Back home in the refreshed Central Hall of the Las Vegas Convention Center, with additional exhibits spread across the North Hall and West Hall, the 2026 NAB Show closed its show floor on April 23. According to show officials, there were more than 58,000 registered attendees, an increase from last year. Almost half were first-time attendees, and more than 20% of registered attendees were international, with 146 countries represented. Plus, there were 132 first-time exhibitors. Beyond the numbers, here were a few trends I observed.

[We Saw Phish at The Sphere, and the Video Content Had Us Bouncing around the Room]

Acknowledge the influencers.

Whether you call them creators or influencers, the important thing is that you call them. NAB 2026 put an emphasis on the creator community and with good reason: It's healthy and it's growing. I attended "How Fortune 500 Brands Are Betting on Creators," while SCN's Wayne Cavadi covered “State of the Creator Economy” at the Creator Lab, an area devoted to the creator community that celebrated its third year at NAB.

During “State of the Creator Economy," Alessandro Bogliari, co-founder and CEO of The Influencer Marketing Factory, explained the appeal of online influences. “The creator economy is a people business,” he said. “It’s a friend I’ve never met, and I follow them because you can see part of myself in them. AI simply cannot replace that.”

Of course, AI was also part of the discussion. Natalie Jarvey, editor of Ankler Media’s "Like & Subscribe" newsletter, said creators who once saw GenAI as a threat have now embraced it as a tool for making creative content. That said, she acknowledged it still has a different look and lacks the human touch. “Brands are all-in on everything AI these days: the good, the bad and the ugly,” agreed fellow panelist Pierre-Loïc Assayag, co-founder and CEO of Traackr.

Meanwhile, in "How Fortune 500 Brands Are Betting on Creators," Jennifer Cho, chief customer officer at CreatorIQ, said creator marketing now delivers more ROI than the traditional marketing funnel. That's why major businesses are using creators to drive social media campaigns. Brendan Ittelson, chief ecosystem officer at Zoom, said measurement and metrics are critical, and it's important to be able to define customer success and identify audiences.

How creators will impact the Pro AV industry remains to be seen. But between them and younger viewers embracing 9:16 content for shorter content on their mobile devices, there is the potential for serious disruption in the production status quo. That means new tools, new techniques, and new workflows—and customers looking to integrators for answers.

There's a new buzzword.

AI is still making the most noise in the industry, but another buzzword has quietly become part of an awful lot of conversations: security. Whether you call it network security, IP security, or cybersecurity, minimizing the risk of intrusion or cyberattacks via Pro AV hardware and software is now a point of emphasis. And just to bring this to a full buzzword circle, AI is a great tool for bad actors.

"Every device on-prem is a potential liability," agreed Frank Zovko, VP of engineering at AI-Media. The company used NAB 2026 to introduce its new LEXI Voice Encoder and LEXI Text Encoder for use in the creation of written and spoken captions, transcripts, and translations. Zovko said the company did its due diligence for security, with updated systems, an overhauled web interface, SOC 2 compliance, and more. AI-Media has also committed to quarterly updates for added security protections.

Security was top of mind for BeckTV at NAB, where the company launched BeckFlow, its web-based, broadcast-centric schematic documentation platform that doesn't rely on traditional CAD workflows. Matt Weiss, VP business development for BeckTV, has noticed there is more security awareness in the industry; in fact, he mentioned that BeckFlow is SOC 2 compliant and has authentication features.

NETGEAR is so serious about security that it acquired Exium, a cybersecurity company, last year. There was less concern about security when connectivity was defined by an HDMI cable, but today's IP-based workflows has "raised the bar for the need for security," according to NETGEAR AV's John Henkel. He advised keeping AV separated from other IT assets on its own network.

AI is getting some serious training.

"We've gotta use AI."

