Zoom Security Protocols
Follow these guidelines to keep your meetings safe and protect student privacy
By Steve Nelson, AASB Public Information Coordinator, with contributions from Ryan Stanley, SERRC TechOps, and Sam Jordan, Alaska Staff Development Network.
Almost overnight, Zoom has become the platform of choice for many districts scrambling to deliver remote instruction to home-bound students, hold public meetings, and enable communication among school staff. Along with Zoom’s rapid adoption by educators have been concerns about the platform’s security and ability to protect student privacy.
Analysis by Alaska ed-tech organizations and district IT teams have found Zoom to be as secure as similar video conference platforms such as Google Meet, WebEx, Microsoft Teams, and others. Given this, and the fact that Zoom is FERPA compliant, it is still the preferred tool for webinars.
Protecting your virtual meeting or classroom from “zoombombing” (unwanted participants disrupting meetings with inappropriate speech and imagery) and safeguarding student privacy can be accomplished with proper setup of Zoom’s meeting controls and by observing recommended host protocols. Here are some best practice security procedures to follow for keeping your Zoom meetings and classrooms as safe as possible.
For Parents and Students
Establishing a Work-At-Home Location
Ideally, students should be positioned in a well lit, open environment where activity can be monitored, preferably not isolated in a bedroom. Be aware of what is in your camera background and do not overshare personal information. For the safety of both students and teachers, video conferencing should not be used for one-on-one communication between students and teachers.
Joining A Zoom Classroom Session
Students should only join Zoom sessions as participants, not as separate Zoom account holders. The School Subscriber’s account administrator (usually the teacher) should securely and confidentially provide meeting information, links, and passwords to students to ensure the school can maintain supervision and control over its students’ meeting experiences.
For IT Administrators
Installing Zoom on District-Issued Devices
Districts may choose to have their IT administrator install Zoom with pre-configured settings on district-issued Mac or Windows mobile devices issued to students. If you issue student devices, Zoom can be configured only to allow users to join meetings from within your school’s account. This ensures that Zoom can only be used for school-related purposes.
Configuring School Zoom Accounts
To help meetings remain secure, your IT administrator can configure the default settings for all school Zoom accounts. These protocols and settings are recommended:
- Instruct staff and teachers not to share meeting links publicly on the web or social media.
- Keep the software as up to date as possible with the latest security patches.
- Disable “Use Personal Meeting ID (PMI) when scheduling a meeting.” Instead, require each meeting to have a new unique ID.
- Enable “Require a password when scheduling new meetings.”
- Disable “Join before host” so participants cannot join a meeting before the host does.
- Enable the “Waiting room,” so when a participant attempts to join a meeting, they are automatically placed into a waiting room. The meeting host must click a button to allow the participant to join.
- Enable “Mute participants upon entry” to the meeting. Disable “Whiteboard” and “Annotation.” That way, even if an unwanted participant gains access to a meeting, they won’t be heard or be able to share.
- Disable “Allow removed participants to rejoin,” so if the host removes an unwanted participant, they cannot rejoin the meeting.
- Select “Host Only,” so that by default, only the host can share their screen.
Scheduling a Class
These protection options can help teachers schedule classes securely:
- Require registration This feature shows you the email addresses of everyone who signed up to join your class and can help you evaluate who’s attending.
- Use a random meeting ID It’s best practice to generate a random meeting ID for your class, so it can’t be shared multiple times. This is the better alternative to using your Personal Meeting ID, which is not advised because it is essentially an ongoing meeting that is always running.
- Password-protect the classroom Create a password and share with your students via school email so only those intended to join can access a virtual classroom.
- Disable join before host Students cannot join a class before the teacher joins and will see a pop-up that says, “The meeting is waiting for the host to join.“
- DO NOT share meeting links publicly on the web or social media.
Meeting Security and Control Settings
The meeting host has a variety of controls they can use to secure their meeting. Click on the titles below to learn more about each control.
- Enable the Waiting Room The Waiting Room feature is turned on by default, allowing the host to control when a participant joins the meeting. You can admit participants one by one, or hold all attendees in the waiting room and admit them all at once.
- Lock Your Meeting You can lock a session that’s already started so that no one else can join, even if they have the meeting ID and password.
- Control Screen Sharing For education users, sharing privileges are now set to “Host Only,” so teachers, by default, are the only ones who can share content in class. For students to share work with the group, hosts can allow screen sharing.
- Control Chat Access Teachers can limit students’ ability to chat among one another privately during an in-class session, but still be able to interact with the teacher if needed.
- Remove a Participant If someone who is not meant to be there somehow manages to join your virtual classroom, you can easily remove them from the Participants menu. Once a participant has been removed from a meeting, they will not be allowed back in.
- Disable Video Turn off a student’s video to block distracting content or inappropriate gestures while class is in session.
- Manage Annotation Teachers can disable participant Annotation and Whiteboard in the screen sharing controls to prevent students from annotating on a shared screen and disrupting class.
- Mute Participant or Mute All Teachers can mute/unmute individual students or mute them all at once. This allows teachers to block unwanted, distracting, or inappropriate noise during a session.
Anchorage School District has selected Zoom to connect remotely with its 48,000+ students. Providing a single videoconferencing solution for all district users reduces training and support needs, and alleviates the confusion of navigating multiple platforms. The district has compiled this four page Zoom user manual that includes a Zoom feature overview, recommended security settings, student etiquette, teaching etiquette, and additional resources.
Finally, here are a few recommendations for teachers regarding data privacy and security:
- Do not post screenshots of video meeting participants on social media. This goes for both classroom meetings and staff only meetings.
- Teachers should not record live classroom sessions, only other instructional material that is posted for students to view.
- The teacher must always be the last person to hang up and end the video conference.
- Just like at school, be clear with students about behavior and expectations on video conferencing, such as clothing, background, and how to participate respectfully.
Zoom isn’t perfect, but its features and ease of setup have made it the right tool at the right time for many educators. To maximize your success with Zoom, follow meeting setup and security protocols, work through issues as they come up, and make adjustments as needed.
More Zoom Resources
For quick reference, here’s a one-page Zoom Safety Settings Checklist adapted from Santa Barbara City College
# # #