LAS VEGAS--At NAB Show 2018, there was plenty of talk about data, connected cars, how to use the data generated and how the data generated needs to be protected. With the proliferation of the Internet of Things (IOT), that is no small task. A Broadcast Engineering and Information Technology Conference presentation, “Hacking Everything: The Dark Side of the Internet” provided some perspective on that task.

IBM security architect Jeff Crume says “with IOT, everything is a computer. A car is not just a car; in fact it’s a computer that carries you places.” That mobile computer (a/k/a “connected car”) contains data on listening, location, and a portal to control vehicle systems. “We have cars on the road today that have twice the amount of code in them, that are in (computer) operating systems.” He raised another point about information security: “All computers can be hacked. If they’re operational, and you give someone enough time, there will be a way to break into it (the computer or device).”

[Read: Akamai: Rise Of IoT Devices Causes Some Security Concerns]

As an example, he mentioned how connected DVR, players and other devices like pacemakers, insulin pumps, even airplanes have had the potential to be hacked. “The way you go in and make changes to these devices, and they have to be changed over time, is through a wireless connection. That means the “good guys” can install patches wirelessly and there remains the potential that the “bad guys” can install patches wirelessly as well, and what they would patch with is not the same thing.”

Crume said “I’m not saying this to be an alarmist; I say this so we get people’s attention and will start working on the problem.”

This article originally appeared in Radio World. 

Here’s another example of the blurring boundaries between “enterprise IT” functions and broadcast engineering: Security. Not so long ago, the IT side of the typical TV broadcaster handled Internet-facing security necessities, like email and firewalls, while the engineering side shored up distribution-related security, usually over dedicated links. Those links were plumbed in Internet Protocol (IP) but didn’t traverse the “big Internet,” so they were, in essence, cordoned off.

These days, securing the attack surfaces of broadcast and media providers is necessarily a collaboration between IT and engineering, increasingly buttressed by top-down mandates to do whatever it takes to keep the bad guys off the digital premises. Just ask TV5Monde, in France, which suffered a massive hack in April of 2015 that took down 12 of its 12 channels overnight. Like so many hacks, the bad guys had gained entry a few months earlier, maneuvering in the background to find the weak spots.

“The real-time nature of broadcast television doesn’t lend itself well to today’s time-to-detect metrics,” which can average 100 days, said Michael Korten, cyber security practice leader for Cisco. “Everyone knows the stresses that come from ads not airing, regardless of the reason.” To use a worst-case example, Super Bowl ads cost around $170,000 per second.

Korten’s group, and in particular Cisco’s Talos division –a team of nearly 300 cyber security experts– live for this stuff. They are scheduled to deliver a full readout of the latest trends during the 2018 NAB Show in Las Vegas. This will happen in the Connected Media IP Theater (which is in the South Hall, Upper Level of LVCC) on Monday, April 9, from noon to 1 p.m. They deliberately won’t compile their report until much closer to the date, so as to capture what happens between now and then. But here’s a short list of best practices and general observations they’ll likely cover:

1. You can’t protect what you can’t see –visibility is job No. 1.

 The prevailing wisdom over the last two or so decades was to buy hardware to secure different types of “perimeters” –the so-called “see a problem, buy a box” solution. Each hole gets plugged with a new thumb, which is fine, until you run out of thumbs. Plus, broadcast and media companies typically average 40 to 50 individual security products. But if the firewall can’t “see” the web security product –and so on down the chain– the entirety of the threat surface can’t easily be visualized, let alone pre-emptively protected.

2. Add “time-to-detect” to your vital metrics.

 According to the Talos folks, the average time-to-detect for enterprise companies (meaning beyond the media/broadcast sector) is 100 days. That’s a little over three months! How to get that vital metric down from months to hours is one of the things they’ll explain during the NAB keynote.

3. Know your attack entrances (which are anywhere there are end points).

 E-mail is a threat surface for its potential to disseminate malicious links. Web searches can be a threat surface because of rogue DNS addresses that redirect to unsafe places. Memory sticks, remote and unsecured (non-VPN) network access, cloud handoff points, connected devices, orphaned or neglected websites –all need to be sussed out, continuously.

4. Attacks increase with each new innovation.

 Whether it’s a new cloud platform, mobile offering or device, if it’s new, digital and “on-net” from production to distribution, it’s probably already being deconstructed somewhere for undesired access. Innovation cuts both ways –the intended uses and the unintended consequences. (This is why security people constantly talk about how security needs to be considered from the get-go of any new product or service and not bolted on at the end.)

5. Have a “before, during and after” plan, and check it frequently. 

Improved visibility across all potential threat surfaces is step one; gaining control after a breach is step two. “The first thing people want to know, after a breach, is scope –can we contain it?” said Cisco’s Korten. “The second thing they want to know is: how bad is it? How much damage, what does remediation look like?” That’s why it’s a good idea to know what levers to pull once the alarms have sounded. (Sometimes, it’s a matter of even having levers to pull.) That means a security blueprint with perimeter detection and a “cloud firewall” designed for real-time threat management and automation. Overall mission: Stay ahead of the hack.

The grim reality about broadcast TV and security is this: Attackers have unlimited opportunities to get where they want to go. They’ll keep trying and trying and trying. We’re likely see more evidence of this, even in the short run-up to the 2018 NAB Show. If this is a topic near and dear to your day-to-day, it might make sense to check out the Talos presentation and the rest of its security portfolio while you’re in Vegas.

