Blog Layout
Video Conferencing Showdown Final Review
Chelsea Sauder • May 28, 2020
Remote meetings and video conferencing services have been on our minds and in the news lately, especially when it comes to privacy and security. Beyond that, though, there are still important differences among the offerings. In this final article of our Video Conferencing Showdown, we’ll give you the information to choose the right tool for the job and make sure technology enables you to do your job with efficiency and success. Make sure to check out the in-depth analysis covered in the previous posts: Part 1: Zoom, Part 2: Microsoft Teams, Part 3: Google Meet, and Part 4: Cisco Webex.
Showdown Scoring
Throughout this post we will be scoring each platform on they key areas we discussed throughout this showdown. Platforms will be scored on a scale of 1-4; with 1 being poor and 4 being great.
1 - Poor
2 - Average
3 - Good
4 - Great
Privacy
Privacy covers both how and why the providers collect and use your data, and privacy of the meeting events themselves, that is, how you control and regulate participants and guests.
Privacy Scores
Zoom
Microsoft Teams
Google Meet
Cisco Webex
Zoom
- Zoom revised their privacy policy on March 29, 2020 — however, while committing to walling off your personal information from tracking and advertiser use by third parties, Zoom specifically exempted their such use of your information;
- Zoom also offers an “attention tracking” feature which notifies the meeting host if the meeting isn’t the foreground window on someone’s device. Many people deem this intrusive to personal privacy;
- Earlier this year, Zoom distributed a single (weak) decryption key for each meeting to all participants, and sometimes that key came from servers located in China. This prompted many to question if Zoom was therefore compelled to provide these decryption keys to the Chinese government;
- Disruptive, unwanted attendees after the surge in Zoom use caused the new verb “Zoombombing” to enter our collective lexicon
Microsoft Teams
- Teams is supported by Microsoft’s overall experience and commitment to privacy and security;
- Teams does not have attention tracking;
- Robust controls exist within Teams meetings such as moderation, and AI chat monitoring to combat bullying and harassment;
- Microsoft is excellent about publishing relevant information like privacy policies and practices, data flow within their apps, and data residency locations
Google Meet
- Google Meet upped their meeting privacy controls in March, but an unfortunate side effect is that any attendee must be signed into a Google account, which brings along tracking and privacy concerns;
- Meet does not have attention tracking;
- Meeting IDs are impractical to guess with brute force, and Google permits external attendees only if they’re invited by someone internal;
- The Google Cloud privacy and data protection policies are robust and well-documented
Cisco Webex
- Cisco has been proactive about their privacy policies, even making a Privacy Data. Sheet easier to find after a Consumer Reports inquiry. Like Google and Microsoft, Cisco is no slouch at this and lists all personal data they collect and use;
- Like Zoom, Webex has a Participant Attention feature;
- While meeting IDs/URLs aren’t easy to randomly guess, it’s trivial to find many thousands online, and scan for which ones would allow anonymous Webexbombing;
- Cisco is the only provider specifically calling out that a) if you’re using a Webex Meetings account at work, all your data is accessible to your employer; and b) when attending someone else’s meeting, that data is similarly accessible to the host organization.
Vulnerabilities
Vulnerabilities are unwanted defects in software that have unintended and usually negative effects.
Vulnerabilities Scores
Zoom
Microsoft Teams
Google Meet
Cisco Webex
Zoom
- Due to sloppy implementation of the Facebook SDK, the Zoom app for iPhone was sending data about users to Facebook, even when the user didn’t have a Facebook account;
- The Zoom client for macOS contained an intentional bypass of web browser security so it could use the camera – unfortunately, this meant any malicious website could also turn on the camera without the user’s knowledge or consent;
- Zoom (though not the only application to do so) made UNC paths into clickable links, so if one was clicked on from the Zoom chat, Windows automatically sent the username and hashed password of the person who clicked on it to the remote site;
- As recently as April, Zoom showed information from the LinkedIn profiles of meeting participants, without any notification to the profile subjects
Microsoft Teams
- Teams had a serious credential-stealing vulnerability discovered and fixed in April. This had the potential to be quite bad, as many people use Office 365/Microsoft 365 for their work email, SharePoint, CRMs, and other business functions – and all of these use the same credentials. It was also possible to perform this theft completely silently to the party being attacked.