I wonder how many companies have declared mandates like this—and then promptly left their teams to their own devices to figure out how to do just that. Thankfully, I'm happy to report that there are Pro AV manufacturers that are avoiding vague "and it's got AI" declarations and really focusing their AI efforts into meaningful products and workflows.

For example, I learned about Shure's Action Isolator software during a Sunday afternoon session in the Broadcast Engineering and IT Conference. Shure's Chad Wiggins, associate VP of innovation, and Brent Shumard, senior staff acoustic engineer, had a fireside chat with John Clark, NAB's chief innovation officer and SVP of emerging technology about why audio has lagged behind with AI.

Beyond a "if it ain't broke, don't fix it" mentality, Shumard said audio is often messy and chaotic. However, AI adoption for processing is starting. Action Isolator uses AI to remove unwanted sounds. So, if you're shooting a basketball game, you can have the sounds of the basketball hitting the rim, dribbling the ball down the court, and even the squeaking of the sneakers all on one fader, minimizing the sounds of the crowd, band, or PA announcer.

How does Action Isolator do it? The first part is the right hardware. Shure's DCA901 broadcast microphone array offers eight channels of audio with very steerable pickup zones that can identify and prioritize key sounds in real time. But the secret sauce is training. The company is currently training the software for basketball, baseball, and hockey. Shumard said the trick is getting clean audio data for training the AI.

On the video side, Vizrt introduced AI Keyer at the show. Vizrt's chief marketing officer, Chris Black, said the company wants its AI applications to be transformative and capable of simplifying human workflows through agentic AI. AI Keyer is certainly designed to simplify VR and XR workflows, because it enables a production to change backgrounds and insert graphics without a greenscreen or special lighting. Indoor, outdoor, on a set, on location—it doesn't matter.

Again, AI training is the key. Vizrt is training its AI to recognize human shapes, maintaining the key while allowing your talent to walk and chew gum (and handle objects) at the same time. Vizrt is also working on training the AI to recognize hats and hairstyles, too.

Is it perfect? No. But like previous technological leaps in our industry, this first generation is the worst it's ever going to look. And it's already more than good enough for prime time. All I'm saying is that if you've been keeping extra stock of green paint for the cyc, you might as well use it now, because you probably won't need it in the near future.

Nobody wants their home alarm triggered, especially at 4:30 a.m. And yet, there I was, awakened from a dead sleep from something a lot louder (and earlier) than my Apple Watch's happy little chirping to announce a new day.

In some homes, the alarm is an absolute call to action. You'll find someone instantly alert, shotgun in hand and bandolier magically slung over one shoulder. Next comes that chuck/chuck sound of a round being loaded in said shotgun, followed by a pithy comment worthy of Bruce Willis in his prime.

[Better Safe than Sorry]

In my home, the response was somewhat different. There was no shotgun. There was a man muttering about his glasses and wandering over to the control panel.

Why so calm? When my alarm went off, it didn't include that high-pitch siren that informs me of a breach. It was just the alarm. Don't get me wrong, it was annoying, but I was reasonably sure I wouldn't have to channel my inner John McClane.

Turns out I was right to be annoyed rather than panicked. The control panel declared there was a low battery. Not a battery on one of the sensors—that would trip a real alarm. Instead, it was the chunky battery that sits in the control box year after year until it can find an inopportune time to lose its charge. One bleary-eyed order placed with Amazon later, I was in bed trying to will myself back to sleep.

Now, if you really wanted to sound an alarm, you should have joined me at the inaugural Cybersecurity Summit last month at ISE 2026. I sat in on the opening session, "Building Cyber Resilience: Why AV systems become part of critical infrastructure," and let's just say it didn't appease my trust issues.

The speaker was Shaun Reardon from DNV Cyber, and his message focused on the importance of planning. Reardon, who is outrageously qualified to speak on matters of security and cybersecurity, didn't sugarcoat the situation. Cyberattacks are a given, and if you don't think about cybersecurity early, it's going to cost you a lot of money later.

