Video killed the conferencing star

Introduction

For many businesses the COVID-19 epidemic has made teleworking the only feasible alternative to having their workers on site. The video call has become essential to collaborating effectively while working from home. Teams, Webex, Zoom and other collaborative platforms have become a part of our daily lives.

In the age of corona, video conferencing has become the substitute for group meetings, conferences, webinars, training or even a simple conversation with colleagues. Thanks in large part to these technologies, there has never been a “better” time in history to be working from home. But utilizing this incredibly useful technology is not without risks.

Videoconferencing: thinking about security

The choice of a video conferencing solution is always a compromise between features and fit on the one hand, and security and privacy on the other. User requirements like performance and availability, features (audio/video, document sharing, whiteboard, questionnaires, etc.), platforms (smartphones, computers, meeting rooms, telephone call, etc.) and technical restrictions such as available bandwidth (broadband or limited connection) need to be weighed up against security requirements like encryption, access control, compliance, exploit mitigation and the like.

An effective solution is a delicate balance of all the above. Using an extremely secure solution is not helpful if it doesn’t fulfill the remote employee’s basic communications needs. Similarly, it is not wise to select a very functional solution which does not provide an appropriate level of security.

When assessing the suitability of platforms for video conferencing we need to remember that the term ‘secure’ has no precise definition. Security is the ability to provide an appropriate level of confidentiality, integrity and availability for the specific use-case. In other words – there is no single answer to the question of whether any communications platform is secure enough – it depends on who’s using it and what for.

In this series of blog posts we offer the reader a summary of salient security and usability features that should be helpful in determining whether a given platform is appropriate for your particular use-case.

To accomplish this in an objective manner, we start by presenting a ‘target security model’ that we believe should summarize the security needs of the ‘average’ corporate user. With the model in mind we then set out to install, configure and test each of the systems we report on here. Where this was not possible, we sought to leverage insights from colleagues who were already using the platforms or (in the worst case) depended on information published by the vendor or other third-party sources. We endeavor to be clear about where our insights were gleaned in each case.

Update: 21/05/2020

The graph above updated to reflect current data.

Update: 02/06/2020

The table below inserted to provide a more balanced summary of the vulnerability management capabilities of the various vendors

The graph above compares the number vulnerabilities officially recorded by the NIST NVD for 2019 and the 2020 year to date. To provide a ‘normalized’ comparison of the vulnerabilities for each product we present the number as a percentage of the total number of vulnerabilities recorded in the database for the period.

There are no vulnerabilities recorded in the NVD for Tixeo, Google Meet or BlueJeans, but this should not be taken to mean that there are no vulnerabilities for these products, or that these should be trusted more than those reflected in the chart. Indeed, as cloud products generally cannot be patched by the customer, vendors will frequently not record the vulnerabilities with NIST even when they are discovered or reported.

BlueJeans, for example, do have a bug bounty program through Bugcrowd, but do not disclose the issues that are reported to them. There are several people listed on the program’s hall of fame suggesting that vulnerabilities have been found but not been made public.

Google is also by no means immune to security bugs and exploits either, and a few vulnerabilities were in fact reported in their previous ‘Hangouts’ product.

Tixeo is especially very quiet on the question of vulnerabilities and patches. A 2014 comment on their blog regarding the “Heartbleed” vulnerability was confident of their security, but in our opinion lacked the technical detail required to garner trust[1].

The table below attempts to capture some of the more ‘subtle’ aspects of vulnerability as a function of product security.

Product	Solution Type	Transparent Vulnerability Disclosure	Runs a Bug Bounty	Vendor has a clear CSIRT/PSIRT Function
Zoom	SaaS & Partial On Premise
MS Teams	SaaS
Webex Meetings	SaaS & On Premise
Webex Teams	SaaS
Google Meet	SaaS	?
Bluejeans	SaaS
Tixeo	SaaS & On Premise
BigBlueButton	On Premise
Skype for Business	SaaS & On Premise
Jitsi Meet	On Premise

From this table above, for example, we can see that whilst Cisco Webex may have a relatively high number of reported vulnerabilities recorded on the NVD, they also have arguably the most transparent and robust vulnerability management and disclosure program of the vendors we considered. Seen from this perspective, the large number of reported security issues on the Cisco products may actually be a good thing, rather than a bad thing.

Nevertheless, the volume of vulnerabilities recorded for a product over time and the way the vendor deals with these is an important indicator of the firm’s maturity and seriousness where security is concerned.

We are inclined to favor products that have a visible history of finding and responding to security bugs over those for which no information is available. In our summary table we have highlighted those products where we have no visibility regarding vulnerabilities by recording a blank cell for the relevant field.

Whilst it is disappointing that data is not available for all the products, the graph above does serve to shed some light on the attention Zoom has been receiving for the bugs in their products recently. Of the three products, Webex is the oldest and arguably the most well established, so it stands to reason that more vulnerabilities would have been discovered and reported. From the data presented it would appear that some products have performed much better than others vulnerability-wise over the last two years. However, Teams and Zoom are relatively new players and have therefore received less scrutiny and dealt with fewer bugs. Some vendors are purely SaaS, whilst others have actual software products. Some are proprietary while others are open source. It’s therefore difficult to read very much about the security capabilities of the vendors from this data alone.

One can, however, conclude from this data that Microsoft Teams has had to deal with significantly fewer security issues than both Zoom and Webex over the period. It would also seem fair to say that, whilst the vulnerabilities reported for Zoom over the last few months are concerning, they by no means make Zoom exceptional in this regard.

