All networks have vulnerabilities and even SDI systems can be attacked. The only difference is that we know when a hacker has broken into an SDI network as they have a pair of wire cutters in their hand!

With IP networks, you no longer need an armored vehicle to break into a broadcast facility. In a poorly designed network, cyber criminals can use internet technology to break into the facility from the comfort of their own armchairs.

To protect against cyber-attacks security must be considered, planned for, and implemented at the beginning and not as an afterthought when the video and audio is already streaming across your new network.

Educate Users

Although technology may appear to be the most influencing factor when building IP networks, users play a huge role in guaranteeing the effectiveness of secure networks. Vulnerability and penetration testing will go a long way to prove your network is secure, but to counter-act user vulnerabilities, we must think more carefully about security.

Firewalls and Intrusion Detection Systems (IDS) block attackers from gaining entry using brute force and random attack methods, and stop users from gaining access to malicious websites. But phishing emails can completely bypass these systems. They work at a human psychological level by manipulating people into performing actions or giving out information they wouldn’t normally provide.

The purpose of phishing is for the attacker to gain sensitive information from employees and users to enable them to gain access to secure networks and infrastructures. Cyber criminals are masters of exploitation and know how and when to maximize their chances of success.

Phishing emails are sent when users are most vulnerable and stressed, such as late in the afternoon, on a Friday, or at the end of the month. They will spoof C-suite managers’ email addresses assuming more junior staff will do as they are asked without question. And they also exploit real deadlines such as tax returns and end of month payments.

Although SPAM filters and virus checkers go a long way to stopping phishing emails from arriving in users’ in-boxes, the filters are always playing catch-up. Attackers are constantly designing new methods of bypassing SPAM and virus filters and an attack must have happened and reported before it can be added to the filter library.

CEO’s Drive Security Attitudes

The most efficient solution to phishing attacks is decisive action driven from the top of the company. CEO’s must drive forward personal security measures such as encouraging the need to change passwords regularly, the use of two-factor authentication, and consistently taking security seriously.

When a new employee starts at a company, security training should be at the very beginning of on-boarding to enforce its importance, and not be an add-on or afterthought.

Performing regular phish testing can help CEO’s learn more about training for their staff. They send phishing attack emails to their own employees and track who responds and clicks on the links. Further training should be provided for those who do make the mistake of responding in order to help users achieve higher and better levels of personal security.

Help Users

A no-blame policy will help users quickly report mistakes such as inadvertently clicking on a phishing email. They know they can call IT and report it without reprisal or fear of losing their jobs.

Spoof websites are another area of concern. Attackers are very good at counterfeiting a real website and making it look very convincing using man-in-the-middle attacks. They occur when a third party maliciously intercepts a connection between the browser and server and makes each think they are the other.

Anybody uploading media to servers should be aware of man-in-the-middle attacks as they can be easily used to intercept and obtain the media for illegal distribution, or even hold the owner ransom.

Secure Websites

HTTP (Hyper Text Transfer Protocol) is the process used to transfer data between servers and clients so that web-pages and streamed media can be viewed. Additionally, HTTPS (Hyper Text Transfer Protocol Secure) ensures the server the user is communicating with is the actual website they think it is and not a man-in-the-middle attack situation.

A secure verified website will have the “lock” icon next to the web address in the browser .

As well as certifying the origin of websites, HTTPS encrypts the data exchange between the server and website using TLS (Transport Layer Security). This ensures eavesdroppers cannot listen to the data exchange and use the information for criminal means.

Once a user enters the servers’ URL into the address bar, the HTTPS handshake is initiated and the server will respond by sending a certificate back to the browser.

Certificate Authorities, such as GoDaddy.com and GlobalSigh.com govern the publication and validity of certificates. Owners of HTTPS-enabled servers must apply to one of the CA’s for a certificate and will need to supply information such as the servers IP address, public key, and details of the company, like those provided to banks when opening an account.

Unique Digital Certificates

Once a certificate has been created, it is made tamper-proof by processing with a hash-function to give it a unique finger print. By issuing this certificate, the CA is validating the upload server as a bona fide computer associated with the owners’ business. Clients uploading their media can be confident and assured that they are dealing with the business they expect to be dealing with and not a third-party imposter, or man-in-the-middle attacker.

When a browser receives the encrypted certificate it looks for the public key to decrypt it from a list of trusted keys installed in the browser. Once the public key has been found, the certificate is decrypted to expose the servers own public key and other company information. Maintaining the validity of this list of trusted CA’s is paramount for security in internet commerce.

Encrypt Keys

The second important aspect of data exchange using HTTPS is encryption using secure keys. Public Key Infrastructure (PKI) is a system used to create, manage, store, and distribute digital certificates and public keys.

Asymmetric encryption uses a unique private-public key pair. If data is encrypted with the public key, only the private key can decrypt it. And if data is encrypted with the private key, only the public key can be used to decrypt it. The private key must remain private to the website, but the public key can be given to anybody. This is a very secure system, assuming the private key is not stolen from the server. But it is computationally intensive, and the webserver would grind to a halt if a film was uploaded to it.

The alternative is symmetric encryption that requires both the users’ browser and server to have the same key. It’s a computationally fast method of encryption and decryption but distributing the key on a public internet is very insecure and eaves droppers can easily pick it up and then gain access to your data. 

To achieve the security of asymmetric encryption and the speed and flexibility of symmetric encryption, HTTPS uses both asymmetric and symmetric encryption.

To initiate the process, the user clicks on the web address, and the encrypted certificate is sent to the browser over an unencrypted link to validate the server and extract the web servers public key. Then the browsers symmetrical key is encrypted using the public key and sent to the server. The server decrypts the symmetric key using its private key and both the server and browser switch to symmetric encryption to exchange media files using this newly created symmetric key.

Fast Encryption for Media Files

Media and large files are now exchanged using the fast-symmetrical encryption method. To further improve security, a time limit on symmetrical keys is enforced and new keys are created to reduce the risk of them being copied and hacked. Each time a user accesses the HTTPS server, a new HTTPS session is negotiated, and a new symmetric key created. Timeout’s periodically action the browser to re-negotiate the HTTPS protocol with the server to force the creation of new symmetric keys.

Technology can only go part of the way to ensure that networks and web access are secure. People are always the weakest link in any security system and it’s the responsibility of every user to make sure they understand security and implement the measures needed. It’s of the upmost importance that the CEO drives personal security measures hard, provides regular user training, and enforces regular phishing attack testing of employees.