Hi, I'm Scott Ferguson, managing editor for news at Information Security Media Group. And we're speaking today with Jeff Green. He is the director of NIST's National Cyber Security Center for Excellence. And we're going to be talking about virtual meeting security at a time when more and more employees are working from home.
Jeff, thanks for joining me. Jeff, over the last two weeks, the workforce has shifted to home offices. And that's meant the amount of video conferencing is skyrocketed. When it comes to securing those meetings, what are many organizations lacking as far as virtual meeting policies?
And do these companies even have these policies in place? So, my brutally honest answer is I'm not 100% sure how many companies have the policies. I can tell you from my own experience, the way this issue came about as something that we were focusing on was talking with some folks at work. Three or three weeks ago, as things were changing, we talked about how the workforce would change.
And I started thinking about how many times in my previous lives I reused conference call number or had someone jump in on the next call as the previous one was ending. So, I asked around a few friends in different industry and government and everyone had a pretty similar reaction, which is that there aren't a lot of people who really focus on the security of their conference calls. So, I think the answer is probably not too many organizations have policies specific to WebEx's conference call, virtual meetings. And even those that do, there's probably not a lot of visibility or awareness that they have them.
So, if this is such a green field for security, what would some of the essential elements of a policy look like, especially now that we're almost at 100% work from home? I think the biggest thing, the goal of any security policy that's going to be in security tool that's going to be really effective is got to be ease of use. Because once you start making security too much of a burden, people just won't follow it. So, it is really important to be thinking about the policy as you're creating one from the perspective of the end user, keeping it relatively simple to read.
You don't want 10 pages on virtual meeting security. Think about how people use the tools. My mother was an English teacher and she always told me to write to the lowest common denominator as long as I was keeping my, continue to make my key point. And I think that should be true here.
In terms of the pieces that you should have in it, first is trust in people, but really making sure people are aware of the written. Think about your virtual meetings or concalls, the way you do any tiered approach is what we would suggest. Low, medium, high, then you apply to different security layers depending upon the sensitivity of the meeting you're going to be discussing. And it's also going to depend upon what tools your organization has in place to have these virtual meeting.
So, you're going to have to tailor it to that and make sure that in fact what you want to do is available and that people have the opportunity. Biggest thing from my perspective is know the risk you're taking and by that I need. If you're going to reuse the conference call number, if you're going to record a meeting, if you're going to share a screen, make sure that's all a conscious choice. If not things that we're doing by default, want to knowingly assume whatever risk you take on.
If you have limited time or resources, I would suggest focusing initially on the most sensitive of the call. Some suggestions there are, and the most obvious is don't reuse a conference call number. If you think about how many times you've sent an invite out to meetings with people both inside and outside of your organization, you don't want to be using that one on a very sensitive business or company call. Use a dashboard to see who's on.
A lot of services will have a green room or a waiting room. So you can actually admit people individually to control who's in there who can lock the call and a lot of them once you have everyone you want. I mentioned recording a moment ago, if you're going to record it, make sure that recording is encrypted, know if it's stored locally or in the cloud. And if it's going to be in the cloud, it might not be held by your provider, know how long you're going to hold it.
For the really most sensitive meetings, you can look into multi-factor authentication. Again, sticking with a sensitive side, one time, pins, identifiers or codes, I think are essential. And you can also, through some services, distribute a personalized link that only that one person can join from. If the other end of the spectrum, if it's truly a routine or not a sensitive call, probably okay if you're using a number, but again, be aware of what you're doing.
Last thing I'm saying that is, we put out a blog. If people look up this cyber insight, you can find a blog we did on remote virtual meeting security. And there is a graphic in there that has 12 or 15 different security options that will walk you through from our suggestions. That's from low to medium to high.
You can pick and choose. You don't have to follow our order. I give you a sense of what the options are potentially and how you might want to apply them. And what makes the 100% remote workforce that much more difficult to secure?
What advice are you giving out to security pros who are coming to you and asking how can I make this more secure? The hardest thing is this year volume that you have coming in and the difficulty in pushing out new policies and enforcing them when there's no means to get everyone together. Like almost anything when you're trying to track more people, more issues. It's harder to do.
The old adages, if you try to secure everything, you'll secure nothing. So again, that means you towards focus on the most secure information, the most sense of information. You've got to be aware again when you have this many people online, two things. Some services are getting overloaded, make sure that they have a bandwidth to do what you want to do.
And this is where the reuse of numbers. If your organization has a set number of call-ins or WebEx links or whatever, you're more likely to have someone else jumping on by accident or in the middle or at the end if they're more people trying to use them at once. So the sheer numbers alone make it harder to manage. One of the best medications is if it's available, you'd make sure that everyone has their own personalized login.
Even if it's a reused, personalized login, that at least prevents two different people from the same part of your business trying to use the same one at the same time. Jeff, what are some of the non-negotiable security must-have for remote networks and personal devices during this time of more and more virtual meetings? Again, I would start with the sensitivity of the information you're talking about, but if we're going more towards the higher sensitivity, using a unique access code in pin, curating and managing who is on the call, who's on the online, be really careful about recordings and who has access to them and who has the encryption key with respect to the devices and the networks. If you're connecting from your home network, make sure that you have good Wi-Fi security enabled with a good password.