Regarding the recent excitement in the press and on social media about vulnerabilities discovered in Zoom specifically, they need to be considered with this data in mind.

In our view the acid test for Zoom would be what their vulnerability count in the NVD looks like as a percentage of all vulnerabilities reported at the end of 2020.

This perspective would allow us to objectively assess how they have fared as a ‘major player’ with the increased scrutiny that implies, and how well they have responded at a fundamental level to improve their ability to minimize security issues in their code.

Summary

The table below captures a summary of the analysis that we will present over the next few blog posts. Each product we evaluated will be discussed in terms of the elements of the target security model we constructed.

Update: 12/05/2020
Readers will note that we have migrated from a simple ‘rating’ model to a detailed breakdown of specific features and properties one would want to see in each of the four security areas were considering. Each product we evaluated will be discussed in terms of the elements of the target security model we constructed, and for each element we will see a breakdown of security features a product might offer, with an indicator of whether its ‘Fully’, ‘Partially’ or ‘Not’ offered.

Given our previous comments about ‘secure’ not being a simple, binary concept, we have not attempted to provide a collated or total rating for each product. Rather we leave it to the reader to examine each element separately, and determine which elements, and what kinds of functionality and usability, are best suited for their specific needs.

Results table

You can find the results for comparison in the table below. Notice that this is not the whole story but only a very short overview. To avoid giving an incomplete picture we will publish the overviews of each tool along with the detailed blog post where you can find the detailed review.

	: Full support
	: Partial support
	: No support
?	: Not clear to us

Encryption
Uses an appropriate encryption algorithm					?
Uses a strong encryption key					?
Data is encrypted in transit under normal use
Data stays encrypted in transit on provider servers		?				?			?
Voice, Video and Text are all encrypted
File transfers & session recordings are encrypted
Vendor technically can’t decrypt the data at any point, even under regulatory pressure (full E2EE)								N/A		N/A
Encryption implementation has withstood scrutiny over time
Authentication
Administrators can define password security policies							?
Supports MFA as default							?
Can integrate with Active Directory or similar
Can integrate with SSO solutions via SAML or similar							?
Offers RBAC							?
Allows passwords to be set for meetings
Allows meeting password security policies to be set
Jurisdiction
Headquarters address	USA	USA	USA	USA	USA	USA	FRA	N/A	USA	N/A
The vendor cannot technically access any data without the client’s consent								N/A		N/A
A full on-prem version is available for users who don’t want to trust the vendor
For SaaS modes of deployment, the client can select which countries or political regions data is stored or processed in							?	N/A	?	N/A
Complies with appropriate security certifications (e.g. ISO27002 or BSI C5)
Complies with appropriate privacy standards (e.g. FERPA or GDPR)
Provides a transparency report that details information related to requests for data, records, or content.								N/A
Security Management
Offers other forms of access control to meetings, e.g. waiting rooms, lockout, banning etc.							?
Allows granular control over in-meeting actions like screen sharing, file transfer, remote control.
Offers clear central control over all security settings							?
Allows for monitoring and maintenance of endpoint software versions							?
Provides compliance features like eDiscovery & Legal Hold
Auditing and Reporting							?
Additional content security controls like DLP, watermarking, etc.									?
Vulnerability Management
Percentage of NVD 2019	0.02	0.01	0.15	0.03	0.00	0.00	0.00	0.00	0.02	0.00
Percentage of NVD 2020	0.08	0.00	0.09	0.02	0.00	0.00	0.00	0.04	0.00	0.01
Vendor discloses which vulnerabilities have been addressed					?
Vendor runs a bug bounty

Conclusion

When assessing the suitability of platforms like video conferencing, we need to remember that the term ‘secure’ has no precise definition. ‘Security’ implies the ability to provide an appropriate level of confidentiality, integrity and availability for the specific use-case in question. In other words – there is no single answer to the question of whether any communications platform is secure enough – it depends on who’s using it and what for. A family wanting to stay in touch with loved ones will have very different security requirements to a government wanting to hold cabinet meetings.

With any conferencing platform there will be a features / security / cost trade-off. Some platforms will be stronger in some areas than in others. For ‘use-cases’ where security is a serious concern the buyer needs to perform a comprehensive risk assessment based on their own unique threat model and decide from there.

For home users the risks are generally going to be low and can usually be mitigated either through available technical controls (like those being clarified and improved by Zoom almost daily) or by simply using the technology appropriately. For example, for most users simply updating to the latest versions, adding a password to meetings and appreciating that their conversations are not fundamentally ‘private’ (as is the case with most platforms they use on the internet) should be enough to make Zoom a perfectly acceptable platform. For a government, military or pharmaceutical company more would be required, and something more fit for corporate use-cases like Teams might be more appropriate.

In short, the security and privacy features we require from a technology depend on our use case and threat model. Security evaluation needs to start by considering what we are trying to protect, and against whom. Businesses need to perform this evaluation thoroughly. Home users need to understand that they will almost always be trading off some level of privacy, understand the trade-off for the products they’re using, keep their software updated and use the security features the product provides.

Please visit our blog again over the next few days to read our detailed analysis of all ten products against the target security model and gain some insight into why we assigned the ratings that we did…

1: Video killed the conferencing star
2: In-depth product analysis – Zoom & Microsoft Teams
3: Let’s examine Cisco Webex – A visionary player
4: Google Meet and BlueJeans – Re-engineered platforms for secure meetings
5: Tixeo and BigBlueButton
6: A closer look at Skype for business and Jitsi Meet