When planning for new technology acquisition, organizations should consider including webcam privacy shutters as a requirement for laptop computers.
Control Type: Physical
Control Function: Preventive
Camfecting is one of the more viscerally upsetting adversarial techniques one can encounter. It involves an adversary remotely turning on a victim’s laptop webcam, usually with the goal of blackmail or targeted surveillance. Oftentimes, camfecting attacks remain dormant and undetected by the victim, with the webcam light sometimes not even turning on to indicate it is being used.
While you won’t typically run into a camfecting attack on a regular basis, it is still a serious threat that should be addressed. Luckily, many modern laptop vendors produce models including a privacy shutter. These are small sliding caps that slide on and off a laptop’s webcam at the user’s discretion. This way, a user can attend Zoom meetings, film lectures, or take a selfie for a job application at their own discretion. When the user is done, they can simply slide the shutter over the webcam and go on to other digital tasks without the lurking fear that somebody could be watching them.
Organizations should at least factor in the presence of privacy shutters when purchasing mobile endpoint devices. Organizations typically purchase endpoints in bulk from vendors such as Dell, HP, Lenovo, or Acer. When preparing to purchase new endpoints for the next refresh cycle, organizations should make note of privacy shutters in the Request for Information (RFI) to the vendor. While they are not a 100% required physical security control, privacy shutters are a great way to protect human resources and signal that the organization cares about the individual privacy of each employee.