Mitigations and Guidance - Canadian Centre for Cyber Security

Treat remote work like you would treat the office in terms of security, and VTCs like you would treat an office meeting. The following practices are recommended:

- Use existing corporate solutions whenever possible.
- Choose a platform with appropriate security features. Factors to consider include the level of encryption, the ability to require passwords or other methods of authentication in order to join a VTC, etc.
- Set rules and expectations concerning the types of discussions that may take place on a given platform. (As an example, for Government of Canada users, classified material should never be shared on an unclassified network.)
- Use the right tool for the job. Don't be afraid to send sensitive documents via courier or secure email rather than sending them over a VTC shared files channel.
- Ensure that VTC organizers are aware of the security features available in the VTC software package and that they are used appropriately. For example: Keep meetings private by requiring a password for entry. If for some reason that is not feasible, control guest access from a waiting room, just like how we let visitors into our buildings: by having them registered and escorted.
- Ensure all parties using the VTC software are aware of and comfortable with any data sharing done by the software owner in order to realize a profit (i.e. Selling data analytics for marketing purposes.)
- Choose a solution that allows you to control how your data is handled. Some platforms may route data outside Canada or store shared data on servers they control.
- Do not post links or teleconference IDs in unmanaged or public forums.
- Consider using a solution that does not require participants to install a client unless necessary. Web versions of a VTC obviate the need to update client software.
- Patch all software to latest version. Always.

Back to Table of contents