Microsoft Teams: Streaming switchboard for Network Device Interface (NDI) Sources

🚨 The Signal: Teams meetings can now stream NDI sources via a new switchboard. This introduces new vectors for content injection and potential data exfiltration if not properly managed.

The Impact

Security teams and meeting organizers are affected by new risks of unauthorized content injection and data leakage.

• Security Teams: Risk of unauthorized content injection into meetings.
• Meeting Organizers: Need to validate all NDI sources to prevent malicious content.
• Compliance Teams: New data flow paths require review for sensitive information.
• IT Admins: Must manage NDI capabilities to prevent misuse.

The Action

1. Review and update Microsoft Teams meeting policies to restrict NDI usage to authorized users or groups.
2. Educate meeting organizers on the risks associated with NDI sources and best practices for content validation.
3. Implement data loss prevention (DLP) policies to monitor content shared via NDI for sensitive information.
4. Monitor Teams audit logs for NDI source usage and potential policy violations.
5. Consider network segmentation for devices acting as NDI sources to limit potential attack surfaces.

Domain: Teams · Impact: medium · Workload: Teams