What is video conferencing software?

In basic terms, video conferencing software allows multiple users to hold live video and audio meetings online, making it feel like they’re having a face-to-face conversation even though they’re not in the same room. It usually includes handy features like screen sharing, chat, and file sharing to ensure efficient and secure video teleconferencing. It’s commonly used for work-related virtual meetings and online classes.

Cybersecurity risks in video conferencing

At the beginning of April, Zoom, one of the most popular video conferencing services, had a ton of security-related problems. Most of them revolved around poor encryption and data protection.

Zoom always stated that it offers end-to-end encryption. However, it turned out to be far from the truth. It only encrypts data in transit, and to make matters worse, the developers have encryption keys that allow Zoom to decrypt its users’ data.

Another problem Zoom had to deal with was so prominent it even has its own name — zoombombing. It’s a type of photobombing where hackers and regular internet trolls would get into people’s video conferences and post malicious links, pornographic images, or use obscene language.

Weak encryption combined with bugs in some of Zoom’s apps also led to 500,000 of its users’ credentials ending up for sale on the dark web. It doesn’t help that Zoom is known to collect and sell users’ data to third parties — without informing them about it.

Even though Zoom was quick to react and patch most of these vulnerabilities, new exploits are likely to arise all the time — both in Zoom and other video chat services. Therefore, you should always keep tabs on the latest cybersecurity news. Otherwise, you risk your private conversations, passwords, and business secrets ending up online.

What you can do to protect yourself

1. Make sure to install the newest version of the app the moment it’s available. Updates include security patches that are vital if you want to stay safe online.

2. Never share the meeting link or ID publicly — send it to the people participating in the call only. If your app allows it, set a password for your meeting. Need help with creating a strong password? Try our password generator.

3. Utilize other features your video conference app offers. Some have a virtual waiting room where you can approve every person. Others allow you to disable participant’s cameras and microphones and even kick them out. Learn about all the features of your secure video conferencing software and how to use them to stay safe.

4. Never accept video conference invites from people you don’t know. It might be a scam or a catfishing attempt, so it’s best to stay away from people you don’t know.

5. Always be mindful of what you say and show during a video call. Remember, everything can be recorded, and you never know where it will end up. So, don’t share any information that’s too personal or sensitive. Look for safer methods to discuss business secrets.

6. Even though many video conferencing apps offer encrypted video calls, you should still take additional safety measures and do some research. Make sure they don’t have any known vulnerabilities, the encryption protocols they use are bulletproof, and your own device is not infected with malware. If someone has control over your computer or phone, they will be able to listen in on your calls even with end-to-end encryption. Scan your devices regularly to make sure they are safe to use.

7. Be careful with apps you never heard of. Only download them from official app stores, and always check whether the developer is trustworthy before installing it. Hackers are known to create fake versions of popular secure video conferencing software that infect your phone with malware.

8. Usage of various video conferencing platforms is skyrocketing, and cybercriminals have their eyes set on them. Therefore, never reuse passwords, change them regularly, and come up with strong, complex passwords for your most sensitive accounts. If you need help remembering them — use a password manager to store them all safely.

9. Use Health Insurance Portability and Accountability Act (HIPAA) compliant video conferencing software to ensure the safe handling of sensitive health information. Considering that sometimes employees need to share their health data with people in other departments (e.g. HR), you should create a safe virtual environment where they can do that without worrying about security.

10. Make GDPR compliance a top priority to confidently use video conferencing tools while keeping data protection standards high. This approach will help you avoid fines and legal issues for failing to comply with GDPR regulations. Plus, remember that adopting GDPR-secure video conferencing practices is a way to not only protect your participants’ privacy but also enhance trust and credibility.

11. Use only strong passwords, that is combinations of letters, numbers, and symbols that are complex and unique enough to prevent cybercriminals or malicious machines from identifying them. Also, you should implement two-factor authentication to increase the level of cybersecurity at your company. With two-factor authentication, employees must provide more than just their password to log in to your company applications or access company data. This means, for example, that they will be sent a verification code via email or SMS, or asked to use their biometrics to confirm their identity

CISA guide for securing video conferencing

The Cybersecurity and Infrastructure Security Agency (CISA), an agency of the US Department of Homeland Security, has released a guide on how to carry out video conferences in a secure way. In essence, CISA has come up with four tips that, when followed, can help you safely connect with others over a video chat. They are:

Make your network secure — Set up your router to use WPA2 or WPA3 wireless encryption standard, and create strong passwords for both the router and your Wi-Fi network.

