Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/6/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Top Security To-Dos For The Entertainment Industry

'The biz' has unique security needs. And it isn't only about preventing 'the next Sony.'

The 2014 disaster at Sony Pictures Entertainment, which was the cherry on top of a very sweet year for cyberattackers, was a watershed moment for the entertainment industry, says Eric Friedberg, co-founder and chairman of risk management firm Stroz Friedberg. Entertainment companies realized that cybercrimes were a legitimate and severe threat to their businesses...but that didn't mean they had an accurate understanding of what they needed to protect and how to protect it.

"The crown jewels [for the entertainment industry]," says Friedberg, "typically involve pre-release content, the ability to broadcast, email, and ... strategic plans." Risk assessments, therefore, should focus on looking for the likely vectors against those assets and tailoring security efforts accordingly, he says.

Pre-release content -- for example, films that are still in the final stages of production or television shows that have not been aired yet -- is both extremely valuable and confidential. Leaked content could be valuable to both pirates or competitors. So all production houses have strict internal policies about monitoring chain of custody and restricting access. However, there is often a large gap between what the policy says and what the users actually do, says Friedberg. He suggests that when calling in penetration testers, these would be the particular gaps and holes to ask them to go looking for first.  

Not all pre-release content needs to be treated the same, though, he says, because not all of it is at high risk for piracy. Millions of viewers salivate at the faintest scent of an upcoming episode of Game of Thrones or The Walking Dead; so the pirates who can sate fans' hunger a few days early could make a lot of money. If a show only has a few viewers to begin with, then why would pirates invest in stealing it, and why should entertainment companies invest in protecting it against piracy?  

Just because content is not monetizable or a target of piracy, however, does not mean it should be left unprotected altogether, says Friedberg. There are other attacks and other attackers to worry about, as Sony learned to their detriment. Hacktivists' motives might be simply to injure or destroy.

Destructive attacks are notoriously hard to stop, but Friedberg says that if a certain project or company is expected to be a target of hacktivists "especially if they have had a history of drawing the attention of activists," he says, "we night work with them very proactively on DDOS prevention," for example.

The DDOSes in question could be quite severe. For example, in April 2014, French network TVMonde5 was attacked, its television broadcast interrupted for hours, and its website and social networking profiles defaced. Cyber Caliphate (a pro-ISIS hacktivist group) claimed responsibility for the attack, (although investigators later stated that Russian APT group Pawn Storm might be involved). 

One basic, but often overlooked way that entertainment companies can better protect themselves is to segregate their production/broadcast networks from their office networks -- like segregating classified from unclassified networks.

Just as important as preparing the kinds of attacks hacktivists might commit, says Friedberg, is that entertainment companies put in place processes by which they look at their content through the eyes of potential hacktivists, so they can prepare for their risks accordingly.

"Track all the haters out there," he says, "classify them into low, medium, high risk ... and understand whether or not that risk is changing." Those risk assessments are based not only on how angry certain groups of "haters" will be, but on the fluctuating maturity of their cyberattack capabilities, he says. Just because a threat actor isn't prepared to launch a devastating attack today doesn't mean they can't tomorrow (on their own, or with their help of a new friend).

Friedberg also mentions that the entertainment industry also has some of the same concerns every other company has: like regulatory compliance and users who use poor social networking judgment and password management. 

Despite all the cases of celebrities having their social network accounts hacked, Friedberg says that the "beautiful people" apparently don't learn from the experiences of their fancy friends. Even celebs "really don't do anything to protect themselves until they've been attacked." 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RiskSenseMediaRelations
50%
50%
RiskSenseMediaRelations,
User Rank: Apprentice
6/7/2016 | 4:15:01 PM
Right on Target
Very interesting article... Many new media companies are prime targets for hackers, as they hold high valuable IP.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-1927
PUBLISHED: 2020-04-02
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
CVE-2020-8144
PUBLISHED: 2020-04-01
The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware u...
CVE-2020-8145
PUBLISHED: 2020-04-01
The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup� and “wizard� endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP ...
CVE-2020-8146
PUBLISHED: 2020-04-01
In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the win...
CVE-2020-6009
PUBLISHED: 2020-04-01
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.