.jpg?width=700&name=policy%20server%203%20(1).jpg)
Not every video meeting needs the same level of security. A weekly team catch-up, a confidential board discussion, and a classified defense briefing all have different requirements for who can join and what they can access.
For IT and security teams, the challenge is putting the right controls in place without making collaboration unnecessarily complicated. That means verifying participants' identities, determining which meetings they're authorized to attend, and managing what they can do once inside.
Start with identity verification
The first step is making sure participants are who they claim to be. Depending on the level of security required, organizations can use several methods to authenticate users:
- Passwords, PINs, and invitation-only access provide a basic level of protection for less sensitive meetings.
- Single sign-on (SSO) allows employees to authenticate through the identity systems their organization already uses.
- Multi-factor authentication (MFA) adds another layer of verification, particularly important when sensitive information is involved.
- Biometric verification and liveness detection can provide additional assurance in environments where impersonation presents a serious risk.
For internal video meetings, integrating with an existing identity provider helps IT teams apply familiar security policies without introducing separate credentials for every meeting. But verifying someone's identity doesn't automatically mean they should have access to every conversation.
Control which meetings people can access
Once a participant's identity is established, the next step is authorization: determining what that person is permitted to access.
Two common approaches provide different levels of control:
Role-Based Access Control (RBAC) assigns permissions according to a person's role or responsibilities. For example, an organization could restrict a board meeting to executives and board members, or an internal restructuring discussion to authorized HR staff.
Attribute-Based Access Control (ABAC) allows organizations to consider additional factors, such as security clearance, nationality, mission assignment, location, or the sensitivity of the information being shared.
This is particularly valuable in defense and government environments, where a participant may have the right credentials but lack authorization for a specific briefing.
How to bring your access controls into every secure meeting.
Manage permissions throughout the meeting
Access control doesn't necessarily end when someone joins a call. Organizations may also need to determine what each participant is allowed to see, hear, or do in the meeting.
Here are some examples by industry:
Justice: During a virtual court proceeding, the judge and authorized attorneys may need a private discussion space that other participants cannot access.
Healthcare: A physician may need to restrict a consultation to authorized family members, protecting confidential patient information.
Defense: A multinational briefing may require different access permissions depending on participants' clearance levels and mission assignments.
Enterprise: An organization may restrict who can present, record, or share information during a confidential board meeting.
In more advanced environments, policies can also be evaluated at defined points during a session. If a participant's authorization changes, the system can respond according to the organization's security requirements.
Match your security measures to the risk
The right level of access control depends on the sensitivity of the meeting and the consequences of unauthorized access. Pexip supports everything from familiar meeting safeguards to advanced, policy-based access control, integrating with organizations' existing identity and security systems.
Originally published April 24, 2024.
- Healthcare
- Defense
- Government
- Judicial
- Secure collaboration
- Secure Meetings
