Microsoft Teams - A Secure Alternative to Zoom

Cambridge University and the Clinical School encourage people to use Microsoft Teams instead of Zoom where possible - it includes more features and is more secure, with robust data govenrnance agreements in place via our Office 365 agreement. Additionally, Teams is licenced for all University staff and students, and UIS and CSCS Service Desks are able to support it.

To assist with this CSCS have put together some user guides on using Teams - including "How to join a meeting" (both with and without a Cambridge University account), "Creating and Joining meetings" and "Recording Meetings" - available on our website here: Microsoft Teams Help

Avoiding "Zoombombing" - aka unwanted participants joining a meeting.

This has been reported as happening to several meetings now, and has been reported online significantly. Zoom have now changed the default option for all new meetings so people joining the meeting are now put into a "Waiting Lobby" and have to be admitted by the host. Please be cautious when posting meeting links on public websites, though people can no longer immediately join the meeting directly, having to deal with unwanted people trying to join can be disruptive. We would also urge you to consider if Zoom is the best option, or if the meeting can be done in Microsoft Teams instead.

Zoom Security Tips

Don't use your Personal Meeting ID for meetings - instead let Zoom allocate a random meeting ID (this is now the default for new meetings).
Always password protect your meetings (this is now the default for new meetings).
Use the Waiting Room to control access (this is now the default for new meetings).
Restrict what participants can do - you can:
- Disable Screen sharing by participants
- Disable private chat between participants
- Don't let people rename themselves
- Disable annotation of shared screens by participants

The UIS also have a page with tips on using Zoom securely: https://help.uis.cam.ac.uk/service/security/cyber-security-awareness/wfh-security/zoom-security

Sharing the meeting URL

Warning: The meeting URL created by Zoom allows someone to join the meeting without having to enter a password or the Meeting ID. We recommend this is only shared for private meetings, and only directly sent to participants. We suggest that if you are planning on posting the information publicly, or if there is a risk it may be shared, that you instead share the Meeting ID (the 9-digit number for the meeting) and then, separately and privately share the Meeting Password.

Instructions

Starting a Zoom meeting (with the app)

To start a Zoom meeting you need to have a Zoom account - you can sign up for a free account online, or using one of the University's paid accounts. This section assumes you have the Zoom App installed already and have signed in - if you don't you can download it from the Zoom website here: https://zoom.us/client/latest/ZoomInstaller.exe - for instructions on joining online please see further below.

You can start a meeting immediately, without having to first schedule it:

In the main Zoom application, click on "New Meeting":
A new window will pop up, which is your Zoom Meeting. You will be the only person in the meeting initially, and by default it will join with your Computer Audio. You will get a prompt telling you to "Click here to invite participants":
Click on "Invite" to pop up the "Meeting Invite" window - from here you can copy the URL to the meeting, copy an Invitation, email the invitation out, or view the meeting ID (at the top of the window) and password (at the bottom of the window):

Note: Anyone joining via the URL does not need to enter a meeting ID or password, so please be careful about posting this on public websites.
Clicking "Copy Invitation" will copy the URL, meeting ID and password to your clipboard. Clicking "Copy URL" will just copy the meeting link (which will allow someone to join the meeting).
Once you've invited people to the meeting, when they try and join they will be placed into a Waiting Lobby and will see a message like the one below saying they are waiting to be admitted:
The meeting host will see a message appear in Zoom saying someone is waiting in the Lobby, with options to allow them into the meeting or view the waiting room to allow multiple people or reject them:

If you click "See waiting room" a white box appears at the right of the window, showing those waiting and options to Admit or Remove each person:

Scheduling a meeting (with the app)

To schedule a meeting in the Zoom app, you need to have signed into the app first, and then click on the "Schedule" button:
This will pop up a new window, we recommend leaving the options on the default for most settings, and urge you to ensure there is a password set for the meeting, to avoid unknown people from joining the meeting. The options you will need to change are at the top, for the name of the meeting and the scheduling:

Unless there is a particular need to change the Meeting ID or Password, we recommend leaving them on the defaults. You may notice in the screenshot above that Video is off for the Host and Participants - this is just the default "on join" options, and Video can be enabled by each person within the meeting once they have joined.
Once you have set a Topic for the meeting, when it will start and the duration, click on "Schedule" at the bottom, and it will then give you a loading window briefly before popping up an Outlook Calendar Invitation window with the date, time, and meeting invitation and details already filled in, which you can then send on:

Joining a Zoom Meeting (with the app)

So you've been invited to a Zoom meeting, either by a link or a Meeting ID and Password, what now? This guide assumes you have already downloaded and installed the Zoom app - if you haven't, you can download it from the Zoom website here: https://zoom.us/download

Joining with a URL

If you've been sent a link, great! Just click on the link, a web page will load and then will launch the Zoom client - you may be prompted to launch Zoom, if so click Open Zoom - if you have not signed into Zoom you will be asked to enter your name before joining the meeting, enter your name and click "Join Meeting:
If you have not signed into Zoom, you will then be required to Agree to the Zoom Terms of Service and Privacy Policy, once you click "I Agree" you will then get a loading screen, followed by a window saying you are waiting to be admitted:
The meeting host will get a notification that you are waiting, and can then admit you to the meeting, or remove you.

Joining with a Meeting ID and Password

If you've been sent a Meeting ID and a Password to join the meeting, you need to open up the Zoom application, then click on "Join a Meeting" (if you are not signed in - if you are signed in you need to click "Join")
You will see a window pop up, asking for the Meeting ID, your name, and whether to connect Video and Audio - by default audio is on and Video is off, though these can be changed after you have joined:
Once you click Join you will then be prompted to enter the meeting password, once you enter it and click "Join Meeting" you will then see a message saying you are waiting to be admitted to the meeting, and the host will receive a message saying you are waiting in the Lobby.

Recording Meetings

Zoom offers the option to Record meetings. With a free account you can only record to your local PC - and by default it will record to your "Documents\Zoom" folder, with a new folder being created per meeting. Please be careful when recording meetings, if you are using a shared account on a PC (e.g. one of the Seminar Room logins) then the recording will be visible to anyone else who logs in with that account, unless you move or delete it. The video is not encrypted or password protected.

With a paid account you are offered the option of saving the recording online - either to the Zoom Cloud Servers, or to another server of your choice. Please be extremely careful when using this, as the video is not encrypted or password protected, and as various news & security organisations have found people have been uploading confidential recordings to public or unsecured websites.

Please also note that aside from these technical steps, there are the usual concerns about data and privacy - no Patient Identifiable Data should be used or discussed in the meeting, and the participants should consent to & be informed of the recording before the meeting is recorded, copyright for eventual published recordings and retention policy of recordings:

Tell participants ahead of time that the meeting will be recorded and the intended purpose of the recording.
Alert them of any copyright restrictions (e.g. as per the copyright notice on MedEd) over the published recordings.
Create, action, and inform all participants of the retention policy/process for the recordings.

Browser not supported