Prevent Zoombombing using Zoom privacy and security features

On this page:


Overview

Important:
Report instances of Zoombombing to the University Information Security Office (UISO) as described in Report an incident.

Zoom is a web collaboration tool available to all Indiana University students, faculty, and staff. Zoom provides high-quality audio and video, intuitive sharing and co-annotation tools, breakout rooms, whiteboarding tools, the ability to easily add content to meetings "on the fly", and the option to download meeting recordings as MP4 files. Standard Zoom meetings support up to 300 simultaneous participants. Licenses for large meetings (up to 500 participants) and webinars (500 or more participants) are available to faculty and staff by request from the IU Zoom administrators. For more, see About Zoom at IU and Use Zoom for large video meetings or webinars at IU.

Zoom at IU offers several features and options that can help you maintain the integrity of your Zoom meeting or webinar. Use the following tips to help prevent Zoombombing, where uninvited users enter your Zoom meeting and use the screen share feature to display inappropriate content.

Important:
  • You shouldn't record meetings that may involve critical data or FERPA protected information (for example, advising sessions or individual discussions with students regarding their education records, including grades). Meetings involving FERPA-protected student information and Protected Health Information (PHI) should not be stored on the Zoom cloud service or on Kaltura. If you have a requirement to record a meeting that will involve FERPA or critical institutional information, consult with the appropriate Data Steward on storage and retention requirements.
  • If you plan to use Zoom to host meetings that involve any type HIPAA-regulated personal health information (PHI), whether or not the meetings are recorded, you must use a Zoom Health account.

What you can do before the meeting

Before your meeting begins, consider the below options to reduce the likelihood of unwelcome or disruptive participants joining your event.

You may also wish to view Zoom: Tools for securing meetings (video tutorial).

Generate a unique meeting ID

To join a meeting, participants provide a 9- to 11-digit ID number unique to said meeting. If one of your previous meetings was compromised, a similar disruption could happen again if you use the same ID. Consider using unique IDs instead. Although they are less convenient than using a recurring meeting ID or your personal Zoom room, unique IDs make it harder for previous disruptive participants to join future meetings. If you are posting about a meeting on a public resource (for example, a departmental website), UITS recommends generating a unique ID. To do so:

  1. Log into https://zoom.iu.edu.
  2. Click Schedule a New Meeting.
  3. Provide all details for your meeting.
  4. Do not select Recurring meeting, even if your meeting is part of a series.
  5. Click Save. The page will reload, and the ID should be listed to the right of "Meeting ID".
Note:
If your meeting is part of a series, then you'll need to schedule a new meeting for each session. You cannot change an existing meeting's ID.

Require participants to register

You can configure your meeting so individuals can't attend unless they have registered. Participants register for meetings through a custom URL that Zoom generates for you. To register, participants must provide their first name, last name, and email address. Participants won't be able to join unless their name and email address matches the information they initially provided when registering.

  1. Log into https://zoom.iu.edu.
  2. Click the name of the desired meeting.
  3. Click Edit this meeting.
  4. Scroll to the "Registration" section.
  5. Check Required.
  6. Click Save. The page will then refresh.
  7. In the "Invite Attendees" section, you should see a registration URL. To copy a default invitation template message that includes the registration URL, click Copy the invitation. In the resulting window, select Copy Meeting Invitation. You can then paste the message into an email message, Canvas announcement, etc.

Require a passcode

  1. Log into https://zoom.iu.edu.
  2. Click the name of the desired meeting.
  3. Click Edit this meeting.
  4. Check Require meeting passcode. In the resulting text field, enter the desired passcode.
    Note:
    When creating meeting passcodes, keep in mind that some videoconferencing equipment can only enter numbers. If some participants might connect from videoconferencing hardware instead of a computer or mobile device, set a numerical passcode to ensure that they can connect without issue.
  5. Click Save.
  6. Share the passcode with your participants in advance by sending meeting invitations via email, Canvas announcement, etc. For more on Zoom invitations, see Inviting others for a scheduled meeting.

Require a passcode for participants joining via telephone

You can require that telephone participants supply a passcode before joining your meeting:

  1. Log into https://zoom.iu.edu.
  2. Click Settings.
  3. Scroll down to find "Require passcode for participants joining via phone", and then click the corresponding toggle button to enable this feature.
Note:
When you enable this feature, it is enabled for all of your meetings.

Require participants to be logged into a Zoom account

You can require all participants to be logged into their Zoom accounts before accessing your Zoom meeting room. While this setting does not discriminate between institutions providing Zoom accounts (that is, it does not restrict the meeting to only IU Zoom accounts), it is an additional precaution you can take to restrict access to your meeting.

For more, see Zoom: Logging in using Single Sign-on (video tutorial).

To enable this setting:

  1. Log into https://zoom.iu.edu.
  2. Click Meetings.
  3. Click Upcoming Meetings (or Personal Meeting Room).
  4. If you clicked Upcoming Meetings, select the desired meeting.
  5. Click Edit this Meeting.
  6. Check the box to the left of Only authenticated users can join.
  7. Click the drop-down and select Any authenticated Zoom user can join.
  8. Click Save.

Require participants to be logged into an IU Zoom account

You can require all participants to be logged into IU Zoom accounts.

To enable this setting:

  1. Log into https://zoom.iu.edu.
  2. Click Meetings.
  3. Click Upcoming Meetings (or Personal Meeting Room).
  4. If you clicked Upcoming Meetings, select the desired meeting.
  5. Click Edit this Meeting.
  6. Check the box to the left of Only authenticated users can join.
  7. Click the drop-down and select Only authenticated IU Zoom users can join.
  8. Click Save.