Control access to your video conferencing software — Create strict policies, processes, and procedures so that only the right people can use your video conferencing software.

Create a secure environment for file and screen sharing — establish secure rules regarding the types of files that can be shared during a video conference. Also, if you want to make a recording of the meeting, let all participants know about that.

Use only the latest versions of your applications — enable automatic updates and follow a patch management policy to make sure your applications are up-to-date and as secure as they can be.

Most Secure Video Conferencing Software

Here are what we consider to be the best video conference tools available on the market today. They are:

ZoHo Meeting – a video conferencing platform that not only provides all the communication features needed to connect with other team members, but it also encrypts all audio, video, and screen sharing to make sure all information – both personal and business – is safe and sound. Using ZoHo Meeting, you can easily record your meeting and share it with the people you trust. Plus, as a host, you can “lock” the meetings so that they are fully private. This means you are in full control of who can join the meeting and be able to add/remove participants at any time.

Microsoft Teams – probably one of the most popular video conferencing tools available on the market, Microsoft Teams is a secure video conferencing service that comes with a wide range of features that can help you set up and carry out video conferences with ease. Not only does it allow you to connect with up to 10.000 people at once for a live event, but it also enables you to go from a group chat to a video conference with the press of just one button. This is convenience at its highest.

Pexip — a video conferencing tool that makes security one of its highest priorities. With Pexip, you can set up PIN-protected virtual meeting rooms that allow you to keep communication private. As a host, you can see all participants taking part in the meeting and thus be sure that no eavesdropping is attempted. If you are looking for a secure video conferencing platform, you should give Pexip a go.

Google Meet – a video conferencing service developed by Google that allows users to host and join virtual meetings. It offers features like screen sharing, real-time captions, and integration with Google Workspace tools, making it ideal for both personal and professional use. Users can engage in encrypted video conferencing through a web browser or mobile app without being required to install any additional software.

Zoom – another highly popular video conferencing platform that lets users set up virtual meetings, webinars, and online events. Offering features like screen sharing, breakout rooms, and virtual backgrounds, it provides functionality for both personal and professional needs. By allowing users to join meetings via a web browser, desktop application, or mobile app, Zoom makes video conferencing an enjoyable experience anywhere, anytime.

The battle of encryption standards

Encryption is the cornerstone of online data security. It ensures that confidential information is accessible only to its owner or authorized recipients, making it nearly impossible for cybercriminals to open or use the files, even if they somehow get ahold of them.

But there’s not just one way to encrypt data. Multiple encryption algorithms exist to help protect sensitive information, and naturally, debates arise over which one is the best.

In this article, we’ll dive into two leading encryption algorithms, XChaCha20 and AES-256. We’ll explore how they work and how they differ, trying to determine which one might be better. Let’s start by defining both.

What is AES encryption?

AES is a type of encryption that uses the same key for both encrypting and decrypting data, which is why it’s called symmetric encryption. It works by chopping data into small blocks and then using that single secret key to scramble and unscramble the information. Known for being both secure and efficient, AES is used by the US government and many other organizations.

How does AES encryption work?

To explain how AES works, we’ll dive into a bit of technical detail, but stick with us if you’re curious about the process. So, as already mentioned, AES breaks your data into blocks (each 128 bits or 16 bytes in size) and encrypts each block separately.

While the block size stays the same, you can choose between 128-, 192-, or 256-bit keys for encryption—more bits mean more possible key combinations and stronger security.

Encryption with AES involves several rounds of processing for each data block. For instance, AES with a 256-bit key goes through 14 rounds. Once encrypted, the data can be sent safely over the web, and only someone with the right key can decrypt it; otherwise, the data is unreadable.

What is XChaCha20 encryption?

