# MA-782.042020: MyCERT Advisory - Online Video Tele-conferencing (VTC) Application Security Guidelines

**Date:** 07 Apr 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-782.042020  
**Advisory ID:** MA-782.042020

---

**1.0 Introduction**
MyCERT received many inquiries on the safety and security aspects of video tele-conferencing (VTC) platforms such as Zoom, Microsoft Teams, Cisco Webex and several others. Ever since the Movement Control Order (MCO) was announced, many organizations and individuals shifted to VTC tools to communicate, conduct online classes and for business transactions.
Most VTC providers already enhanced their applications according to security reports as evaluated by security practitioners. It is user’s responsibility to choose a secure and safe VTC platform for web conferencing. As a precaution, MyCERT recommend the following general guidelines when using VTC.
**2.0 Security GuidelinesA. All VTC User**
1. **Use the latest version of VTC and security software**
- Only download software from its official website or official app store.
- Update regularly the software to its latest version.
- Update operating system and security software on desktop computers, mobile devices, frequently.
2. **Never share confidential information during a meeting**
- Avoid discussing any confidential information to prevent leakage.
- Enable non-recordable videos and audios, and limit file sharing.
3. **Protect VTC account and watch for suspicious account activity**
- Create a strong password for the account.
- If something is suspicious, log out from clients VTC. If you lost your computer or mobile phone, log out from all clients immediately and change your login password.
- Do not share or publish the conference ID and URL sent by the organizer
- Log out from the application when you finish the meeting.
**B. Unit hosting the Meeting**
1. **Protect meeting privacy and prevent illegal intruders**
- Share the meeting ID and website only with intended participants. Never share it on social media or public online platforms
- Create a high-intensity meeting password and send the meeting URL to participants separately
- Use the pre-registration function to monitor list of participants
- Disable "Join before Host" option to ensure the host is present before other participants join the meeting. This enables the host to identify participants in advance
- Utilize the waiting room function to monitor participants log in
- Lock the meeting immediately after all participants join the meeting
- Enable the sharing screen to "Only Host" and when necessary only, enable this function to participants
2. **Monitoring meeting**
- Use another device to log in as participant
- Monitor any inappropriate content shared by participants, remove inappropriate information and unidentified participant
- Ensure all participants to log out before the main host end the session.
3. **Ensure participants safety and privacy during video conference**
- Notify all participants in advance if recording is required
- If the recording contains sensitive information, do not save it in the cloud. Save the recording on a personal computer, with restricted access and sharing
4. **Secure your account Personal Meeting ID**
- This ID can be linked to your VTC account for personal use only
- Do not share this ID or use it in general meetings
5. **Develop security policy for web conferences**
- Organization is advised to develop security policy for employees to follow when hosting and participating in online meetings
- This policy should include VTC usage and safety guidelines
For additional references, the following websites also provide detailed guidelines on Online Video Tele-conferencing:
- <https://www.us-cert.gov/ncas/current-activity/2020/04/02/fbi-releases-guidance-defending-against-vtc-hijacking-and-zoom>
- <https://www.bleepingcomputer.com/news/software/how-to-secure-your-zoom-meetings-from-zoom-bombing-attacks/>
- <https://www.forbes.com/sites/kateoflahertyuk/2020/04/03/use-zoom-here-are-7-essential-steps-you-can-take-to-secure-it/#3757da2a7ae1>
- <https://zoom.us/security>
- <https://docs.microsoft.com/en-us/microsoftteams/security-compliance-overview>
- <https://help.webex.com/en-us/8zi8tq/Cisco-Webex-Best-Practices-for-Secure-Meetings-Hosts>
- <https://help.webex.com/en-us/v5rgi1/Cisco-Webex-Best-Practices-for-Secure-Meetings-Site-Administration>
In general, MyCERT advise all users and administrators of Online Video Tele-conferencing to follow latest security announcements by the vendor and adhere to security policies, according to best practices, to determine applicable updates.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>