Pro AV has its own cybersecurity challenges, because our industry's supply chain includes a heaping pile of vendors and a surplus of high-risk entry points, from IP-based cameras to digital signage systems and more. Reardon warned that this is where integrators can encounter liability; in fact, cybersecurity negligence can lead to lawsuits, fines, even potential prison time.

We've probably all heard about the case of the hackers who stole data from about 40 million credit cards from Target's IT network more than a decade ago. They broke in using stolen network credentials from a third-party HVAC vendor. In the case of Pro AV, you've got all sorts of gear with default passwords that need to be changed and/or firmware that needs to be patched (seriously, when was the last time you plugged in a new device and it didn't want to immediately update its software).

Plus, there's the added wrinkle of managed services. Yes, we all love that it reduces truck rolls and provides a steady revenue stream, but it's yet another access point that can be breached by the cyber bad guys. And I haven't even talked about potential personnel-based cybersecurity threats.

It's easy to be complacent with cybersecurity, treating it like you would a checklist for packing your suitcase for summer vacation. However, Reardon considers the cybersecurity standards in place for our industry and others as minimal effort—conformity is not security. Consider those the starting point for your cybersecurity journey.

Yes, journey: Cybersecurity needs to be a continuous effort, not a one-time deal. Basically, Reardon suggested a holistic approach. That means having a comprehensive understanding of your Pro AV environment, an incident response plan in place for when the cyberattack comes, and an active security mindset. Yippee Ki-Yay.

Integrated Systems Europe is launching the CyberSecurity Summit, a new addition to the ISE 2026 content program. Scheduled for Thursday, Feb. 5, the Summit will tackle the escalating cybersecurity challenges confronting the Pro AV and systems integration industries, as digital threats increasingly impact critical infrastructure, smart buildings, venues, and public services. With cybercrime surging across Europe and globally, the timing of ISE’s new Summit couldn’t be more relevant.

[AV Networks' ISE 2026 Coverage]

The Summit is part of ISE 2026’s overarching theme, Push Beyond, which challenges the global AV and systems integration community to redefine what’s possible. By introducing the CyberSecurity Summit, ISE is pushing beyond traditional boundaries to address one of the most urgent and complex issues facing the industry today.

“Cybersecurity is no longer a technical afterthought, it’s a business-critical factor,” said Mike Blackman, managing director of Integrated Systems Events. “For AV manufacturers, integrators, and technology users, it’s essential for accessing public tenders, ensuring regulatory compliance, and building long-term trust with clients.”

As AV systems become increasingly networked and embedded in enterprise, public sector, and venue environments, they are directly exposed to the same vulnerabilities as traditional IT infrastructure. From control rooms and conferencing platforms to digital signage, smart buildings, and event venues, AV solutions are now high-value targets for ransomware, data breaches, social engineering, and denial-of-service attacks. At ISE’s CyberSecurity Summit, AV professionals will learn about safeguarding critical systems, navigate evolving regulations like NIS2 and ISO 27001, and transform cybersecurity from a vulnerability into a strategic advantage, before it’s too late.

Summit chair Pere Ferrer i Sastre, former directorgeneral of the Catalan Police with extensive experience in public security, digital transformation, regulatory frameworks, and critical infrastructure management, will facilitate discussions addressing emerging digital threats to the AV and systems integration sectors. 

“Cybersecurity is no longer optional; it lies at the heart of every AV innovation," he explained. "ISE’s CyberSecurity Summit brings together the brightest minds in our industry to confront today’s digital threats head-on and turn them into strategic advantages. By sharing actionable insights, proven strategies, and real-world experience, we will empower AV professionals to protect critical systems, lead with confidence, and build a safer, smarter future for the entire industry.”

