Top Security To-Dos For The Entertainment Industry

The 2014 disaster at Sony Pictures Entertainment, which was the cherry on top of a very sweet year for cyberattackers, was a watershed moment for the entertainment industry, says Eric Friedberg, co-founder and chairman of risk management firm Stroz Friedberg. Entertainment companies realized that cybercrimes were a legitimate and severe threat to their businesses...but that didn't mean they had an accurate understanding of what they needed to protect and how to protect it.

"The crown jewels [for the entertainment industry]," says Friedberg, "typically involve pre-release content, the ability to broadcast, email, and ... strategic plans." Risk assessments, therefore, should focus on looking for the likely vectors against those assets and tailoring security efforts accordingly, he says.

Pre-release content -- for example, films that are still in the final stages of production or television shows that have not been aired yet -- is both extremely valuable and confidential. Leaked content could be valuable to both pirates or competitors. So all production houses have strict internal policies about monitoring chain of custody and restricting access. However, there is often a large gap between what the policy says and what the users actually do, says Friedberg. He suggests that when calling in penetration testers, these would be the particular gaps and holes to ask them to go looking for first.  

Not all pre-release content needs to be treated the same, though, he says, because not all of it is at high risk for piracy. Millions of viewers salivate at the faintest scent of an upcoming episode of Game of Thrones or The Walking Dead; so the pirates who can sate fans' hunger a few days early could make a lot of money. If a show only has a few viewers to begin with, then why would pirates invest in stealing it, and why should entertainment companies invest in protecting it against piracy?  

Just because content is not monetizable or a target of piracy, however, does not mean it should be left unprotected altogether, says Friedberg. There are other attacks and other attackers to worry about, as Sony learned to their detriment. Hacktivists' motives might be simply to injure or destroy.

Destructive attacks are notoriously hard to stop, but Friedberg says that if a certain project or company is expected to be a target of hacktivists "especially if they have had a history of drawing the attention of activists," he says, "we night work with them very proactively on DDOS prevention," for example.

The DDOSes in question could be quite severe. For example, in April 2014, French network TVMonde5 was attacked, its television broadcast interrupted for hours, and its website and social networking profiles defaced. Cyber Caliphate (a pro-ISIS hacktivist group) claimed responsibility for the attack, (although investigators later stated that Russian APT group Pawn Storm might be involved). 

One basic, but often overlooked way that entertainment companies can better protect themselves is to segregate their production/broadcast networks from their office networks -- like segregating classified from unclassified networks.

Just as important as preparing the kinds of attacks hacktivists might commit, says Friedberg, is that entertainment companies put in place processes by which they look at their content through the eyes of potential hacktivists, so they can prepare for their risks accordingly.

"Track all the haters out there," he says, "classify them into low, medium, high risk ... and understand whether or not that risk is changing." Those risk assessments are based not only on how angry certain groups of "haters" will be, but on the fluctuating maturity of their cyberattack capabilities, he says. Just because a threat actor isn't prepared to launch a devastating attack today doesn't mean they can't tomorrow (on their own, or with their help of a new friend).

Friedberg also mentions that the entertainment industry also has some of the same concerns every other company has: like regulatory compliance and users who use poor social networking judgment and password management. 

Despite all the cases of celebrities having their social network accounts hacked, Friedberg says that the "beautiful people" apparently don't learn from the experiences of their fancy friends. Even celebs "really don't do anything to protect themselves until they've been attacked."