Securing the Modern Boardroom: How to Network Zoom Rooms, Teams Rooms, Smart Displays and Guest Presentations
Modern conference rooms are no longer a TV and a cable. Today's boardrooms run dedicated room systems from vendors like Poly, Neat and Logitech — displays, touch controllers, soundbars, cameras and microphones working together as Zoom Rooms or Microsoft Teams Rooms.
Behind every smooth video call sits an infrastructure decision most organizations never make deliberately: which network should these devices live on, and how should guests present?
My position is clear. Here is the framework I recommend.
1. Prefer Wired, Avoid Wi-Fi
For room devices (touch panels, video bars, soundbars, smart displays), I recommend hardwired Ethernet wherever possible. Microsoft itself strongly recommends wired connections for Teams Rooms.
- Stability: Real-time audio and video need low latency and low jitter. A cable removes wireless congestion and packet loss from your most visible meetings.
- Power over Ethernet (PoE): Controllers, touch panels and video bars often run on PoE/PoE+, which means fewer power adapters and fewer points of failure.
2. Put the Whole Room on a Dedicated Guest Network
Recommended: a dedicated internet line for guests and meeting rooms
Purchase a separate internet line that serves only guests and meeting-room equipment — displays, video bars, controllers, smart TVs and guest devices — with its own switches and access points. Nothing on it should ever touch the corporate network.
- Connect the entire meeting room to this dedicated guest network, and enable client isolation so devices can't reach one another — with only explicitly allowed presentation paths as exceptions. A guest laptop shouldn't be able to reach the room's cameras and microphones.
- Allow outbound traffic only to the Microsoft or Zoom service endpoints the room devices need, apply QoS for media, and exempt the devices from proxy authentication.
- Disable unused wall ports.
Less secure alternative: one main internet line with logical separation
If everything must run on the company's main line, the minimum is: dedicated VLANs for guests and meeting rooms, a default-deny firewall between zones, client isolation on every guest and room network, switches hardened against VLAN hopping, and 802.1X or MAC authentication on room ports.
It works — but logical separation on shared switches still leaves the corporate network one misconfiguration or one compromised switch away from an untrusted device. I'd treat it as a temporary state and put a dedicated line on the roadmap.
3. Guest Presentations: Prefer a Cable — but Never USB
- Preferred — HDMI into the room system: The guest's laptop connects to the video bar or room controller. Content is shared, and the guest gets no access to your internal network.
- No USB from guests: Guests should never plug USB cables or devices into room equipment. Malicious USB-C cables that look like ordinary chargers can pose as a keyboard and inject commands, while USB opens a potential data channel into the room system. Treat every guest cable as untrusted, and block unused USB ports on room PCs and consoles.
- Wireless sharing and wireless BYOD: Acceptable when cabling isn't an option. Client isolation blocks local casting by design, so prefer cloud-based sharing built into Zoom or Teams (sharing key or casting): the laptop and the room device each connect to the cloud, never to each other — which also lets employees on the corporate network present without joining the guest network. If you use a wireless presentation system (such as ClickShare or AirMedia), prefer its direct wireless link; if it must run over the guest network, keep client isolation on and allow guests to reach only the base unit on its required ports. Require an on-screen code, and turn sharing off when not needed.
- Consumer streaming boxes: I recommend avoiding unmanaged Apple TV, Chromecast or Android TV devices. They rely on discovery protocols (mDNS/SSDP) that encourage flat networks and add attack surface. If the business truly needs AirPlay, use an MDM-supervised Apple TV locked in Conference Room Display mode, on the guest network — never on the corporate LAN — with an explicit isolation exception and a controlled mDNS gateway, since AirPlay won't work through client isolation otherwise.
4. Treat Smart TVs as Untrusted Endpoints
Smart TVs and interactive displays often run firmware of unknown provenance, collect viewing data (ACR), and receive irregular security updates.
- Used only as a monitor? Consider keeping it off the network entirely.
- Needs internet? Connect it only to the guest network with client isolation, and disable ACR, voice assistants and built-in microphones.
- Prefer commercial-grade displays with a published update policy over consumer TVs.
5. Don't Forget the Devices Themselves
- Manage room systems centrally (Teams Rooms Pro Management, Zoom Device Management) and keep firmware up to date.
- Change default admin passwords and disable unused services such as SSH or local web admin.
- Restrict room resource accounts with conditional access scoped to room devices.
- Mind the physical layer: block unused USB ports, and use cameras with privacy shutters and clear mute indicators.
A Small Investment, a Large Risk Removed
A dedicated internet line and a few switches cost far less than a breach, ransomware recovery or a leaked board discussion. For IT leaders, it is one of the easiest security wins to justify in the annual budget.
Key Takeaways for IT Leaders
- Prefer wired connections and avoid Wi-Fi for room devices.
- Consider a dedicated internet line for guests and meeting rooms, with its own switches and access points.
- Connect the whole meeting room to that guest network, with client isolation enabled and only explicit exceptions for presentation.
- If you must share the main line, segment with VLANs, a firewall and client isolation — and plan the move to a dedicated line.
- For guests, prefer HDMI, never USB, and use cloud-based wireless sharing as a fallback.
- Avoid unmanaged consumer streaming devices, and treat smart TVs as untrusted.