The CyberSecurity Summit at ISE 2026 will unite AV and cybersecurity leaders to tackle the most pressing challenges facing connected AV systems in critical infrastructure, smart buildings, and corporate environments. Opening with Pere Ferrer, the Summit features keynotes from Shaun Reardon (DNV Cyber) on building cyber resilience, Timo Kosig and Andrew Dowsett (Barco Control Rooms) on secure operations, and Pedro Pablo Pérez (TRC) on protecting corporate communications. Roundtables with Laura Caballero (Cybersecurity Agency of Catalonia), Folly Farrel (TÜV SÜD), and Sergi Carmona (Veolia España) will explore compliance, governance, and best practices for securing critical AV environments. 

Business professionals have moved from corporate offices to their homes and other remote locations and back again, with many now splitting their time through new hybrid workplace models. Regardless of location, workers often use their personal devices to get the job done.

[Diversified: Companies Underinvesting in Workforce Technologies]

You may be surprised to learn that an overwhelming 89% of associates employ their own devices or apps for work due to better ease of use compared to company-provided options, according to the Diversified Technology Maturity Survey of more than 1,600 U.S. employees. Given the widespread BYOD usage—and all that we have learned about remote and hybrid work—you might think that enterprises had BYOD security solved.

The reality? That’s typically not the case. Many businesses still lack the controls needed to protect their organizations in a BYOD world. Here’s how BYOD creates business risk and what companies can do to address it.

Split Tunneling Concerns

Several business and IT leaders have told me they trust their employees not to visit or download materials from inappropriate or illegal websites. Trusting your employees to behave ethically and responsibly is a good instinct. But what these company and department heads often fail to understand is that most cyber incidents result from mistakes, not malicious intent.

For example, if an employee incorrectly keys in a website address, or maybe their child uses their device to play videogames and downloads a plug-in, their machine can get infected. Even the most innocent actions by your employees can create cyber risk.

During the pandemic, a lot of companies enabled split tunneling to reduce their bandwidth costs. These split tunneling adopters instructed their employees to use VPN to connect to corporate networks, but encouraged associates to use their own connectivity when doing internet work using browsers such as Google Chrome, Internet Explorer, and Mozilla Firefox.

However, home networks are some of the most vulnerable networks on the planet. They often include home automation devices that have never been patched. Home routers may not be password protected, or a technician who installed the router may have seen the password on the back of the device and used it later to log in, so outsiders may already be lurking within the home network.

If a laptop that’s using split tunneling is not correctly configured and monitored, an adversary could attack that machine and use it to jump into your corporate network. The best approach to split tunneling is to avoid using split tunneling.

BYOD Corporate Standards

Some companies bought and configured computers for people who had to work from home during the pandemic. But a lot of businesses didn’t have the resources to do that, so they advised their associates to buy laptops online or from a big box store.

Businesses taking this BYOD approach now must contend with a mixture of machines, many of which are not owned or managed by the company, and most of which are not enterprise-grade. Plus, now that people are on the move again and many companies have hybrid work environments, employees often use these devices to log in from corporate and home offices, as well as airports, coffee shops, hotels, and more. That creates risk; in these situations, companies lack the security controls they had when people worked on stationary desktop computers at the office.

Gain control of your BYOD environment and secure your IT environment (and company) by limiting the use of devices to corporate-approved machines. Ask employees to sign a document explaining that you will allow them to use their own device, but during their employment with your company, it will adhere to your corporate standards. This includes the company’s ability to install a corporate “image” on the device, which should include all of the security and management software that is used on standard corporate systems.

Security over Convenience

If you’re a CIO or CISO, you’ve likely heard employees say that they want to use a particular application, rather than what you have invested in and provided, because it’s better, faster, or easier. They might even go ahead and get the legacy or freeware version of their tool of choice and start using it for work.

But in a corporation, free rein comes with significant risk. If employees use freemium or individual versions of software for business—with or without your knowledge or consent—your company may be in violation of the software supplier’s licensing rules.

Avoid legal and cybersecurity risks by removing administrator rights on BYOD devices to prevent employees from administering their own patches and installing their own apps and software. While the removal of local administrator rights will raise the level at which an IT organization must operate, it removes a lot of risks on your end points.

