Webex best practices for secure meetings: Site Administration

Scheduled Webex Meetings

Scheduled Webex meetings are our recommended meeting type when security is important to you or your organization. Scheduled meetings are one-time meetings that are password protected and have a wide range of security features in meeting feature controls and attendee controls. As an administrator you can control the security features for all scheduled meetings on your Webex site. Hosts can also configure meeting security, meeting options and attendee privileges when they schedule their meeting.

Personal Room Meetings

Webex Meetings Personal Rooms are a form of Webex meeting that are continuously available to the meeting host. The meeting host activates their personal room when they join and deactivates the meeting room when they leave. Webex Meetings Personal Rooms are intended to provide a quick and convenient way for trusted participants to meet, and therefore have a limited set of configurable security features. If meeting security is your primary concern, we recommend using scheduled Webex meetings which have a comprehensive set of configurable security features.

Personal Room Meetings can be enabled or disabled for all users in your Webex site. If enabled for your Webex site, they can be enabled or disabled for individual users.

To enable Personal Room Meetings

Locking Webex meetings affects the meeting entry behavior for all users. When the meeting starts, participants are placed into the lobby by default, until the host admits them.

Separate meeting lock settings are available for scheduled meetings and personal room meetings on your Webex site.

The meeting lock controls allow an administrator to do the following:

• Automatically lock the meeting 0, 5, 10, 15, or 20 minutes after the meeting starts

• Configure the meeting entry behavior when the meeting is locked:

  • Everyone waits in the lobby until the host admits them

  • No one can join the meeting

The default setting when a meeting is locked is Everyone waits in the lobby until the host admits them.

As an administrator, you can force meeting hosts to use the site-wide default meeting lock settings, or allow the host to set the number of minutes after the meeting starts when it gets locked. We recommend you enforce automatic locking of meetings after a set time. Meeting hosts can always use in-meeting controls to lock and unlock their meeting while it is in progress.

The lobby is enabled by default for all Webex meetings. With this default setting, when a meeting starts, and the meeting is unlocked, all guest users are placed into the lobby, until the host admits them.

A guest user is categorised into the following user groups:

• Unverified Users — Users who have not signed in and whose identity is not authenticated.

• Verified External Users — Users who have signed in, but belong to an external organization.

Each user group has separate and independent lobby controls. Distinguishing between Unverified and Verified External Users allows you to enhance meeting security by applying more stringent meeting entry controls for unverified users. For example, Unverified Users cannot join the meeting while Verified External Users are placed in the lobby, or Unverified Users are placed in the lobby while Verified External users can join the meeting directly.

With the default setting “They wait in the lobby until the host admits them”, when the meeting is unlocked, users in your organization who have signed in with a Webex account using a host or attendee license bypass the lobby and join the meeting directly.

The meeting host can see a list of attendees waiting in the lobby. When users are placed into the lobby of a meeting, they are categorized into three groups to simplify user screening and meeting admission choices:

• Internal users (authenticated users in your organization)

• External users (authenticated users in external organizations)

• Unverified users (users who have not signed in and are not authenticated)

Internal and external authenticated users have signed in and verified their identity. The identity of unverified users (users who have not signed in) can't be assumed to be true because they were not authenticated.

Users can be admitted to the meeting, or removed from the lobby individually or as a group.

For more information on lobby controls see Know who you're letting into your Webex meeting.

To change the lobby settings for scheduled meetings and personal room meetings

We recommend that you enforce password requirement on users joining scheduled meetings from phone or video conferencing systems. The system automatically generates an eight-digit numeric password for phone and video conferencing system attendees and adds it to the meeting invitation. This measure ensures that only people with an invitation can join the meeting when using a phone or video conferencing system.

We recommend that you prevent attendees from joining before the host, unless you fully understand the security risk and require this functionality.

Consider disabling the join before host options for your site, particularly for listed meetings. Otherwise, external attendees could leverage scheduled meetings for their own purposes, without the knowledge or consent of the host.

Similarly, if you allow attendees to join before host, consider not allowing them to join audio before host. If your meeting is listed on your site or is not password-protected, unauthorized users could potentially gain access and initiate expensive calls without the host's knowledge or consent.

For Personal Conference Meetings (PCN Meetings), we recommend disabling the join audio before host option. The host must dial the Webex access number for the audio bridge, and then enter the host access code and host PIN, before attendees can join the meeting.

In addition to using the meeting lobby and meeting lock features for personal room meetings, you can use CAPTCHA to detect and block attackers using robots and scripts to fraudulently gain access to your personal room meetings. When enabled, CAPTCHA applies to guests joining your personal room meeting.

A guest user is defined as follows:

• Not signed in (identity is not authenticated)

• Signed in, but belongs to an external organization

Telephony callback fraud can happen when someone joins one of your meetings and uses callback to call suspicious phone numbers from different countries, which cost your organization money. These suspicious phone numbers can come from anywhere in the world. However, we've observed that a higher percentage of fraud originates from the following locations:

• Belgium

• Costa Rica

• Ecuador

• Egypt

• Ethiopia

• France

• Moldova

• Niger

• Panama

• Philippines

• Portugal

• Saudi Arabia

• South Africa

• Sri Lanka

• Taiwan

• Turkey

• Ukraine

• United Arab Emirates

• United Kingdom

• Vietnam

To help reduce fraud, we recommend that you disallow certain countries in the Webex Allowed Callback Countries list. For example, you can add countries that you don’t do business with, or from which you've received fraudulent or suspicious calls.

Even meeting titles can reveal sensitive information. For example, a meeting entitled “Discuss acquisition of Company A” can have financial impacts, if revealed ahead of time. Creating unlisted meetings maintains the security of sensitive information.

For listed meetings, the meeting topic and other details appear on your Webex site for authenticated users, as well as unauthenticated users and guests to see. We recommend that you mark all meetings as unlisted, unless your organization has a specific business need to display meeting titles and information publicly.

If your organization works with sensitive information, we recommend that you require all users to have an account on your Webex site. When enabled, Webex prompts all hosts and attendees for their credentials when they join a meeting, event, or training session.

In addition, we recommend that you require attendees to sign in when dialing in from a phone. This requirement prevents anyone getting into the meeting or training session without proper credentials.

Hiding meeting and event links within meetings deters attendees from inviting unwanted guests by making the links less convenient to copy and share. It doesn’t prevent attendees from copying and sharing meeting links from their email invitations.