Google Meet
- Meet generally runs entirely within a web browser, and therefore has a reduced attack surface compared to applications requiring a standalone client;
- There is a standalone client called Google Chat, which is essentially mini browser based on the Chromium engine. There isn’t an easy way to verify software updates to Google Chat;
- The Google Chat client is written in a software framework called Electron, and uses a relatively old release of it;
- Electron has a long history of vulnerabilities and a security researcher found a way to redirect Google Chat client users to phishing sites
Cisco Webex
- Though not any inherent flaw within Webex itself, Webex users have been targeted recently for their account credentials by a phishing email which uses graphics and formatting stolen from legitimate Cisco emails and looks very authentic;
- It was discovered (and fixed) in January that setting a password on a Webex meeting didn’t always work – attackers using an iOS or Android mobile device could bypass the password completely and successfully join meetings;
- The Webex software for Windows has three known high severity vulnerabilities over the last year
Encryption
Encryption Scores
Zoom
Microsoft Teams
Google Meet
Cisco Webex
Zoom
- Zoom has a sordid history about encryption and telling the truth. The company claimed to offer end-to-end encryption, which they didn’t and still don’t;
- Zoom had a security guide whitepaper claiming the Zoom app used AES-256 encryption for meetings. It does that now, but it was previously the case that each meeting only used an AES-128 key with the ECB block cipher mode – which does a poor job hiding patterns in data and is not acceptable for meaningful encryption;
- The AES-128 key just mentioned sometimes came from servers located in China. This prompted many to question if Zoom was therefore compelled to provide these decryption keys to the Chinese government;
- Zoom uses a single *.zoom.us wildcard SSL certificate and their implementation rates A+ on SSL Labs, supporting only TLS version 1.2
Microsoft Teams
- Teams is part of the Office 365 ecosystem. Files are stored and encrypted within SharePoint, notes are stored and encrypted within OneNote, which is itself stored inside SharePoint. All Teams data is encrypted while in transit and at rest;
- Teams Private Channels currently only support a subset of security and compliance features;
- TLS implementation specifics are published;
- teams.microsoft.com gets a B grade from SSL Labs, though this is expected to improve when support for TLS 1.0 and 1.1 is removed next week
Google Meet
- Google asserts that Meets and their data are encrypted in transit between participants and Google (not end-to-end);
- Meets recordings stored on Google Drive are additionally encrypted at rest;
- meet.google.com receives a B grade from SSL Labs, because like Microsoft, it still supports TLS 1.0 and 1.1;
- No deprecation timeframe for TLS 1.0 and 1.1 has been announced
Cisco Webex
- Both in their Privacy Data Sheet and a technical whitepaper on Webex Security, Cisco states that all media streams are encrypted between participants and Webex Cloud, decrypted at Webex Cloud, and re-encrypted and forwarded to other participants. An exception to this is when any meeting attendees are using third-party video end points;
- Media streams are encrypted with AES-128 but no block cipher mode is published;
- Webex is the only player in the showdown to offer true end-to-end encryption of meetings, albeit at the sacrifice of some features;
- *.my.webex.com scores an A+ on SSL Labs, supporting only TLS 1.2
User Settings
All of these applications do fundamentally the same thing, so the majority of good advice applies to all equally:
User Settings Scores
Zoom
Microsoft Teams
Google Meet
Cisco Webex
- Don’t over-share your meeting IDs and URLs;
- Always use a meeting password;
- Use the waiting room/lobby function if you can;
- Be mindful of settings covering who may screen share by default
A few items specific to their platforms:
- With Teams, an organization administrator may centrally manage meeting settings for all users according to company standards;
- Google asserts that their security controls are enabled by default and “just part of the service” – we recommend using multifactor authentication as well;
- If using Meet as part of G Suite for your organization, think about enforcing MFA with SSO;
- Lock Personal Rooms in Webex when they’re not being used;
- Cisco allows for Webex Site Administration which enables central management of user settings by a company
Final Thoughts
When we tally up all of the scores, Microsoft Teams and Cisco Webex are neck and neck. If your company already lives within the Office 365 platform then Microsoft Teams is a no-brainer. On the other hand, if your organization isn't using Office 365, Webex is a solid choice.
