How to Secure a Video Meeting From Uninvited Guests

Require a passcode or a waiting room, use a random meeting ID instead of your personal one, send the link only to invitees, and lock the meeting once everyone has arrived. Those are the core steps in advice from the US Cybersecurity and Infrastructure Security Agency (CISA, April 2020) and in Zoom's security documentation, which this post uses for the specific menu names. Other platforms offer similar controls under different names.

1. Before the meeting: control who gets in

Use a passcode or a waiting room, or both. (Zoom's passcode page adds that its meetings on free accounts already require a passcode.) CISA's video conferencing tips say that for private meetings you should require a meeting password and use features such as a waiting room to control who is admitted. Zoom's security guide lists three options that can be required for all meetings: a passcode, the waiting room, or allowing only authenticated users. Zoom adds that if none of these is enabled, it automatically secures meetings with a waiting room.

Use a random meeting ID instead of your personal one. Zoom's guide compares your Personal Meeting ID to one continuous meeting that never really ends, so people who had the link for one call can return later. A randomly generated ID for each meeting avoids that. CISA likewise recommends randomly generated meeting codes and strong passwords that are not reused.

Do not post links publicly. Both sources make this point. Zoom's guide says disruptions typically occur when meeting information is made public, and that a link posted on social media makes a meeting effectively open to anyone. CISA says not to share a link to a teleconference in an unrestricted, publicly available social media post.

Send links directly to the people invited. CISA suggests sharing the meeting link with specific people and sending the password in a separate email.

Turn off join-before-host. CISA recommends disabling the option that lets participants join before the host, and muting participants on entry, where possible.

2. How the waiting room works

Zoom's support documentation describes the waiting room as a way for the host to control when each participant joins. The host can admit people one at a time or all at once, and can let people from the same organization, or from specified email domains, skip the waiting room.

Two details from Zoom's documentation are worth knowing:

• The waiting room is off by default for instant meetings, so it has to be turned on from the Security option during the call.
• If the waiting room captures all incoming participants, join before host will not work for that meeting.

Hosts can also send someone back to the waiting room mid-meeting from the Participants list.

3. During the meeting: lock it and limit sharing

Once everyone expected has arrived, lock the meeting. Zoom's guide says a locked meeting accepts no new participants, even if they have the meeting ID and passcode. CISA gives the same advice: monitor members as they join and lock the event once all desired members are in.

Restrict screen sharing to the host for larger meetings. CISA recommends having the ability to mute all attendees and limit screen sharing for broadly attended meetings, and Zoom notes the host can restrict sharing before or during the call.

Other controls in Zoom's guide that hosts can use:

• mute participants, or mute everyone on entry;
• turn off a participant's video;
• disable in-meeting file transfer;
• turn off annotation on shared screens;
• limit private chat between participants.

4. If someone disrupts the meeting

Zoom's guide describes a "Suspend Participant Activities" option for hosts and co-hosts. It temporarily halts video, audio, in-meeting chat, annotation, screen sharing, and recording while the host removes the person. A removed participant cannot rejoin by default, and both hosts and attendees can report a user to Zoom.

CISA recommends deciding in advance, especially for large meetings:

1. under what circumstances a disrupted meeting will be ended;
2. who has the authority to make that call; and
3. how the meeting will actually be shut down.

A plan written before the meeting is much easier to follow than one invented while someone is shouting over the presenter.

5. Protect what is on your screen and in your room

Uninvited guests are not the only risk. CISA's tips also cover what you reveal yourself:

• When sharing your screen, show only what needs to be shared, and close or minimize other windows.
• Check what is visible behind you, such as whiteboards or papers, and use background blur or replacement if available.
• Move, mute, or disable smart speakers and home security cameras that could record a sensitive discussion.
• Use only video tools your organization has approved, and verify that meeting links come from senders you trust.

6. A quick pre-meeting checklist

1. New meeting ID, not your personal room.
2. Passcode on, waiting room on.
3. Link sent only to invitees, passcode sent separately for sensitive calls.
4. Screen sharing set to host only for large groups.
5. Co-host assigned, with a plan for removing someone or ending the call.
6. Lock the meeting once everyone has arrived.

7. Key takeaways

• Require a passcode or waiting room, and use a random meeting ID instead of your personal one.
• Never post meeting links publicly; send them only to invited people.
• Lock the meeting once attendees arrive, since a locked meeting rejects even people with the passcode.
• Limit screen sharing to the host for larger meetings and plan who ends the call if it is disrupted.
• Check your screen and room before sharing, and only use video tools your organization approves.