B mbing Mitigations
Control
Screen Sharing
Turn it off or lock down who
can screen share in
advanced settings
Managing Participants
• Allow only signed in users to join a
meeting, forcing the user to have a
Zoom account (they are still free
to create).
• Lock the meeting, stopping anyone
else from joining, this would not stop
anyone who was already in.
• Activate a password on all meetings,
meaning that an attacker would need
to successfully brute force the Meeting
ID and a 6 digit passcode.
• Kick unknown users and they will
not be able to re-join the same meeting.
Disable recordings
Unless you wish to allow
participants to record the ZOOM
meeting, this option PRIVACY
should be disabled
TIPS
Notify of recordings
Only record the meeting if you
need to, and ensure that you
notify all participants beforehand
How to Secure Your Zoom Meetings
from Zoom-Bombing Attacks
Use password in your zoom meeting.
When creating a new Zoom meeting, Zoom
will automatically enable the "Require meeting
password" setting and assign a random 6
digit password.
Use waiting rooms. Zoom allows the host (the
one who created the meeting) to enable a
waiting room feature that prevents users from
entering the meeting without first being
admitted by the host.
Keep Zoom client updated. The latest Zoom
updates enable Meeting passwords by default
and add protection from people scanning for
meeting IDs.
• Use the “on-hold” function to pause a
participant. They will not see or hear
anything whilst on-hold.
• Disable Video for participants.
• Mute all participants, doesn’t stop
them from hearing you.
• Turn off file transfer, a wise idea to
stop any DLP loss.
• Turn off annotation, prevents any
potentially embarrassing on screen
drawings.
• Disable private chat between users.
Be aware of what’s on camera
Remove any confidential documents
that may be in view before
the meeting starts, or
consider enabling the
“Virtual background” feature
Keep microphone muted
Turn on microphone only when
you are speaking
Do not share your meeting ID. Each Zoom user is
given a permanent 'Personal Meeting ID' (PMI) that is
associated with their account. If you give your PMI to
someone else, they will always be able to check if
there is a meeting in progress and potentially join it if
a password is not configured. Instead of sharing your
PMI, create new meetings each time that you will
share with participants as necessary.
Disable participant screen sharing. To prevent
your meeting from being hijacked by others, you
should prevent participants other than the Host from
sharing their screen.
Lock meetings when everyone has joined. If
everyone has joined your meeting and you are not
inviting anyone else, you should Lock the meeting so
that nobody else can join.
Do not post pictures of your Zoom meetings. If
you take a picture of your Zoom meeting than
anyone who sees this picture will be able to see its
associated meeting ID. This can then be used
uninvited people to try and access the meeting.
Activate a
Waiting Room
The waiting room
will stop any new
users from entering
a meeting without
first being accepted
by the host.
Admin Settings
to look at:
• Require password for
participants joining via phone
• Mask phone number in the
participants list (will hide most of
the phone number)
• Show a “join from your browser”
link (allows access from a web
browser to join the meeting)
• Only authenticated users can
join meetings (participants must
have been pre-authorised)
• Sign-in methods (restrict what
services you would like to allow
e.g. Google, Facebook)
• Require a password (various
different options)
Security Settings
to look at:
• Basic password requirements
• Enhanced Password Rules
Do not post public links to your meetings.
When creating Zoom meetings, you should
never publicly post a link to your meeting.
Be on the lookout for Zoom-themed
malware. Since the Coronavirus outbreak,
there has been a rapid increase in the number
of threat actors creating malware, phishing
scams, and other attacks related to the
pandemic. This includes malware and adware
installers being created that pretend to be Zoom
client installers. To be safe, only download the
Zoom client directly from the legitimate Zoom.us
site and not from anywhere else.