Like AES, XChaCha20 is symmetric encryption, which means it uses a single key to scramble and unscramble data. However, XChaCha20 is also a 256-bit stream encryption type, with “stream” referring to the fact that, instead of dividing data into blocks, XChaCha20 encrypts each bit of data one at a time. Some argue that this makes XChaCha20 a better choice than AES, which is why XChaCha20 is often used in modern encryption systems.

How does XChaCha20 work?

XChaCha20 uses a 256-bit key and a 192-bit nonce to generate a keystream—a sequence of random numbers. It encrypts data by combining this keystream with the plaintext using XOR, which compares corresponding bits: if they are the same, the result is 0; if they are different, the result is 1.

This process scrambles the data in a way that can be reversed for decryption. The larger nonce size in XChaCha20 helps prevent security issues related to nonce reuse, enhancing its overall security.

Key differences between XChaCha20 and AES

We know that technical details can be a lot to take in. So, to make things easier, we’ve created a simple bulleted list that breaks down the differences between the two encryption algorithms. Here’s a straightforward comparison:

AES encryption

• Older: AES has been around since 2001.

• Block-based: Works with fixed-size blocks of data (128 or 16 bits).

• More complex: Involves multiple rounds of encryption with key sizes of 128, 192, or 256 bits.

• Hardware-dependent: Often requires hardware support for optimal performance.

• Prone to human error: Key management and nonce handling can be tricky, leading to potential errors.

XChaCha20

• More modern: XChaCha20 was introduced in 2014.

• Stream-based: Encrypts data bit by bit using a stream cipher.

• Simpler: Faster to implement with a 256-bit key and a 192-bit nonce.

• Less hardware-dependent: Doesn’t always require hardware support for efficient performance.

• Less prone to human error: Larger nonce size helps reduce issues with nonce reuse and simplifies key management.

The main difference between AES-256 and XChaCha20 encryption is that AES-256 is a block cipher, meaning it encrypts data in fixed-size chunks, while XChaCha20 is a stream cipher that handles data one bit at a time. AES-256 has a long-standing reputation as the “advanced encryption standard,” while XChaCha20 is relatively new but gaining popularity.

AES-256 encryption is more complex than XChaCha20, which comes with a few drawbacks:

1. The more complex the algorithm, the higher the chance of mistakes that could put your data at risk.

2. AES-256 often needs special hardware to run efficiently, whereas XChaCha20 works well on regular software. For example, newer Intel, AMD, and ARM processors support AES, but older or entry-level devices like Android Go phones, smart TVs, and smartwatches may not have built-in support.

3. Without that special hardware, AES-256 can be significantly slower compared to XChaCha20.

Use cases and industry adoption

As we discussed earlier, AES has become a popular encryption standard across many industries. You’ll find it widely used in finance, healthcare, and government services. However, XChaCha20 is starting to make waves, especially in areas where high security and performance are critical, like mobile devices and IoT applications.

One of the key reasons for its growing popularity is that XChaCha20 is less susceptible to certain side-channel attacks compared to AES, making it a top pick for situations that demand extra security.

XChaCha20 vs. AES – which is better?

Although both AES and XChaCha offer high security and are useful in various scenarios, the speed and simplicity of XChaCha20, along with its ability to run smoothly without specialized hardware, are making it a popular choice for many companies—even Google.

On top of that, key management is much easier with XChaCha20. The longer nonce it uses reduces the risk of collisions and simplifies the process overall, making implementations more straightforward and less prone to errors.

Here at NordPass, we know how crucial it is to stay ahead of the curve and provide our customers with the best, most up-to-date tech solutions. That’s why we’ve chosen XChaCha20 encryption for our password manager. With its speed, simplicity, and ease of use, it’s likely that more companies will follow suit in the future.

Bottom line

Both AES-256 and XChaCha20 are great at encrypting and, therefore, securing sensitive data. But XChaCha20 really shines when it comes to simplicity and speed, making it a better choice for situations where you need both top performance and easy setup.

First, what is SaaS security?

The term software-as-a-service (SaaS) security refers to the measures and security protocols implemented to safeguard the data, applications, and infrastructure associated with SaaS solutions used by a given organization.

