Risk

6/6/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Security To-Dos For The Entertainment Industry

'The biz' has unique security needs. And it isn't only about preventing 'the next Sony.'

The 2014 disaster at Sony Pictures Entertainment, which was the cherry on top of a very sweet year for cyberattackers, was a watershed moment for the entertainment industry, says Eric Friedberg, co-founder and chairman of risk management firm Stroz Friedberg. Entertainment companies realized that cybercrimes were a legitimate and severe threat to their businesses...but that didn't mean they had an accurate understanding of what they needed to protect and how to protect it.

"The crown jewels [for the entertainment industry]," says Friedberg, "typically involve pre-release content, the ability to broadcast, email, and ... strategic plans." Risk assessments, therefore, should focus on looking for the likely vectors against those assets and tailoring security efforts accordingly, he says.

Pre-release content -- for example, films that are still in the final stages of production or television shows that have not been aired yet -- is both extremely valuable and confidential. Leaked content could be valuable to both pirates or competitors. So all production houses have strict internal policies about monitoring chain of custody and restricting access. However, there is often a large gap between what the policy says and what the users actually do, says Friedberg. He suggests that when calling in penetration testers, these would be the particular gaps and holes to ask them to go looking for first.  

Not all pre-release content needs to be treated the same, though, he says, because not all of it is at high risk for piracy. Millions of viewers salivate at the faintest scent of an upcoming episode of Game of Thrones or The Walking Dead; so the pirates who can sate fans' hunger a few days early could make a lot of money. If a show only has a few viewers to begin with, then why would pirates invest in stealing it, and why should entertainment companies invest in protecting it against piracy?  

Just because content is not monetizable or a target of piracy, however, does not mean it should be left unprotected altogether, says Friedberg. There are other attacks and other attackers to worry about, as Sony learned to their detriment. Hacktivists' motives might be simply to injure or destroy.

Destructive attacks are notoriously hard to stop, but Friedberg says that if a certain project or company is expected to be a target of hacktivists "especially if they have had a history of drawing the attention of activists," he says, "we night work with them very proactively on DDOS prevention," for example.

The DDOSes in question could be quite severe. For example, in April 2014, French network TVMonde5 was attacked, its television broadcast interrupted for hours, and its website and social networking profiles defaced. Cyber Caliphate (a pro-ISIS hacktivist group) claimed responsibility for the attack, (although investigators later stated that Russian APT group Pawn Storm might be involved). 

One basic, but often overlooked way that entertainment companies can better protect themselves is to segregate their production/broadcast networks from their office networks -- like segregating classified from unclassified networks.

Just as important as preparing the kinds of attacks hacktivists might commit, says Friedberg, is that entertainment companies put in place processes by which they look at their content through the eyes of potential hacktivists, so they can prepare for their risks accordingly.

"Track all the haters out there," he says, "classify them into low, medium, high risk ... and understand whether or not that risk is changing." Those risk assessments are based not only on how angry certain groups of "haters" will be, but on the fluctuating maturity of their cyberattack capabilities, he says. Just because a threat actor isn't prepared to launch a devastating attack today doesn't mean they can't tomorrow (on their own, or with their help of a new friend).

Friedberg also mentions that the entertainment industry also has some of the same concerns every other company has: like regulatory compliance and users who use poor social networking judgment and password management. 

Despite all the cases of celebrities having their social network accounts hacked, Friedberg says that the "beautiful people" apparently don't learn from the experiences of their fancy friends. Even celebs "really don't do anything to protect themselves until they've been attacked." 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RiskSenseMediaRelations
50%
50%
RiskSenseMediaRelations,
User Rank: Apprentice
6/7/2016 | 4:15:01 PM
Right on Target
Very interesting article... Many new media companies are prime targets for hackers, as they hold high valuable IP.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10739
PUBLISHED: 2019-01-21
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possib...
CVE-2019-6499
PUBLISHED: 2019-01-21
Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\server.xml) that could potentially be exploited by malicious users to compromise the affected system.
CVE-2019-6500
PUBLISHED: 2019-01-21
In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.
CVE-2019-6498
PUBLISHED: 2019-01-21
GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.
CVE-2019-6497
PUBLISHED: 2019-01-20
Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.