Cybersecurity: Lock It Down

Long behind us are the days when Pro AV equipment was its own entity. Its convergence with IT and existence on the network—not to mention increased dependence on audio and video for both internal and external messaging—makes it a key presence in almost every organization’s technology stack.

For AV integrators, this is good for business, but it also requires them to exercise responsibility. Like everything else tech, modern AV systems need to be as secure as possible.

Gabriel Gonzalez, audio visual SME at Mason Technologies, views cybersecurity design as something similar to building a secure brick-and-mortar facility. A design for a bunker, for example, could call for a steel box featuring no doors or windows. While this may render the structure safe, it’s also completely useless because no one can get in.

“The art of design is really in deciding where am I going to put a door? Where am I going to put a window? Who’s allowed to move through these access points? How do I secure these access points from the bad actors?” Gonzalez illustrated.

The same concept applies to Pro AV equipment, which is why it’s necessary to work closely with end users and IT departments to determine how this technology will be used and what the requirements are for access and visibility. With the prevalence of Bluetooth, cloud services, and Wi-Fi, this has gotten more complicated.

“[These services] are very useful, but if you’re going to have them enabled it should be for a clear reason,” Gonzalez said. “Have well-defined access control for all of these openings.”

If a service isn’t required, Gonzalez said it should be disabled. This includes empty switch ports and network protocols that are no longer in use. Plus, each device account should contain only the permissions that its user needs.

“When you’re designing these things, you have to coordinate with the client’s IT team in the beginning and be as detailed as possible,” Gonzalez said. “It can be really surprising how two different organizations might use the same equipment, so if it’s going to work well and feel right for them to use but still be secure, it’s got to be tailored to them like a good suit.”

Remediating Vulnerabilities

The first step in designing a secure AV system is simple, according to Daniel Schirripa, senior remote commissioning engineer, virtual, at Diversified. “Treat every AV device like a server on the network and treat every entry point as a possible attack vector,” he said.

However, that’s just the beginning.

Network segmentation is crucial for system security. AV traffic should be assigned to its own VLAN (virtual local area network) that is separate from the corporate and guest networks. Schirripa explained this prevents unauthorized individuals from spying on company meetings, for example, without ever being detected.

It’s also important to harden devices. “Unused services such as SSH, Telnet, and HTTP should be disabled and unnecessary ports closed,” Schirripa said. “Authentication and encryption matter, too—802.1X should be used for port security wherever possible, and control protocols should run over TLS/SSL or similarly secure protocols.” He also reminded AV pros to secure physical assets by locking down racks and system peripherals.

AV systems have several weak spots that designers and integrators need to address, the first of which is default credentials. “Most devices ship with login information that’s easily found through a quick web search or a glance at the manufacturer’s documentation,” Schirripa explained. This is why a unique login should be assigned to every device at the login stage without exception.

Outdated firmware is another problem. Schirripa observed that in some cases, it can be years before AV equipment is patched; remaining on top of manufacturer-recommended updates can go a long way in protecting systems. He added that control data should be encrypted to prevent man-in-the-middle attacks that could enable a malicious third party to take over a room.

“The fix on the integrator side is making automated firmware management and strict password policies a standard part of every commissioning checklist,” Schirripa said. “Where it makes sense, building in monitoring and early warning systems adds another layer of protection.”

Remote monitoring systems that provide alerts and notifications in real time can also expose the network to risk, noted Mike Stocklin, director of technology at Automation Arts and a member of the National Systems Contractors Association (NSCA) AI & Cybersecurity Committee. “Anything that goes on the network should be considered a cybersecurity threat," he warned, "[but] there are devices that are potentially more harmful, such as devices that talk consistently in and out of the network."

The Legal Stuff

If a client is breached, and there’s a chance AV technology had something to do with it, the integrator could potentially be found liable. Because of this, it’s wise to include a clause in the contract that limits liability.

