Risk

6/6/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Security To-Dos For The Entertainment Industry

'The biz' has unique security needs. And it isn't only about preventing 'the next Sony.'

The 2014 disaster at Sony Pictures Entertainment, which was the cherry on top of a very sweet year for cyberattackers, was a watershed moment for the entertainment industry, says Eric Friedberg, co-founder and chairman of risk management firm Stroz Friedberg. Entertainment companies realized that cybercrimes were a legitimate and severe threat to their businesses...but that didn't mean they had an accurate understanding of what they needed to protect and how to protect it.

"The crown jewels [for the entertainment industry]," says Friedberg, "typically involve pre-release content, the ability to broadcast, email, and ... strategic plans." Risk assessments, therefore, should focus on looking for the likely vectors against those assets and tailoring security efforts accordingly, he says.

Pre-release content -- for example, films that are still in the final stages of production or television shows that have not been aired yet -- is both extremely valuable and confidential. Leaked content could be valuable to both pirates or competitors. So all production houses have strict internal policies about monitoring chain of custody and restricting access. However, there is often a large gap between what the policy says and what the users actually do, says Friedberg. He suggests that when calling in penetration testers, these would be the particular gaps and holes to ask them to go looking for first.  

Not all pre-release content needs to be treated the same, though, he says, because not all of it is at high risk for piracy. Millions of viewers salivate at the faintest scent of an upcoming episode of Game of Thrones or The Walking Dead; so the pirates who can sate fans' hunger a few days early could make a lot of money. If a show only has a few viewers to begin with, then why would pirates invest in stealing it, and why should entertainment companies invest in protecting it against piracy?  

Just because content is not monetizable or a target of piracy, however, does not mean it should be left unprotected altogether, says Friedberg. There are other attacks and other attackers to worry about, as Sony learned to their detriment. Hacktivists' motives might be simply to injure or destroy.

Destructive attacks are notoriously hard to stop, but Friedberg says that if a certain project or company is expected to be a target of hacktivists "especially if they have had a history of drawing the attention of activists," he says, "we night work with them very proactively on DDOS prevention," for example.

The DDOSes in question could be quite severe. For example, in April 2014, French network TVMonde5 was attacked, its television broadcast interrupted for hours, and its website and social networking profiles defaced. Cyber Caliphate (a pro-ISIS hacktivist group) claimed responsibility for the attack, (although investigators later stated that Russian APT group Pawn Storm might be involved). 

One basic, but often overlooked way that entertainment companies can better protect themselves is to segregate their production/broadcast networks from their office networks -- like segregating classified from unclassified networks.

Just as important as preparing the kinds of attacks hacktivists might commit, says Friedberg, is that entertainment companies put in place processes by which they look at their content through the eyes of potential hacktivists, so they can prepare for their risks accordingly.

"Track all the haters out there," he says, "classify them into low, medium, high risk ... and understand whether or not that risk is changing." Those risk assessments are based not only on how angry certain groups of "haters" will be, but on the fluctuating maturity of their cyberattack capabilities, he says. Just because a threat actor isn't prepared to launch a devastating attack today doesn't mean they can't tomorrow (on their own, or with their help of a new friend).

Friedberg also mentions that the entertainment industry also has some of the same concerns every other company has: like regulatory compliance and users who use poor social networking judgment and password management. 

Despite all the cases of celebrities having their social network accounts hacked, Friedberg says that the "beautiful people" apparently don't learn from the experiences of their fancy friends. Even celebs "really don't do anything to protect themselves until they've been attacked." 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RiskSenseMediaRelations
50%
50%
RiskSenseMediaRelations,
User Rank: Apprentice
6/7/2016 | 4:15:01 PM
Right on Target
Very interesting article... Many new media companies are prime targets for hackers, as they hold high valuable IP.
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.