You can't safely assume all your employees are properly assessing the risks unless that is their actual job. If you only allow what you know then you can reason about your risk.
Engineers aren’t clamoring to get into the kinds of companies where IT needs to pre-approve software for their workstations.
Of course, after years and years and hundreds of thousands of engineers, the whitelist is pretty robust.
I don't know for sure, but I bet Zoom has been on that whitelist, and "banning" is removing it from that whitelist.
Our laptops are configuration managed, force upgraded, and surveilled, but we all have root and IT has never stood in the way of "power user" behavior. The extent of the frustration in engineering is that their management processes sometimes eat CPU. My understanding is that most of the Valley is like this.
Installing third-party software on corp devices is generally a no-go at a lot of workplaces. With the security problems that Zoom has been having, it's only prudent of IT to ban its use on work devices.
> Why would forcing use of web version mitigate any concerns?
Because the web version runs in a browser sandbox, so there's a reduced risk of it compromising the security of the corp device.
> The concerns I have heard are lack of proper end-to-end encryption, servers in China and the possibility to join chatrooms by guessing a name (zoom-bombing)).
Googlers don't use Zoom for work, they use it for personal stuff, so that's not the problem.
From the perspective of a generic IT department: Even if there aren't any security problems with having the client installed on your workstation - the problem is that when they've made so many amateurish security mistakes, it's difficult for IT to trust the binary blob that Zoom wants you to install on your computer.
Corporate device security is a series of safety-versus-efficiency tradeoffs, made with incomplete information. Banning Zoom does not really compromise efficiency, if you aren't using it for work stuff.
https://www.cvedetails.com/vulnerability-list/vendor_id-2159...
There is nothing new/outstanding.
Once may have been an honest mistake; 2+ times is now a pattern.
"For those who have no choice but to use Zoom, including in contexts where secrets may be shared, we speculate that the browser plugin may have some marginally better security properties, as data transmission occurs over TLS."
Apparently the web version doesn't use their homegrown encryption scheme.