Final Video Conferencing Showdown Scores
Zoom
Microsoft Teams
Google Meet
Cisco Webex
Choosing the best app for video conferencing is a matter of selecting the right tool for the job you have in front of you. It’s possible your employer has standardized on one of these products, or something different, and if so, that’s generally what you’ll be using. Take the time to review the suggestions in the User Settings section, both here and within the article about the specific product. See if there are any items you could improve on, or security options that might be better. It only takes a moment and is certainly better than having an important meeting disrupted.
If you’re personally in the market for video conferencing, Zoom, Google, and Webex all offer free plans for individuals, and Microsoft indicates one is coming soon for Teams.
Share this post with others:
When it comes to automating processes around your business, it can simultaneously seem like everything can be automated, and absolutely nothing can be automated. As with many other things, the real answer is somewhere in the middle but can be a bit challenging to put your finger on. These projects usually start when someone at the strategic level of the organization has decreed that “we are going to automate!” and either they personally go on the hunt for what to automate or they hand it off to someone on their team to go do the leg work and come back with “automation” (maybe in a nice box with a bow on it). Sound familiar?
Data is everywhere. You’ve got a lot to focus on and it can be hard to stay on top of what’s going on with your business. Report creation in Excel is often time-consuming and can quickly become a nightmare. Modernizing your reports and streamlining your process with PowerBI to get more reliable and consistent reporting across all of your systems can be a game changer for your business. Read on to learn about three key acceleration tactics that our team uses on every implementation that we facilitate.
83% of knowledge workers require technology to work together. Microsoft Teams is a cloud-based collaboration and communication tool that lets workers share the right information to the right people all through one integrated platform. According to a Forrester report, The Total Economic Impact of Microsoft Teams, there are a variety of ways using Teams saves organizations time and money. Read and download the infographic to share here .
How to Get Started with the Power Automate app for Teams You can get started with Power Automate app in just 3 quick steps: Click on the … in the left-hand corner of your teams browser Search for “Power Automate” Click on the Power Automate app icon and pin it to your left-hand Teams navigation panel
As mentioned, there are several options available for automating your business. One of our favorite low-code/no-code options is the Microsoft Power Platform. As a suite of 4 different tools, the Power Platform can automate routine tasks, customer support, data visualization, and more. A few highlights on the effectiveness of the Power Platform are:
It is no secret that 2020 and the coronavirus pandemic altered the reality of doing business. These changes are showing little signs of letting up and a lot of the adjustments made to respond to a remote workforce may very well become a permanent feature in daily business operations. As business decision makers (BDMs) and IT decision makers (ITDMs) head into a new year it is important to keep an eye out for technology solutions that can further support these operational changes while increasing efficiency. This post briefly highlights the top 3 digital solutions we have our eyes on for 2021 and our Microsoft-based clients.
In our latest video series, Patrick Boren, Principal Consultant at TexasPGB, introduces the newest addition to the Microsoft Project family, Microsoft Project Operations. In this video Patrick discusses: What challenges Project Operations aims to solve What is Project Operations and common use cases for the tool Who uses Project Operations Upcoming "Day in the Life" Sessions Watch the video or read the condensed transcript below.
Having a wealth of data at your fingertips is great, but what happens when your data is so vast that it takes you years to make a key discovery? A friend of mine told me a story recently about an experience he had. His first company conducted a VP meeting every quarter – everyone scrambling to put together their presentations and make their case based on the data from Excel spreadsheets. Departments and information tended to be segmented into silos. While much of the data could be shared across the company, rarely was it compiled in a way to show how one area of the business could affect another.
If you are looking to migrate your data to Microsoft 365 there are two common methods to funnel your data - SharePoint or Common Data Service (CDS). SharePoint solutions take advantage of lists and libraries. Data is housed, originated, and manipulated entirely within the SharePoint platform. CDS solutions use both standard and custom entities to collect and house data that is then integrated across the Microsoft 365 platform. Below we will review a few ways each method is different and what you should look for before making a final decision for your data migration plan.
When it comes to technology, do you have a one-size-fits-all vendor? In today’s world of cost cutting, we see more and more organizations that end up missing out on huge technology opportunities by assuming a single vendor can and will do it all. As a technology consulting firm, we’re frequently asked “aren’t you the same as my managed service provider (MSP)?” Fortunately, for those that ask, we’re able to shed light on how a Technology Consulting Firm varies from an MSP.