To combat cyber risks, you have to involve IT, human resources, legal, the executive team, and your associates, as there are a lot of factors to consider. The best tools in the world will be useless if you do not ensure everyone is aligned with the risks and the compensating controls. Depending on where you operate, you may also need to address privacy rules like GDPR.

Take a cross-departmental approach as you work to address the BYOD security challenge and ensure that you take the right approach to securing devices and your business. Also, ensure you are doing a cost benefit analysis, as the savings you gain by not buying equipment may be eroded with additional security costs. Put the proper policies in place that are approved by the heads of your IT, human resources, legal, and other relevant functions, as they will go a long way in protecting your corporation.

[Cloud Power: Cybersecurity and Pro AV Priorities]

Proactively secure and protect your technology, data, and operations with cybersecurity solutions that are matched with strong and reliable industry experience, and always ensure you partner with a security organization that understands your industry. There are differences in what you need to protect and how you protect it, depending on your vertical.

People think that cyber risk and cybersecurity are all about technology. But during my more than two decades in the cybersecurity arena—first as a cyber engineer and later as the chief information security officer at a public company and in executive management—I have found that cyber risk and cybersecurity have more to do with people, personalities, and psychology.

[Cybersecurity and Pro AV]

Whether you are preparing for the Super Bowl or another live event and/or delivering your product online or via TV, it’s critical to take an end-to-end approach to security. That starts with understanding what experiences people want and need from the content you are offering.

Expectations will vary depending on what you are offering and how people are experiencing it. Some people may be entering your arena. Others may be streaming or watching your event on TV. Certain individuals may be betting on the sporting event for which you are responsible.

Step back and think through all those scenarios, because the people experiencing your product through each of those lenses will be different. The attack vectors in these situations will also vary, as will regulatory requirements and people’s privacy expectations.

Enterprise vs. Stadium Security

It’s critical to understand that you can't take blanket cybersecurity rules and programs from the enterprise world and shift them to sports or broadcast. There are distinct differences between sports and enterprise environments. One of the biggest differences is on the people side.

In enterprise cybersecurity, you generally can control who enters and exits your environments. You can limit what devices from what locations can access your website and VPN. And for physical security, you can issue badges to help ensure only current employees can enter your facilities and/or leverage geofencing to create virtual boundaries, so you can monitor access to sensitive areas and receive alerts if unauthorized parties breach those physical perimeters.

But you don’t have that level of control with stadium security if you want to open your league and arena experiences to the world. You will need to implement an elevated level of both physical security and cybersecurity beyond what you would need in an enterprise environment.

Enterprise users are also more tolerant of the impacts of cybersecurity solutions. If an employee on a corporate laptop inside an enterprise facility has to wait an extra three seconds for a website to render, they are not going to file a complaint with the company’s chief information officer, chief information security officer, or IT team. If they did, it would probably elicit laughter. Public users have a different expectation regarding website load times when they are at home compared to being at work, so it is critical that the controls you put in place do not degrade their experience.

[NDI 6.1: New Features, Enhanced Tools, and More]

However, in sports, if your online experience is even a fraction of a second slower than what appears on the air, you may face a legal problem if you run afoul of sports betting rules. Cybersecurity controls, if implemented incorrectly, can easily add latency and delays to an online experience. Because there is less tolerance in sports for the impacts that cybersecurity controls can create, it is critical to work with consultative partners who are not only cybersecurity experts, but also understand your business and take an end-to-end approach to secure you and your customers and deliver top-notch experiences.

Be Transparent

Many organizations today believe that security by obscurity is a good thing. The thought that if you don’t talk about or expose capabilities within your environment that something bad cannot happen is simply a wild fallacy.

People tend to inherently distrust security, technology, and cameras. If you are not clear about what you’re doing and why, it just takes a few people to post something that puts you on your heels.

