ASD ISM 1562 Secure video conferencing and telephony systems

The IT team should conduct a security assessment of current video conferencing and telephony systems.

They can do this by reviewing existing configurations and checking for updates or patches that need to be applied. Use available tools or engage a security expert to identify vulnerabilities.

System administrators should ensure encryption is enabled on all video calls and internet-based phone lines.

They can do this by configuring the system settings to use encryption protocols, such as end-to-end encryption, that block unauthorised access to conversations.

The office manager should organise training sessions for staff on secure usage practices.

This includes instructing users on not sharing meeting links in public forums, using strong passwords, and recognising suspicious activity during calls.

Procurement should review service agreements with video conferencing and telephony providers.

They need to verify that vendors adhere to industry security standards and have a clear process for security updates and breach notifications.

The IT team should implement network segmentation for these systems.

This involves setting up separate networks for video conferencing and telephony equipment, reducing the risk that a breach in one area impacts the entire network. They can do this by configuring firewalls and network policies accordingly.