V
For many organisations, the COVID-19 pandemic has led to a large number of employees working from home. This increase in remote working has resulted in a proliferation of video-conferencing applications.
ideo-conferencing services can do a lot to help organisations overcome many of the difficulties they face, but it’s important to perform certain checks when choosing a video-conferencing application and make sure you configure it securely.
For example: • • •
Some video-conferencing services implement end-to-end encryption, how the provider implements so that all data is encrypted in basic security controls transit and can only be decrypted by participants of the meeting. where your data is held Others encrypt data between user what they can do with it. devices and the service, which allows them to provide more functionality.
Choosing a Video-conferencing Service
Many video-conferencing service providers also offer premium options, which provide extra features or levels of service. These may include enhanced security, configuration and privacy options.
If your organisation already has access to video-conferencing applications as part of its software services, you should do a risk assessment (even if it has been done before) to make sure they are suitable for remote working. If your organisation is considering a new service, you should do risk assessments and perform checks for a shortlist of service providers. The results of these assessments, considered alongside the provider’s terms and conditions (and privacy statement), will give you an understanding of what is required.. 12
If your organisation needs to use video-conferencing for more sensitive meetings, you should follow the National Cyber Security Centre’s (NCSC’s) Cloud Security Principles1 to determine whether a service meets your organisation’s security needs.
Cloud services often store and process data in (and route traffic through) data centres across several countries and jurisdictions. It’s important to know where your data is, who can access it and under what circumstances they can do so. If your organisation is in a regulated industry or handles government data, you should again refer to the NCSC Cloud Security Principles to find out whether a service is secure enough for your organisation’s needs.