Turn off participant video upon entry

You can configure your meeting room so that every participant's video feed is disabled when first joining. However, unless you have manually disabled the user's video feed (see Stop the participant's video), these participants can enable their video feed once they've joined. To do this:

  1. Log into https://zoom.iu.edu.
  2. Click the name of the desired meeting.
  3. Click Edit this meeting.
  4. Scroll to the "Video" section. To the right of "Participant", click off.

Mute participants upon entry

You can configure your meeting room so that every participant's audio feed is disabled when first joining. However, unless you have manually disabled the user's audio feed (see Mute the participant), these participants can enable their audio feed once they've joined. To do this:

  1. Log into https://zoom.iu.edu.
  2. Click Meetings.
  3. Click the name of the desired meeting.
  4. Click Edit this meeting.
  5. Check Mute participants upon entry.
  6. Click Save.
Note:
If you are running a webinar, your participants won't be able to unmute themselves.

Enable the waiting room

If you enable the waiting room, participants won't be able to join the meeting until you admit them individually. This option works best for meetings with fewer numbers of attendees.

Enable for a single meeting

  1. Log into https://zoom.iu.edu.
  2. Click Meetings.
  3. Click the name of the desired meeting.
  4. Click Edit this meeting.
  5. Check Enable waiting room.
  6. Click Save.

Enable for all meetings

  1. Log into https://zoom.iu.edu.
  2. On the left navigation pane, under "Personal", click Settings.
  3. Click In Meeting (Advanced), and scroll down to "Waiting room".
  4. Toggle the "Waiting room" setting on. Some new options will appear under "Waiting room".
  5. To allow only IU participants to be admitted automatically without being sent to the waiting room, select Users not in your account.
  6. Click Save.
Notes:
  • Zoom Health users and regular Zoom@IU users are part of a different Zoom instance, and as such, will be treated as guest participants if attempting to join one anothers' meetings. For example, if a user from Zoom Health tries to join a Zoom@IU user's meeting, and the Zoom@IU user has the waiting room enabled with Guest participants only selected, the Zoom Health user will be sent to the waiting room.
  • If the waiting room is toggled on at the account level, all future meetings will by default have the waiting room enabled. You can turn this off for a single meeting when you create the meeting, or by editing the meeting.

Back to top

Ensure file transfers are disabled

  1. Log into https://zoom.iu.edu.
  2. Click Settings.
  3. In the "In Meeting (Basic)" section, ensure that File transfer is toggled off.

Ensure removed participants are unable to rejoin meetings

  1. Log into https://zoom.iu.edu.
  2. Click Settings.
  3. In the "In Meeting (Basic)" section, ensure that Allow removed participants to rejoin is toggled off.

What you can do during a meeting

To secure settings for a meeting that you've started, or if you need to handle a disruption (if someone has interrupted the session, for example), you have several options.

For more, see Zoom: Managing disruptions during meetings (Video tutorial).

Note:

If you're using a Windows, macOS, or Linux Zoom desktop client, you can use Zoom's Security feature in your meeting controls to quickly set some options for a meeting you've started; these include locking the meeting, enabling a waiting room, disabling screensharing, and more. For details, see In-meeting security options.

zoom icon that looks like a shield and has the word security below it

Designate a co-host

Depending on the size of your meeting, it may be difficult to both run your session and moderate your participants. One or more co-hosts can help with these responsibilities while you conduct your meeting. For details about what co-hosts can and cannot do, see Enabling and adding a co-host.

To promote a participant to co-host:

  1. In the Zoom meeting window, click Manage Participants. A tab called Participants should appear on the right.
  2. Hover over the name of the desired co-host and select More.
  3. Click Make Co-Host.

Prevent participants from screen sharing

  1. In the Zoom meeting room window, click the arrow next to "Share Screen", and then select Advanced Sharing Options.
  2. Under "Who can share?", select Only Host.

Restrict chat

Restricting chat to only the host allows the host to still be able to take questions from the audience without allowing attackers to spam offensive messages that are seen by all. To restrict chat:

  1. In the meeting controls, click Chat.
  2. At the bottom of the in-meeting Zoom group chat window, click More. Under "Participant Can Chat With:", select Host only (or No one, if you don't want participants to use the Chat feature).

For more, see Controlling and disabling in-meeting chat.

Disable and clear annotations

By default, anyone in the meeting can annotate or draw on a shared screen. Once a screenshare has started, the host can disable the ability for attendees to add annotations.

Note:
Disabling annotations will not remove annotations that the attacker made prior to the setting change. The host or co-host can use the annotation tool to clear all current annotations.

To disable annotations:

  1. Start sharing normally.
  2. In the control panel at the top of the screen, click More.
  3. Select Disable Annotation for Others.

Mute the participant

To mute a participant:

  1. In the Zoom meeting room window, click Manage Participants. A tab called Participants should appear on the right.
  2. Hover over the name of the desired participant and select More.
  3. Click Mute.

Stop the participant's video

To disable a participant's video feed:

  1. In the Zoom meeting room window, click Manage Participants. A tab called Participants should appear on the right.
  2. Hover over the name of the desired participant and select More.
  3. Click Stop Video.

Remove the participant

To remove a participant from the meeting:

  1. In the Zoom meeting room window, click Manage Participants. A tab called Participants should appear on the right.
  2. Hover over the name of the desired participant and select More.
  3. Click Remove.

Lock the meeting

Once a meeting is locked, no one else can join. To lock your meeting:

  1. In the Zoom meeting room window, click Manage Participants. A tab called Participants should appear on the right.
  2. Click More in the bottom right.
  3. Click Lock Meeting.

This is document ativ in the Knowledge Base.
Last modified on 2020-09-25 17:09:45.

Contact us

For help or to comment, email the UITS Support Center.