Cybersecurity is a business issue, not an operational one

Media consumption patterns have tremendously changed over the past few years. This new hyper-connected and multi-platform media ecosystem continues to push media companies to adapt their production and distribution strategies to enable them to reach dispersed audiences.

To help solve this challenge, media companies have created a range of IP-based content delivery services (from internet-radio and hybrid TV to second screen and video on demand). This is done in addition to traditionally broadcasting radio and TV which are slowly also migrating to IP for flexibility.

Everything talks IP: audio and video content is delivered over the internet, news-feeds are collected over the internet, traditional production applications get cloud access or are provided ‘as-a-service’ and even studio lights are controllable via apps running on tablet devices or smartphones.

As a result, media companies are becoming an integral part of a new smart cyber-ecosystem.

Increasing threats towards media companies

So far, this all sounds exciting and good. But, there is a twist in the perfectly interconnected world because even hackers become smart. Beginning with the Arab Spring and the Wikileaks whistle-blower disclosures in 2010, a growing radicalisation and ideologisation of hackers has raised a new type of hacker whose intent is not to gain money but to destroy or manipulate systems or institutions at any price.

Such activities may even often be government driven, as part of defence departments or national intelligence offices.

Today’s hackers are usually well organised, and attacks are rarely done by a single person but more likely by a group of attackers. Social media provides, almost offers, the required information about employees and the target organisation, and Google-like search engines can be used to find the weakest link in the target’s content delivery chain.

Recent hacks like the disastrous attack against TV5Monde in 2015, Sony Pictures in 2014 and a steadily increasing amount of DDOS attacks against public broadcasters have shown the potential damage that can be done.

The EBU Media Cybersecurity Group

So what do we do? These changes in technology and hackers’ approaches require a fundamental paradigm shift to transform and actively address security risks as corporate cyber risks. Security is no longer an operational, technical issue; it is an integral part of wider business decisions that are not limited to the broadcaster itself, it’s the whole industry that needs to adequately address security.

For these reasons, the European Broadcasting Union (EBU) has started a Strategic Programme on Media Cyber Security (MCS)1 to address these new and evolving threats.

The EBU MCS Group consists of chief information security officers of EBU Members (including SRG SSR). These Members actively share their knowledge to provide broadcast-specific recommendations on cybersecurity (e.g. EBU R141 on DDoS Mitigation).

These recommendations are built on proven security practices and further refined with the specifications of the media world. Below are a few examples of the types of recommendations the group makes for media companies.

1. Involve security governance at the highest corporate level

First and foremost, it is key for organisations to create awareness of the topic, especially among senior management. A company’s security advocate is required to have the necessary skills and competencies to address security-related topics. If appropriate, a security team or board should be institutionalised.

By defining scenarios based on probable hacker attacks that cover the big picture of the content delivery chain, the topic of cybersecurity will become more tangible and known as a realistic threat.

Based on these scenarios, potential security risks can be derived for feeding corporate risk management programmes, thus making security an active part in the corporate decision making process.

As a result, security aims to be a business enabler, not a business preventer, outgrowing today’s hackers in smartness and speediness. The EBU MCS Group has created a security governance guideline (EBU R144) that helps organisations benchmark their security awareness level and also establish an efficient security hierarchy.

2. Raise the security level of media-specific systems and services

Even though most media products and services run on conventional IT platforms, the security best practices from the IT world are not necessarily carried out in the media domain. The EBU’s recommendation (EBU R143) helps manufacturers and media companies benchmark the minimum security levels of their products or services.

3. Security in the design of media applications and standards

Security in media is mainly related to digital rights management around the content. However, in this ecosystem of apps and web- based services, not only the content should be secured, but also the application itself (Android/IoS Media Apps, HbbTV, etc). If flawed, the application can be used as an entry point to either hijack the device (create a bot) or gain other privileged access.

The EBU liaises with different standards bodies and consumer electronic vendors associations to consider minimum security requirements and implementation best practices (e.g. EBU R142).

This article was first published at IBC2016.