8 Data Security Best Practices for Private Video Conferencing

What’s under the hood of your video conferencing vendor? Chances are you may not know. There are eight key security considerations you should look for when selecting the most secure video conferencing service for your company.

1. End-to-end encrypted (E2EE) video conferencing

E2EE ensures privacy between all parties in secure video conferencing software. Encryption takes data and scrambles it so that anyone without the key to unlock the data cannot view it. In secure video conferencing, E2EE should cover every aspect of the service, from the underlying infrastructure to the security of conference rooms, cameras, and microphones (media), call setup (signaling) and any other endpoints accessed by users.

2. Data Transport Layer Security (DTLS)

DTLS adds an extra layer to secure video conferencing software. This communications protocol is designed to prevent message forgery, tampering, or eavesdropping.

3. Secure Real-Time Protocol (SRTP)

SRTP protects real-time streaming data, such as audio and video, encrypting data and authenticating messages within the video conferencing solution.

4. Camera and microphone access

Look for a provider that restricts access to camera and microphone devices. You know you have a secure video chat when the user’s web browser requires their explicit permission before it will access their microphone and camera.

5. WebSockets

This security protocol protects the telecommunication signaling channels that allow the video conference to call end-users and allow them into the chat room.

6. User meeting security controls

Secure video teleconferences allow the person conducting the meeting to apply additional security controls as an added layer beyond the security infrastructure.

7. The video conference account should also be secure

Account information should also be secured and require authentication from the end-user.

8. Look for HIPAA compliance

HIPAA is a stringent federal compliance rule that secures the protected health information (PHI) of patients. If your video conferencing solution is HIPAA-compliant, you know the service is secure.

Don’t use consumer-grade, generic video conferencing solutions.

Many of these tools do not allow an end-user the administrative controls to apply additional security to their meetings.

Don’t share your private meeting information in a public social media setting.

Most providers allow you a room or login that is exclusively yours to use. Never share this data with anyone other than your internal team. Instead, use an automated password that is unique by user and meeting. The password should not be used again after the meeting is over.

Don’t record meetings without buy-in.

If you are recording, let everyone on the call know it, even if the secure video conferencing software does this automatically.

Do make use of waiting room features.

This places participants in your video conference into a separate holding tank before the meeting. It allows you to review who is attending the meeting to be sure there are no unwelcome guests.

Do allow the host to manage screen sharing.

Some video conferencing services default to allow participants to share their screens at will. Check your admin settings to be certain you have control.

Do train your employees

on the security features of your video conferencing solution. Make sure they understand security is also their responsibility and not just the goal of the video conferencing vendor. Create a basic checklist that fits your private video conferencing company. For example:

Use a waiting room.

Turn off participants’ video until the call is initiated.

Mute participants’ audio until the call is initiated.

Allow the host to retain control of screen sharing.

Do not give out private conference room logins in public forums.

Turn off “join the meeting before the host” feature.

Allow the meeting to make a sound when people enter or leave the meeting room.

Be able to “lock” your meeting room.

Understand how you can “kick out” a participant from a meeting.

Understand how you can mute participants.

The most secure video conferencing services will have many of these features as the default so end-users can plug and play the service. However, it’s important to verify and not assume this is the case.