Blair Dawson, member in the data privacy and cybersecurity practice at McDonald Hopkins, said liability could be defined as a month or two worth of fees, complimentary services for a specified period, or even a maximum monetary payout. “Starting with the contract is the best way to mitigate what that overall exposure could be if there was an incident,” Dawson said, “or if your client thinks that you’re part of an incident.”

The contract should also spell out who is responsible for what post deployment, according to Clay Swanson, risk management advisor at True North Companies, an insurance broker that works with the NSCA. “If it’s silent on who owns security for the devices after installation, then you’re going to have plaintiff’s attorneys who are going to argue that the integrator has that implied duty and is somehow negligent or responsible,” he said. Swanson added that cyber liability and technology errors and omissions insurance can provide integrators with some protection if they are, or could be, found responsible.

For firms that provide ongoing services, such as firmware or software updates and patching, Dawson counsels keeping a detailed record of when these tasks were completed, as this can be valuable if an integrator is faced with a lawsuit. “One example is an MSP that says, ‘I know I did patches on Tuesday because of Microsoft Patch Tuesday,’ but they don’t have the records,” Dawson illustrated. “Litigators and regulators don’t take too kindly [when you] make it up after the fact. Take that extra step to document things so you can prove that you’re doing everything that you can within reason to keep your environment secure.”

When a client opts out of following the AV integrator’s cybersecurity recommendations, Dawson suggests having them sign a waiver stating that they are aware of the risk of doing so and will hold themselves accountable in the event of a breach.

Responding to a Breach

The integrator’s role in incident response centers on containment and forensics, Schirripa explained. When a client is breached, the first task is to isolate the AV network. “Airgap the AV VLAN from the rest of the corporate network right away to stop anything from spreading,” Schirripa said.

Next, the integrator should examine the logs from the control processor and the DSP to learn where and when the system was accessed without authorization. “Then, perform a full credential reset for every password and certificate across all networked AV hardware,” Schirripa advised.

After ensuring things are back under control, it’s important to document where the attacker got into the system and what processes need to change. Armed with this information, AV integrators and their clients can improve their incident response protocols. “Understanding how an attack happened is the first step in making sure it doesn’t happen again, and ensuring every employee knows what to watch for can go a long way toward preventing the same situation from arising elsewhere,” Schirripa said.

Some technology providers are reticent to share information with clients that fall victim to a breach. Dawson said this is not good practice.

“One of the things that’s really important is to be as cooperative as possible with any investigation,” she said. In not being transparent with a client—and their insurance provider or third-party forensic investigator—the integrator may be increasing the client’s losses. “That’s not going to help with the relationship.”

While national and global enterprise clients tend to prioritize cybersecurity, there remains a significant number of organizations that need to practice stronger security hygiene, Stocklin observed.

“We [haven’t had] a lot of issues from the AV side of the world, but I think the potential is there and we need to be fully aware of that,” Stocklin said. “We need to focus on this, because the more and more we utilize things like AI, the more bad actors there are that can use that same technology to get into our systems.”

Cybersecurity for All

Based in Orlando, FL, Cyber Mettle is a nonprofit focused on developing cybersecurity talent and making cybersecurity services accessible to small to mid-sized businesses. Alyson Laderman, executive director and co-author (with Jason Dion) of AI Security Essentials: Strategies for Securing Artificial Intelligence Systems with the NIST AI Risk Management Framework, said the organization is responding to a key problem: When companies recruit talent, they mandate at least three years of on-the-job experience, making it extremely difficult for entry-level candidates to break into the industry.

"There is no way to get to mid or high level if we don’t train the entry level,” Laderman explained. “It’s just a matter of developing those pathways, guidelines, supervision, and willingness to actually invest in [new talent], but also in building your own business.”

This is increasingly important as AI is simultaneously the cybersecurity practitioner’s friend and enemy. New talent needs to know how to navigate this continually evolving landscape successfully. “The more we get into tech, the more we need to appreciate the human factor,” Laderman said. “How do we work with AI in a way that we understand what it can do, what it shouldn’t do, and what the problems could be in using it?”