And one thing that's often overlooked is make sure that your router is patching and updating itself because router vulnerabilities are unfortunately common and can be devastating to any device connected to your home network if you have the vulnerability there. And the same thing with your devices. If it's a company device, hopefully they have rules set in place for keeping it patched and updated. But if it's a personal device, again, you want to make sure that you are applying all the latest security patches and other tools available.
Most compromises, most attacks out there are taking advantage of existing known vulnerabilities. And if you're taking care to keep your devices up to date, you're going to be pretty safe from them. The old adage is if you're being chased by a bear, you don't have to be faster than a bear. You just have to be faster than the next guy.
If you're keeping all your devices in the most up-to-date secure state, you're going to be faster than most the people and the bad guys are going to end up moving on to someone else. Jeff, what you said about routers is kind of interesting because what other specific security threats, if anything, you're watching for since we're in the middle of the COVID-19 quarantine? Beyond the specifics of the virtual meetings we've talked about, unfortunately, criminals and scammers flock to any events of national significance and use that in a variety of ways. I think you need to be a most people party.
I'm probably already seeing perhaps unknowingly any emails, seeking money or giving something to charity distribution of bad links that could take you to some malware through those types of communications. I think one of the biggest that you'll see is an increase in bone support scams because bad guys are going to know that more people are at home. And for folks unfamiliar with that, you'll get a phone call, literally like a landline or a cell line thing. We're from major tech provider X.
We're calling because your computer is compromised. Please go to the following website where we can perform a scan. I can't see my air quotes but can perform the scan. And what you're doing then is taking your computer to a malicious website and then the scammers will often have you change settings that will allow them to access your computer and sometimes maybe even ask you to pay to clean again air quotes your computer.
I think we'll see a big uptick in them. On the business side, there's a very lucrative kind of scam called a business email compromise where criminals will spoof an email appearing to come from a senior person, a company to somebody who has the ability to transfer money saying, hey, this is an emergency, send $10,000 that is wire transfer or something along those lines. They're extraordinarily successful in the normal state and the FBI has done several public reports on business email compromises. But now with everyone physically disconnected, I think the success rate of those, unfortunately, is probably likely to go up.
But with any scam, your best defense is your audience thing. Something just doesn't feel right pause. And let's say that I'm probably as paranoid about these things as most folks, at least once a year, if not more often, as my fingers coming off the button, I realize I should immediately then try to mitigate and figure out if I actually did something wrong. Don't freak out.
Just take care to make sure that there is mitigating the data, but really trust your instincts and pick up the phone more. And that's the biggest thing that can eliminate the business email compromise. It's actually called a person and verified. But I think we're definitely going to see and put some staff from one of the major security providers earlier today, something like a 40% increase in scams over the past few weeks.
That's a good advice for end users. When we're talking about security leaders and video conferencing and the new security paradigm that we're in, how can they make sure that their policies are being followed appropriately by this remote workforce? So that is most likely going to be pretty specific to the service that you are flowing through your organization or services. So my recommendation there would be to go in from the management side with your provider, what type of tools they have, and both in terms of what security you can force, and also how they provide an ability to monitor to see that things are used.
I know some providers are set up so that you can actually force users in every situation to have a unique meeting or call it number. That's one way you avoid review. Keep in mind though, that gets in the way of usability. And that's really important, as I said, because you don't want people to come up with their own workarounds if they don't like the way the organization is set up.
My instinct would be, again, at least make sure people make the choice to either reuse a number or create a pin. Set examples as a security leader, make sure that you are following your own policies. Last thing that comes to mind is, particularly for the way I started, is I wasn't even aware whether my old organization had a virtual meeting security policy. If you have one, socialize it, distribute it, ask people to review it, maybe ask them to sign off, and distribute it in an easy to reformat.
If you send out five pages, people are going to check the box and not do it. If you send out 10 bullets in an email or a PDF, you're much more likely to have people being aware of it. So awareness and empowering the user is going to be key. But again, the biggest thing I would say is check with your provider, see what they make available to you, and then you can select the tools that you think are most appropriate for your organization.
You mentioned just something really interesting there. It's almost the return of shadow IT, folks from home trying to make sure that they can work and get stuff done. And I'll just download this to make sure I can do my job. I mean, are you kind of seeing that creeping back up into conversations as we're going along?
I can just speak from personal experience. I set up a free account with an online meeting. So I could have virtual happy hours with my fellow hockey parents and other friends out there. It's been a great way to connect.
I have not to date used it for a work meeting, but I would bet if you could do a poll of any large organization over the past week, you'd find a significant number of people who are using their own free or even paid services that may not be company or organization approved. So I don't have data and this is a data driven organization, but my gut tells me that you're on to something there. We appreciate that, Jeff. Thanks so much.
And thank you for joining us today and talking about video conferencing in this new world that we're living in. No problem. Happy to do it.