It’s best to be transparent about what you’re doing. I’m not suggesting that you give away all your secrets or share your security protocols. But be forthright about your efforts to protect their physical security, credit card transactions, and other aspects of their experience.

Explain in your literature, website, and stadium signs what controls you have in place. For example, you may want to post signs about whether or not you offer free Wi-Fi and how people can connect. That lets people know what is available and discourages them from connecting to unauthorized access points, protecting them in the process.

If you use cameras to allow faster entry into your facility or a more secure environment, let people know that. Calm people’s fears by communicating your policies around their images or information. If you will never use their face for anything other than a particular use case, share those details.

Some visitors may be unwilling to allow you to use their face or their fingerprint, so let people opt into the experience. But remember that many of those same people already use their biometrics to log into their phones. If you offer something that makes opting in worth their while—and put the right information in front of them to make them comfortable—more people will opt in, which will improve their overall experience with your services.

Baked-In Security

My team and I have had the opportunity to work with incredible organizations and venues such as Madison Square Garden, the NFL, the San Francisco Giants, the University of Texas Moody Center, and many others. Given my role, I have visited most of the stadiums across the United States.

Nobody likes to talk about security, but many sports organizations want to use facial recognition or fingerprint identification or encourage fans to install an app on their phones. I believe fans are willing to do all that if you demonstrate that you take cybersecurity—and your role as the custodian of their personally identifiable information—seriously.

No organization is immune to threats, but by making cybersecurity an integral part of your operations from the very beginning, you can turn it into a competitive advantage. Start by assessing the full spectrum of your audience’s interactions—whether in the stadium, online, or at home—and design solutions that balance security with seamless user experiences. Engage with trusted partners that have the expertise to help you implement robust, transparent, and scalable security measures tailored to your unique environment and budget.

[Executive Q&A: Time for Transformation]

Cybersecurity isn’t just a checkbox, it’s a responsibility that impacts every touchpoint of your brand. When you prioritize it, you protect your business and enhance the trust and loyalty of your fans and customers.

Don’t wait for a breach to rethink your approach. The time to act is now. Evaluate your risks, build a strategy, and lead with a commitment to security that sets your organization apart.

Anyone who’s dealt with migrating AV infrastructure to the cloud knows it’s not as simple as flipping a switch. It’s a massive shift, and while it offers game-changing flexibility and scalability, it also brings some serious cybersecurity challenges. Moving from a system that’s locked down on-prem and staff-controlled to the public cloud means your data and systems are suddenly in a much more open environment—and that’s enough to make any security professional’s hair stand on end.

When AV infrastructure transitioned to IP transport, that was the first time we had to think about security differently. Now, with the cloud, it’s a whole new ballgame. You’ve got confidential data and mission-critical systems operating in a potentially public space.

[Cloud Power: The Evolution of Virtualized Production]

CIOs and CFOs love the cloud because it offers cost efficiencies and the flexibility of OPEX-driven tools. But the security teams? They’re often not as enthusiastic. They’re focused on keeping data safe, and that doesn’t always align with the real-time demands of AV production.

Identifying the Problem

This is also a problem in broadcast, but it's a much bigger problem in AV and internal production. In broadcast, there is always a risk benefit analysis. Broadcasters must produce content, and they have to be on the air. So, there is an absolute business case to find a sweet spot balance between having restrictive practices and being able to run its core business of actually making media.

In what have traditionally been referred to as corporate environments, that need for compromise isn't looked at in the same way. If you are a large corporation, your need to produce content from an extreme business case point of view is not the same as somebody who is producing content as the actual product.

If I’m a broadcast call letter TV station, I can say with certainty that if we can't come to a reasonable perspective on how my cybersecurity practices are going to deploy, then we can't run that television station, which means It has no income whatsoever. At a big corporation, I don't have the same business case to take to the cybersecurity people and say, “Look, if we don't do this, our company can't achieve its primary goal.” And that can make it very difficult to come to a working solution.