This is the third in a six-part blog series preceding the 2018 NAB Show. Click here to read more about what broadcasters will be talking about at this year's show. 

About the Author: Leslie Ellis is a respected “technology translator,” known in cable and telecom circles for her award-winning, 20+ year “Translation Please” column in Multichannel News. She took on this Cisco-sponsored pre-NAB series to point out common and frustrating obstacles, for anyone on the sliding transition toward “being more Internet-like.” It is less of a comprehensive representation of available options and more a glimpse into what’s worrisome, on a day-to-day basis for engineers and IT people who work in media and entertainment.

OTTAWA—In July, HBO’s media content library was hacked when 1.5 TB of data was illegally accessed and downloaded, including unaired episodes of “Ballers,” “Barry,” “Insecure,” and “Room 104,” plus a script for an unaired episode of “Game of Thrones.” These were later made available on the apparently hacker-run website Winter-leak.com, (the site is currently inaccessible but media coverage is available at winter-leak.ml). The result: HBO’s expensively-produced premium content was online for anyone to see for free.

An Akamai Security Operations Center

HBO is just the latest victim of unauthorized entry into its video operations. In April of 2015, hackers claiming allegiance to the Islamic State, (and now potentially believed to be Russian), knocked French-language broadcaster Canal Plus off the air for the better part of a day; in March, 2013, North Korea posed a series of cyber-attacks on South Korea inflicting damage on three major banks and two broadcasters. “The broadcasters were not affected on-air; however, their business IT infrastructure was paralyzed,” according to the white paper “Cyber Security Services for Broadcasters,” by Obor Digital, an Orlando, Fla.-based provider of cyber security solutions for broadcasters.

These kinds of attacks are becoming more common and more serious, said Rob Caldwell founder and CEO for Obor Digital, which, along with TV Technology, conducted a series of Cyber “boot camps” for broadcasters this fall. “In the case of content producers, the threat is to their bottom line,” he said. “Who will pay to see premium video content if hackers are making it available for free?”

Making matters worse is that “broadcasters haven’t yet begun to seriously address the threat of ‘content replacement’ where a hacker or disgruntled employee could potentially replace a commercial spot with media intended to create panic, confusion and chaos,” Caldwell added. Not all threats come from hackers breaking directly into servers either. “All it takes is an employee to bring in a USB flash drive that’s infected with hacker malware—say with some ‘free music’ they downloaded to listen to at work—then plugging the flash drive into the broadcaster’s internal network. All of a sudden, the ‘bad guys’ can get in and steal what they want—and they will.”

There are several caveats broadcasters should be aware of when protecting their valuable media content from online theft and illegal distribution. Here are three of them:

WORK WITH A SECURE CONTENT DISTRIBUTOR

As broadcasters and content creators distribute more of their premium content online, they will invariably come under hacker attacks more often.

So says Dave Lewis, global security advocate the Boston-based streaming provider Akamai. His remedy is for broadcasters and content providers to hook up with a secure content delivery network (like Akamai), which has sophisticated cyber security tools such as web application firewalls (WAF) already in place.

Case in point: A distributed denial of service (DDoS) attack occurs when a hacker floods a web site with so many requests that the site ceases to function, knocking it offline. Unfortunately, such attacks are extremely common these days, and they can result in content distributors being unable to serve paying clients.

To prevent this from happening, “Akamai can provide a line of defense to ensure your web site stays online, so that your customers can be assured that they will have access to your programming during DDoS attacks,” said Lewis. “As well, our platform is extremely secure; making your content far less vulnerable to piracy.

HIRE A PROFESSIONAL 

Originally, the U.S. military decided to use Obor Digital’s Zeus software to track military communications equipment, configurations, failures and repair issues in Afghanistan and Iraq, according to Caldwell. Subsequently, Obor decided to partner with those military cyber specialists and bring this expertise directly to broadcasters.

Cyber security services offered by Obor Digital to broadcasters include “Vulnerability Assessments” to determine a content provider’s operational/IT system weaknesses and remedies for them; ongoing Monitoring (three available levels) to detect and address security threats/attempted intrusions; Security Device Management to ensure that the broadcaster’s security devices are running properly; and Incident Response to step in when an attack succeeds, minimize it, and determine what happened after the fact to keep it from happening again.

GO FULL OUT ON END TO END SECURITY

The Entertainment Security Operations Center in Los Angeles

Los Angeles’ new Entertainment Security Operations Center (ESOC) is an end-to-end response to hacker threats. Built by security solutions provider Secure Channels Inc., ESOC combines a “tier 3” (99.98 percent availability) data center infrastructure with dark fiber tethering (connecting over so-called dark fiber networks that are not otherwise in use), to provide content creators with a totally secure, membership-only production process.

“We only connect your company to other ESOC-checked members, meaning that everyone in your production chain is secure and verified,” said Richard Blech, CEO of the Irvine, Calif.-based company. “Too many times, a major content provider with reasonable security will contract a third-party firm that isn’t secure, putting the entire production/distribution chain at risk. The ESOC model eliminates this risk, because everyone you work with is as secure as you are.” ESOC’s protection extends to member documents and emails, as well as video content.