How to secure Zoom on Windows and Mobile Devices

Zoom video conferencing captured a lot of attention at the start of the COVID-19 pandemic for several reasons. First, it skyrocketed in awareness and usage for virtual meetings among businesspeople and the public due to its reputation for being user-friendly. Second, IT professionals immediately examined potential security and data exposure risks for an app and service that users were suddenly adopting en masse.

Cybercriminals, of course, could not pass up a large, growing and target-rich attack opportunity and started devoting attention to Zoom users. Zoom also been the target of Internet trolls -- Zoom meetings were freely accessible by default and the meeting ID system was easily to access. That allowed troublemakers to enter any open Zoom session and disrupt the meeting with pornographic, racist and/or other offensive content via the "share screen" option accessible to all participants. Word of the security holes traveled quickly and garnered a lot of negative media attention. Zoom responded – and continues to respond -- with a sequence of updates and longer pre-release testing. Zoom has now enabled meeting passwords and waiting rooms as default settings.

Companies are urged to take additional security measures including:

Allow only pre-designated users to share their screens
Lock meetings as soon as all registered participants have joined
Share meeting IDs only with invited participants vs. sharing the information publicly.

Securing zoom on Windows and mobile devices

IT administrators using baramundi Unified Endpoint Management also have additional options for protection against more serious security gaps:
Use the baramundi vulnerability scanner in combination with baramundi's automated update management to close known OS and app vulnerabilities on laptops and desktop PCs before they can be exploited by cybercriminals.
Create a whitelist of trusted apps for your company's mobile devices. This prevents the installation of compromised apps that use exploit kits targeting Zoom security gaps.
Securing the Zoom app for company Android and iOS mobile devices requires a few straightforward steps. Basically, you customize Zoom settings in the app and push that customized app to user devices. Users also can download and install that version on a virtual company app store that you set up using the baramundi user self-service Kiosk.

Here’s what you do:

For iOS Devices:

import the latest Zoom Cloud Meeting App into the baramundi Management Suite
http://docs.baramundi.com/helpsetid=m_software&externalid=k_dia_software_apps_add-apps&Language=de-de&Version=2019R2
create a job to distribute the Zoom app and insert the following configuration in the App Configuration field
<plist>
    <dict>
         <key>mandatory:ForceLoginWithSSO</key>
         <integer>1</integer>
         <key>mandatory:SetSSOURL</key>
         <string>YOUR-VANITY-URL-HERE</string>
         <key>MeetingReminder</key>
         <integer>1</integer>
         <key>SyncMeetingFromCalendar</key>
         <integer>0</integer>
         <key>TurnOffVideoCameraOnJoin</key>
         <integer>1</integer>
    </dict>
</plist>
(XML-Konfiguration für iOS)

Make sure to adapt the field "SetSSOURL" to your vanity (corporate) URL.
Details about the configuration can be found here.

For Android Enterprise Devices:

1. Open the Enterprise PlayStore via the baramundi Management Center and release the current Zoom Cloud Meeting App. It will then automatically be added to the apps that can be distributed.
Create a job for distributing the Zoom app and activate the "App configuration" area.

2. set the app configuration as shown in the screenshot. Note the two different areas for mandatory configurations (upper area; "mandatory") and recommended settings (lower area; "recommended").

3. Make sure to adjust the field "SetSSOURL" to your vanity URL.
More details about the Android configuration can be found at.