To put it differently, SaaS cybersecurity is about implementing the right strategies to protect an organization against unauthorized access, data breaches, and other security threats that may compromise the confidentiality, integrity, and availability of its SaaS-based resources.

So, the core focus of SaaS security requirements is making sure the digital tools and data you use through SaaS services are safe and sound. This is usually achieved through incorporating measures such as encryption (to maintain the confidentiality and integrity of the data), authentication (to verify user access), and access control (to manage permissions). In addition, SaaS security monitoring plays a crucial role in overseeing these measures and ensuring their effectiveness. Regular security assessments are also necessary to identify and address potential vulnerabilities.

The most common SaaS security threats

Switching to SaaS is a significant move for businesses aiming for success, even though it means they sometimes have to give up some control over how their data is handled, how apps are managed, and how systems are customized.

This shift in approach, known as SaaS security management, introduces its own set of risks, particularly concerning SaaS data security. Let’s now explore the top seven challenges that organizations using SaaS solutions must face these days:

Data breaches — Unauthorized access to sensitive information can result in data breaches, leading to the exposure of confidential data.

Phishing attacks — Cybercriminals can use various social engineering techniques to trick users into revealing sensitive information, compromising the security of SaaS accounts.

Insecure interfaces and APIs — Vulnerabilities in interfaces and application programming interfaces (APIs) can be exploited by cybercriminals, which poses a risk to data integrity and security.

Insufficient data encryption — When the protective layer around your information during transmission or storage isn’t strong enough, it makes it easier for unauthorized parties to intercept or access your data without permission.

Account hijacking — Cyberattackers might break into user accounts, getting unauthorized access to potentially mess with or steal data.

Configuration flaws — Improperly configured SaaS settings can lead to security vulnerabilities, creating opportunities for unauthorized access or data exposure.

Non-compliance issues — Failing to meet regulatory compliance standards can not only result in legal consequences but also jeopardize the overall security of SaaS applications.

Increase your online security

Identify breaches before they harm your business

Start Free Trial

What is SaaS Security Posture Management (SSPM)?

SaaS Security Posture Management (SSPM) is a strategic approach that organizations can adopt to help ensure SaaS application security. In other words, it involves continuously monitoring, assessing, and improving the security of the company’s SaaS applications to protect it from potential threats and vulnerabilities.

The key benefits include enhanced visibility into the security of SaaS applications, which allows organizations to quickly identify and address any issues. Additionally, SSPM helps ensure compliance with security policies and regulations, reducing the risk of data breaches and improving the overall security posture.

SaaS security: Best practices

When it comes to keeping your online activity safe and sound, especially with software as a service (SaaS) applications, it’s crucial to follow the best practices outlined in what we refer to as “the SaaS security checklist.” Here are the most crucial guidelines:

Protect data using encryption

Encryption plays a vital role in ensuring the security of sensitive data. The way it works is by transforming sensitive information into an unreadable code, decipherable only by authorized parties possessing the right decryption key. This protective measure can help secure your data both in transfer and at rest so that confidential information remains confidential.

Implement identity and access management tools

Identity and access management (IAM) are essential tools in software as a service (SaaS) environments, helping control access to applications and data. In essence, IAM solutions help you make sure that only authorized individuals have the necessary permissions, reducing the risk of unauthorized access and data breaches. IAM is also involved in tasks like setting up, removing, and overseeing user identities throughout their time using the system.

Introduce effective authentication methods

Using multi-factor authentication (MFA) is a way to take your organization’s SaaS security standards to the next level. When you enable this feature, users will be required to provide more than just a password — for example, a special code or a security token — to confirm their identity and get access to company resources. Therefore, MFA makes it much harder for someone to get in without permission, giving an added layer of protection beyond the usual passwords. Making MFA a key component of your SaaS security solution can help ensure that sensitive data and resources are securely protected.

Become compliant with data privacy standards

Achieving compliance with data protection standards such as the General Data Protection Regulation (GDPR) or the Health Insurance Portability and Accountability Act (HIPAA) underscores an organization’s ability to legally and securely handle sensitive data. Therefore, if a company aims to ensure the safety of the data it stores, nurture customer trust, and avoid potential legal complications, it must prioritize compliance efforts, regularly update policies, and educate employees on the significance of adhering to the standards.

