Cyber security: The view from NAB

This was reflected in a special NAB conference session on cyber security.

Announced at the session was the Trusted Partner Network, an initiative of the Motion Picture Association of America and the Content Delivery & Security Association.

The initiative encourages all partners in the content chain to submit to certification on security practices, seeking a “trusted partner” status. Such trusted partners will have to demonstrate that they apply best practices.

One element of note is that assessors, too, will need to compete for trusted partner status.

Rather than apply scrutiny itself, the TPN has elected to create a market for assessors, allowing content producers and distributors to choose their certification partners.

DPP was primarily at NAB to promote IMF, but Head of Business Development and Delivery Andy Wilson emphasised the need for trusted partnerships regarding security, but took the issue further.

He underlined the importance of technology developers and manufacturers playing their part.

He said: “Vendors have to demonstrate their commitment to protecting broadcasters’ security.”

On the show floor, cyber security was not inherently a hot topic. But those questioned were largely confident in their solutions.

Jon Finegold of Signiant pointed out major studios are now generally forbidding the use of FTP to move content around. They also ban the shipment of hard drives.

Content has to be moved by a specialist transport platform – like Signiant – which secures the content end-to-end, and provides an audit trail of everyone who touches a file. “Security is top of mind for everyone,” he said.

Fellow transport specialist (and IBM company) Aspera also places a high priority on security. “Our goal is to make it impractical to break into the content – even if you are the NSA,” Charles Shiflett said.

Approaches to securing transfers vary. IPV, for example, sets up links using dual factor authentication. Others use the secure shell, SSH.

“The SSH protocol is believed to be secure against cryptographic attacks on the network, provided keys and credentials are properly managed,” according to SSH inventor Tatu Ylonen.

Aspera’s Shiflett also outlined the different requirements for security at different stages of the content lifecycle: it needs to be protected not just in transit but “at rest” – while stored on a server – and “at work” – while being processed.

“There are different levels of security: around access, around transmission and around the integrity of the data,” Francisco Ontoso-Ramos, CTO of Object Matrix said.

His technology provides repeated routine checks of stored data using checksums. By storing multiple copies of the data in multiple locations, the content store can be self-healing.

Encryption at rest requires the content to be protected on the server, so not directly viewable. This provides a double lock on content, alongside carefully controlling access.

Typical security methods not only encrypt the content but also put the key on the server. This gives you protection even if you do not trust the storage.

Encryption has been seen as a time-consuming part of the process, a nuisance when you need access to material immediately. But Intel is now building high-grade encryption into its processors as a standard function, so it adds virtually no latency.

One of the smaller exhibitors, Fortium specialises in content protection, particularly at the production and post production stages. Its encryption is integrated into transport platforms like Aspera.

The Fortium MediaSeal product provides encryption for files in transit – between studios and facilities – and at rest – when stored on a workstation, server or cloud. On top of that, it provides for centralised access control and permissions management, linked to detailed audit trails of user activity.

It secures access by granting individuals content access only after multi-factor authentication. Fortium can apply automatic sunrise and sunset controls to passwords – when they become and subsequently cease to be valid – ensuring individuals and workstations are only allowed to deal with select content while they have a need to.

There is a growing acknowledgement that sometimes it is the human that is the weak link in the security chain. Object Matrix, for example, allows content to be locked against deletion, even by the system administrator.

One growing trend that is at risk of cyber-security is remote production: creating even live television such as sports at the stadium, but carrying multiple signals back over IP networks to a centralised control room.

In Australia, NEP has implemented a network linking all the major soccer, rugby and Aussie Rules stadiums in the country to control rooms in Sydney and Melbourne.

The core technology to link these sites is based on the microservices platform from Aperi.

Company chair Eugene Keane explained to IBC365 how they could secure the multiple streams carried over public networks.

“We can build 100% perfect firewalls using our NAT configuration app. Then we configure what we allow in.

“We might define the system to only allow 2022-6 streams through, with packet inspection on the fly.”

The software-defined FPGA hardware that Aperi provides at each end of a live link can be configured to have trusted and untrusted sides of the same board.

With the content protected, addressing and other irrelevant data is stripped out of a stream before handing it to the trusted side of the board; reverse feeds have the addressing inserted only on the untrusted side.

One aspect of security that can easily be overlooked is the growing trend for major system vendors to allow contact between their site and that of the user.

This is seen as a positive selling point. If there is a problem with an installation, there is no need for an engineer to get on a plane to fix it. By logging in from the comfort of the support centre, the engineer can identify and fix the problem remotely.

The problem with this is it means you have to allow remote access to the very heart of your system. In major security breaches like TV5 Monde, this access point allowed the perpetrators to take the station off air and virtually destroy the technology and content.

Andrew Isherwood, CTO of ATX Networks, explained how this should be handled. His view was that a secure system would not allow any vendor to “call in” for diagnostics. If a problem arose, then the device should be the one to open a path through the firewall and contact the service centre.

In practical terms, though, quite often the problem was around the network, so it may not be possible for a system to call home via the conventional route. “We generally install an LTE modem in the equipment rack to allow the system to get the message out,” Andrew said.

The presence of cyber-threats is a constant challenge on data integrity, system resilience and intellectual property theft. The media industry is having to catch up fast.

“People are very worried about cyber-security these days,” Francisco Ontoso-Ramos of Object Matrix told IBC365. “But they didn’t start worrying about it as early as the IT industry”.

That the IT industry takes it very seriously indeed is the fact that Google alone has more than 750 engineers, and invests more than $2 billion a year in security. That gives an idea of the scale of the challenge.