Security Notes:

• Zoom 5.0 is scheduled this weekend to provide major security and privacy upgrades (Betanews Article, 4/22/2020).
• You should be aware that Zoom is not fully encrypted end-to-end, uses weak keys, and they have ties to China; it was reportedly developed by three Chinese companies (Telecoms Article, 4/6/2020). 
• Zoom has been routing data through China (Business Insider Article, 4/6/2020). 
• Zoom accounts are being sold in the dark web (Yahoo Finance, 4/6/2020). 

Best Practices:

With so many organizations now using Zoom to keep their organizations working, we have here a short  list of best practices for education and business. 

• Check for updates daily - security updates are happening frequently
• Do not use your PMI (Personal Meeting ID) for meetings. You should "Generate Automatically" the Meeting ID.
• Require a password for the meeting (make it complicated).
• Do not post meetings publicly unless you absolutely must - see below for public meetings.
• Disable "Join before Host".
• Enable "Waiting Room".
• Don't allow others to share their screen unless you really need to. 
• If you meeting is for your organization and not public, select "Only Authenticated Users can Join". 
• When all of your expected attendees have entered the meeting lock the meeting. 
• If your meeting is going to be public, use Zoom Webinar and only allow questions that have been answered to be seen so that no one can zoombomb the meeting. This requires the moderator to watch for questions.
• With Zoom 5.0, check out the consolidated security settings and report misbehaving users to Zoom. 

Security Notes:

With more of our activities using online access for setting up and managing our academics, it is important to maintain security on banweb. 

• Adobe patches 41 vulnerabilities (SCMagazine, 3/18/2020)
• Adobe released updates to 35 critical vulnerabilities (ZDNet, 2/12/2020)

Best Practices:

With reliance on digital signatures, being aware of best practices is critical. 

• Check for updates - see above for major Adobe updates in February 2020

 

 

Security Notes:

• Federal Student Aid (FSA) posted a security alert on the Ellucian Banner systems using third-party software as front-end access points (Federal Student Aid, 8/6/2019)
• Ellucian vulnerability allowed compromise with remote access to records at 62 universities (Edscoop, 7/22/2019)

Best Practices:

With more of our activities using online access for setting up and managing our academics, it is important to maintain security on banweb. 

• If you need to log in to banweb on an untrusted machine, make sure you use a private window in the browser of choice, e.g., Brave. 
• Ensure you have a complex password. 
• Be aware of those around you so you do not make it easy for someone to shoulder surf your login and password. 
• Close the private window as soon as you are done with banweb; never leave your machine/web browser where some else might be able to access it.