all meetings you schedule going forward. Be aware that Zoom often moves settings around. If you can’t find something, try using the search bar in your Settings or searching the Zoom Support website.

Internal

Settings to turn off:

• Allow participants to join before host: Allowing participants in a session without the host can pose security risks. If you need another person to run a meeting, assign one or more hosts. 
• Use Personal Meeting ID (PMI) when scheduling a meeting: Always schedule new meetings with randomly generated meeting IDs. 

UC Davis

In addition to the settings above, we recommend doing the following to secure your Zoom Meeting.

• Make someone a Co-Host to help manage participants. Hosts and co-hosts can pause the meeting to remove and report an offending party and prevent further disruption.
• Settings to turn on:
  • Waiting Room: We recommend turning on the waiting room. This is an effective way to screen who is trying to enter your Zoom session. It can help keep unwanted guests out. 
  • Mute all participants when they join a meeting: This will automatically mute all participants when they join the meeting. The host controls whether participants can unmute themselves. 
  • Report to Zoom: This allows users to report meeting participants for inappropriate behavior to Zoom's Trust and Safety team for review. 
• Settings to turn off:
  • Participants video: When participants join, their video will be turned off, but they can change this during the meeting.
  • Screen sharing: Screen sharing permissions can be changed during a meeting if the hosts would like to give individual participants the ability to share the screen. 
  • Annotation: Like screen sharing and in-meeting chat, annotation can be a great tool when you need it, but it can also be an opportunity for mischief when you don’t. 
  • Allow removed participants to rejoin: Turning this feature off prevents unwanted guests who have been removed from rejoining your meeting. 
  • Allow users to change their name when joining a meeting: By disabling this setting, users will always use their name on profile page to join a meeting.

UC Campuses/Public