Raise awareness among your customers

It’s no surprise that human error plays a huge role in SaaS cybersecurity. Gartner even predicts that by 2025, 99% of cloud security breaches will be due to customer mistakes. To help avoid these issues, it’s crucial to keep both new and existing customers updated on any system changes. They need to know how each update might impact their security and how their actions could potentially jeopardize it.

Moreover, as more companies shift to cloud-based systems, some customers might not fully understand the risks involved with that transition. That’s why you need to make sure they’re informed on how to keep their information safe and avoid security problems when dealing with your SaaS applications.

Ask the provider about certifications

One of the most important steps toward ensuring a secure SaaS environment is teaming up with the right cloud services provider. Therefore, before making a decision, it’s essential to do your research. Ask potential providers about their certifications and the standards their solutions adhere to, particularly regarding SaaS network security.

For instance, you might want to check for compliance with certificates like SOC 1, SOC 2, and ISO 27001, but also consider other relevant certifications based on your specific needs. Also, be sure to request documentation from providers to check if their solution meets your security requirements, and choose the one that offers the best value.

Improve SaaS security with NordPass

All the practices we mentioned above can be followed by using just one cybersecurity solution, NordPass. Let us prove it to you.

First, NordPass is an encrypted password management platform, which means that you and your team can use it to securely and easily generate, store, manage, and share company credentials, knowing that they are protected by advanced encryption algorithms.

Second, you can use NordPass as an identity and access management (IAM) tool, ensuring the secure provision of access to company data, services, and applications. In other words, with NordPass, you have full control over access to company resources, plus, you can monitor all company logins in real time so that you know exactly who accessed what and when.

Third, NordPass enables multi-factor authentication (MFA) and the single sign-on (SSO) method, allowing you to double-check and confirm the identity of each user whenever they attempt to access one of the company accounts.

Fourth, NordPass can play a crucial role in helping you meet regulatory compliance by adhering to some of the most essential data privacy standards such as HIPAA. Also, you can use the platform to set up various rules, procedures, and policies in a way that will allow your organization to be in line with specific requirements.

Of course, there is a lot more to NordPass than we can discuss in just one blog post. So if you want to learn more about how it can help your organization improve its cybersecurity and productivity.

We’re sorry, passwords – you’re just not enough anymore

There was a time when passwords were our go-to for authentication. When they were made strong, they were reliable, tough to guess, and hard to crack. These days, however, with hackers using highly sophisticated phishing tactics and advanced password-cracking algorithms, passwords have been reduced to a weak link in our security practices. Sad but true.

And so, it’s time for us to explore better options for protecting our accounts and data. This means moving to a passwordless approach, which might sound a bit daunting but can actually make things more secure and user-friendly. Let us explain a bit more.

Limitations of password-based authentication

An average internet user has around 170 online accounts. Let’s suppose you have fewer, say, 40 accounts. Even then, once you start using a strong, 16-character password for each and every one of those accounts, you’ll quickly see it’s not a convenient method of ensuring online protection. And the problem is, it’s not so safe anymore, either.

According to Verizon’s 2023 Data Breach Investigations Report, stolen credentials are among the top three main methods of accessing organizations. This happens for a few reasons. First, many people reuse passwords across multiple accounts, so if one account is compromised, it can lead to others being at risk, too. Second, a lot of people use weak passwords that are easy to guess or crack. Third, cybercriminals trick users into revealing their login details through phishing. Additionally, many users don’t use multi-factor authentication (MFA), which normally provides an extra layer of security when hackers get ahold of their login credentials.

With these security concerns in mind, some organizations have explored the possibility of getting rid of passwords altogether and replacing them with something better. This brings us to WebAuthn.

What is WebAuthn, exactly?

Developed by the World Wide Web Consortium (W3C) in collaboration with the FIDO Alliance, WebAuthn is a web standard for secure authentication based on public-key cryptography. In simpler terms, WebAuthn allows users to log in to websites without using passwords, instead relying on biometrics, security keys, or other authenticators like passkeys.

