Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/6/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Security To-Dos For The Entertainment Industry

'The biz' has unique security needs. And it isn't only about preventing 'the next Sony.'

The 2014 disaster at Sony Pictures Entertainment, which was the cherry on top of a very sweet year for cyberattackers, was a watershed moment for the entertainment industry, says Eric Friedberg, co-founder and chairman of risk management firm Stroz Friedberg. Entertainment companies realized that cybercrimes were a legitimate and severe threat to their businesses...but that didn't mean they had an accurate understanding of what they needed to protect and how to protect it.

"The crown jewels [for the entertainment industry]," says Friedberg, "typically involve pre-release content, the ability to broadcast, email, and ... strategic plans." Risk assessments, therefore, should focus on looking for the likely vectors against those assets and tailoring security efforts accordingly, he says.

Pre-release content -- for example, films that are still in the final stages of production or television shows that have not been aired yet -- is both extremely valuable and confidential. Leaked content could be valuable to both pirates or competitors. So all production houses have strict internal policies about monitoring chain of custody and restricting access. However, there is often a large gap between what the policy says and what the users actually do, says Friedberg. He suggests that when calling in penetration testers, these would be the particular gaps and holes to ask them to go looking for first.  

Not all pre-release content needs to be treated the same, though, he says, because not all of it is at high risk for piracy. Millions of viewers salivate at the faintest scent of an upcoming episode of Game of Thrones or The Walking Dead; so the pirates who can sate fans' hunger a few days early could make a lot of money. If a show only has a few viewers to begin with, then why would pirates invest in stealing it, and why should entertainment companies invest in protecting it against piracy?  

Just because content is not monetizable or a target of piracy, however, does not mean it should be left unprotected altogether, says Friedberg. There are other attacks and other attackers to worry about, as Sony learned to their detriment. Hacktivists' motives might be simply to injure or destroy.

Destructive attacks are notoriously hard to stop, but Friedberg says that if a certain project or company is expected to be a target of hacktivists "especially if they have had a history of drawing the attention of activists," he says, "we night work with them very proactively on DDOS prevention," for example.

The DDOSes in question could be quite severe. For example, in April 2014, French network TVMonde5 was attacked, its television broadcast interrupted for hours, and its website and social networking profiles defaced. Cyber Caliphate (a pro-ISIS hacktivist group) claimed responsibility for the attack, (although investigators later stated that Russian APT group Pawn Storm might be involved). 

One basic, but often overlooked way that entertainment companies can better protect themselves is to segregate their production/broadcast networks from their office networks -- like segregating classified from unclassified networks.

Just as important as preparing the kinds of attacks hacktivists might commit, says Friedberg, is that entertainment companies put in place processes by which they look at their content through the eyes of potential hacktivists, so they can prepare for their risks accordingly.

"Track all the haters out there," he says, "classify them into low, medium, high risk ... and understand whether or not that risk is changing." Those risk assessments are based not only on how angry certain groups of "haters" will be, but on the fluctuating maturity of their cyberattack capabilities, he says. Just because a threat actor isn't prepared to launch a devastating attack today doesn't mean they can't tomorrow (on their own, or with their help of a new friend).

Friedberg also mentions that the entertainment industry also has some of the same concerns every other company has: like regulatory compliance and users who use poor social networking judgment and password management. 

Despite all the cases of celebrities having their social network accounts hacked, Friedberg says that the "beautiful people" apparently don't learn from the experiences of their fancy friends. Even celebs "really don't do anything to protect themselves until they've been attacked." 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
RiskSenseMediaRelations
50%
50%
RiskSenseMediaRelations,
User Rank: Apprentice
6/7/2016 | 4:15:01 PM
Right on Target
Very interesting article... Many new media companies are prime targets for hackers, as they hold high valuable IP.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Browsers to Enforce Shorter Certificate Life Spans: What Businesses Should Know
Kelly Sheridan, Staff Editor, Dark Reading,  7/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17366
PUBLISHED: 2020-08-05
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate...
CVE-2020-9036
PUBLISHED: 2020-08-05
Jeedom through 4.0.38 allows XSS.
CVE-2020-15127
PUBLISHED: 2020-08-05
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flip...
CVE-2020-15132
PUBLISHED: 2020-08-05
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that th...
CVE-2020-7298
PUBLISHED: 2020-08-05
Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.