What is Zoombombing?

Zoombombing is the abuse of default settings that allows anyone to join a meeting distributed by a public link to screen-share malicious content. There are multiple ways to prevent Zoombombing from occurring. Click this link for more privacy and security information from Zoom.

Social media and public sharing

• Do not share meeting links publicly (on social media or LinkedIn, for example).
• Public links allow uninvited strangers to jump into your video call and disrupt it with spam, hate speech, or explicit content.
• Publicly shared screenshots or video feeds can accidentally expose private documents, email addresses, background details, or personal information visible in your camera frame.
• Attackers scrape public social media posts to collect meeting schedules, target participants with phishing scams, or track when homes/offices might be empty.

How can I keep my meetings secure?

• Zoom Waiting Room Requirement: Managing Meeting Access for UMD and External Collaborators.
• Changing your advanced sharing options to lock down who can share a screen and what they can share.
• Managing your options in an active meeting to change what permissions are available to your participants.
• Reviewing Zoom best practices.
• Disabling cloud recordings.
• Restrict who can join your meetings to umd.edu accounts only by enabling authentication profiles.
• If you are creating a meeting through ELMS-Canvas, please see Instructor's Guide to Zoom for additional security settings.

Recommended settings and best practices

Consider implementing these best practices to keep your Zoom meetings private and secure. To access these settings in Zoom, from the navigation on the left, click Settings. Most of these settings are located in the Meeting section.

• Enabling Co-Host who can help moderate.
• Enable a Waiting Room to manually grant participants entry to your meeting.
• Disable File transfer to prevent malicious files from being shared.
• Do not use the Use Personal Meeting ID (PMI) when scheduling a meeting in advance. Disabling this setting will generate a unique meeting code.
• If all of your attendees have a UMD username (Directory ID), restrict access to authenticated users.
• In the Settings menu under Security, select Only authenticated users can join. Non-authenticated users will be stopped in the Waiting Room.
  

Advanced sharing options

In a meeting

1. Click on the Host tools button to bring up security settings. 
   
2. Lock Meeting inhibits anyone else from entering the room, 
3. Enable Waiting Room enables the room host to admit individuals one at a time, and Hide profile pictures allows the host to hide images they deem inappropriate.
4. By clicking the Participants section, you can determine whether you wish to enable participants to unmute themselves, record the meeting, or participate in the Chat field.
5. Click the arrow next to the Share Screen button, then click Host Tools for Share.
   
6. If you do not need to offer the ability to share screen to participants, click Only Host under Who can share? for a more secure meeting. 
   
   • If you do, click All participants.
7. Next to Who can start sharing while someone else is sharing?, click Only Host.
   
   • This will allow you to take back the screen. 
     

In your profile settings

1. Access your Zoom profile.
2. From the navigation on the left, click Settings. These settings are located in the Meeting section.
3. Apply the same settings mentioned in the Advanced settings section above.
4. Browse through other settings that suit your security needs. Recommended settings are listed in the Recommended settings and best practices section.

Options in an active meeting

To control who can share during an active meeting, make use of the advanced host controls. For more information, Zoom has a blog post dedicated to advanced host controls in Zoom.

• By default, Zoom prevents participants from sharing their screens. As the host, you can enable screen sharing.
• Disable video.
• Disable annotation.
• Use the Security option in your meeting controls to see and manage all your in-meeting security settings in one place. 
• Enable a Waiting Room from your active meeting, even if the feature was not turned on before the start of the meeting.
• Control or limit in-meeting chat access. You can lock down chat options or remove it completely.
  
• Remove disruptive users via the Participants menu.
• Report a user during a meeting. The meeting host can report a user by clicking on the Security icon, then Report.
  • A report will be sent to the Zoom Trust and Safety team to evaluate any misuse of the platform and block a user if necessary.
• Users will have the label External next to their name if they are not using a UMD Zoom account. This label is displayed in one-on-one chat and the user's profile details.
  
  Note: Join Before Host and Allow Removed Participants to Rejoin are disabled by the Division of Information Technology to prevent disruptive activity.

Manage participants during a meeting

Hosts and co-hosts have the ability to manage the meeting settings to enable individuals to self-identify accordingly, while maintaining meeting safety and security. It is important to actively monitor and address any misuse of the renaming feature within Zoom, such that those changing names to be offensive can be confronted appropriately and referred to the Office of Student Conduct (OSC).

Likewise, any Zoom situations that may demonstrate bias or discrimination toward a person or group should be documented and submitted to Bias Incident Support Services (BISS). This office will follow up with the person reporting the situation and support those impacted.

Options to manage the security settings of your meeting

Find available Zoom security settings and learn what they do.

Security setting	Feature
Enable waiting room	The waiting room is enabled by default; this option cannot be changed.
Unmute themselves	Hosts may have selected criteria to mute participants on entry to the Zoom room. Enabling this option allows participants to unmute themselves during the meeting to more easily participate in discussion. An alternative method to manage participant communication is to request that they use the Raise hand feature in the Participants panel which then necessitates a host or co-host to unmute and re-mute manually.
Annotate on shared content	By default this feature is off; toggling it on allows participants to use annotation tools to write on the host's shared content (slides, whiteboard and so on). Hosts should have a plan for such an activity.
Lock meeting	Select this option to preclude new participants from joining the meeting in progress (even if they have UMD identities and a passcode). Hosts will not have any way to know who was turned away from the room.
Remove participants	In the unlikely event that a participant becomes unruly or provocative and does not observe the rules of conduct for the room, hosts and co-hosts can identify and immediately remove the participant if this option is enabled.
Report incidents or user	This option allows hosts and co-hosts to report a user to Zoom's Trust and Safety[LINK] team. Select which user to report and provide details about the problem.

For more information on how to change different security settings, refer to this knowledge article from the Zoom team. 

Top