The main goal of WebAuthn is to provide a more secure alternative to passwords, creating a safer online environment and significantly reducing the risk of phishing and other cyberattacks. Importantly, WebAuthn is backed by major web browsers and platforms, so you get a seamless and secure experience no matter what device or service you’re using.

So, how does WebAuthn work?

The process is pretty straightforward, and once you know the steps, you can easily visualize WebAuthn in action. Here’s how it works in a nutshell:

1. Signing up: When you register for a service, the server sends a random value (also known as a “challenge”) to your device.

2. Creating keys: Your device uses this challenge to generate a pair of keys: a public key, which is sent to and stored on the server, and a private key, which remains safely on your device.

3. Logging in: Each time you log in, the server sends a new challenge. Your device encrypts this challenge with the private key, and the server verifies the encrypted data using the public key it has stored.

The whole idea is to keep your private key safe, even if the server gets hacked. This way, unauthorized parties can’t get access because the private key never leaves your device.

The benefits of WebAuthn

The WebAuthn standard is a real game-changer for everyone involved, though the benefits vary depending on whether you’re an end-user or a business. So, let’s now break down what each side can potentially gain and dive into how WebAuthn can help both hit a home run.

End-users

The biggest benefit for users is how much easier and quicker logging in becomes. No more hassle with complex passwords – often, it’s just one click to get into your accounts. And you don’t have to stress about security, either. WebAuthn boosts your privacy by using advanced cryptography, making it nearly impossible for cybercriminals to get into your accounts. Plus, it seriously cuts down on the risk of password theft and phishing attacks.

Businesses

For businesses, WebAuthn is a way to fight off the growing threat of credential-based cyberattacks. By adopting this standard, organizations can enhance their security posture with minimal disruption, as WebAuthn integrates smoothly with existing systems and workflows. This transition also translates into cost savings and improved operational efficiency by reducing password-related support requests. Not to mention the fact that businesses that implement WebAuthn can elevate their reputation by being seen as security-conscious.

WebAuthn in practice – popular use cases

Thanks to organizations like the FIDO Alliance, WebAuthn is gaining traction across many different sectors. In e-commerce, it’s revolutionizing the way customers log in and pay, making transactions more secure and smoother. Banking institutions have started to use WebAuthn to safeguard online transactions and account access, adding a robust defense against unauthorized access. Social media sites are also jumping on board, using WebAuthn to fend off phishing attacks and streamline the login process for their users. There are many other industries where WebAuthn has made a significant impact, which is why it’s becoming a technology that might soon make passwords a relic of the past.

Challenges and limitations

This might sound a little bold, but there are no major challenges or limitations when dealing with WebAuthn. While there might be some obstacles, they can be easily addressed with common-sense actions or by using available tools. Let us explain.

First, for WebAuthn to work properly and provide the right level of security, biometric data must be handled with the utmost care, ensuring it is protected against unauthorized access and misuse. This is a straightforward practice and essential for maintaining user trust. Though some might find this a big challenge, it is manageable with current security protocols and best practices, making it more of a standard requirement than a hurdle.

Second, some might argue that reliance on biometric devices may not be universally available or convenient for all users. However, as biometric technology becomes more prevalent in our digital lives, this concern is diminishing. NordVPN’s survey shows that more than 50% of Americans use biometrics daily, while other research indicates that over 80% of smartphones have biometric capabilities. So, we’re on track to make it a global standard.

Third, some claim that implementing passwordless solutions can be complex for developers, requiring companies to make significant investments and extra effort. However, there are already tools available that simplify this process, enabling businesses to implement password-free logins based on passkeys with ease. One such tool is Authopia.

Introduce passwordless logins for your customers today

Dedicated to helping organizations make passwordless options part of their login experience, we’ve created a tool called Authopia that allows them to easily add a passkey widget to their website or service.

It’s super simple to use: you just grab the pre-written code, have someone with basic IT knowledge implement it, register your product with Authopia, and voilà – you’ve got a passkey option available for your customers. It’s quick, efficient, and doesn’t require a big investment or the hiring of additional IT specialists. So, if you want to be ahead of the curve and enhance your login experience, consider giving Authopia a try.

If you need more info on going passwordless, check out our other materials, like the one where we compare passwords and passkeys to help you decide which is best.