The result? Delays. Building out a real-time AV infrastructure across the public cloud might only take 90 days, but getting the green light from the security team can easily take another year. Security teams often don’t understand the unique needs of real-time AV systems, and that’s where a lot of the friction can occur.

[AVoIP: Beyond the Buzzword]

You’ve also got the question of trust. AV teams need real-time access to systems that security teams might see as vulnerable. This is where early communication becomes critical. Without it, you risk running into barriers that delay or derail projects entirely. Security isn’t just a box to check at the end of a deployment—it must be baked in from the start.

Why Systems Integrators Matter

This is where systems integrators like us come in. We’re the ones who navigate the maze of corporate security requirements while still delivering a system that works for AV.

The first step is always to sit down with the security team and figure out their rules. What are the governance standards? What’s allowed and what’s not? Without those answers upfront, you’re just setting yourself up for wasted time and frustration.

From a best practices point of view, you really want to look at it from the point of view of network performance requirements and security requirements. Work out the conflict between those two things before you start down the real system design process.

One of the first questions we ask clients is: What exactly are you trying to do with the cloud? Is it the best option for this application? And what would the partnership with a cloud vendor look like?

Once you've determined the goals that the client has from an a functional point of view, and then looked at that from the client’s security governance point of view, it is incumbent that you advise the client on what will be involved, as well as the potential risks, so they don't invest money in a project with you that at the far end they can't realize, because it doesn't meet the requirements of the company.

Measure Twice, Cut Once

A lot of the lesser-known issues around this are things like what transport protocols are allowed on the network and what kind of security methodologies are allowed for a VPN? You take that information, look at your design and determine if using those standards will meet the performance requirements for the system you've been tasked to build.

Next step is to calculate the upfront costs of a cloud-based system. The good news is that once you’ve run that gauntlet with your client, you have a guidepost of what's allowed and can work creatively to find where that adoption can be most useful.

Once you understand the client requirements, the first order of business is to understand the security concerns, then evaluate if the cloud is the right way to go. We need to determine if we’re talking about a private cloud inside the client’s data center or server room, or the public cloud in the form of Google, AWS, and Microsoft Azure. You can run the same technology using all. So, the question is, when we say the cloud, do we mean public cloud or software-defined workflows?

Typically, the first thing the folks in charge of cybersecurity with a large corporation will want to know about is the transport of content, how is it protected as it’s distributed, and how are assets stored. Once we answer those questions, we can make location decisions and evaluate those environments so that we mitigate the challenges of moving these workflows into a software defined infrastructure, whether it be on-prem or in the cloud.

The overall key is collaboration. Integrators have to bridge the gap between what the AV team needs and what the security team will allow. That often means a lot of back-and-forth discussions, tweaking designs, and even revisiting fundamental assumptions about the project. It’s not a quick process, but it’s essential to get right.

Balancing Security with Performance

Here’s the thing about cybersecurity: It’s not free. It costs you in performance. You only have so much bandwidth, and every layer of security you add takes a bite out of your bandwidth and compute power.

[Cybersecurity and Pro AV]

The more cybersecurity tools deployed, the slower the core application will run. In the AV world, where real-time performance is critical, that tradeoff cannot be ignored.

Take VPNs, for example. They’re great for creating a secure bubble, but they also add latency and are heavy on network resources. When you’re dealing with live production, those extra milliseconds can make a big difference. It’s all about finding the right balance, and that’s where upfront design work becomes so crucial.

This balancing act isn’t just about technology, it’s also about priorities. Security teams prioritize risk mitigation, while AV teams focus on performance. Finding common ground requires a clear understanding of each side’s goals and constraints. It’s not easy, but it’s possible with the right approach.

The Price of Failure

Let’s be honest: Cost is always a factor. Cloud migration isn’t cheap, especially when you factor in the time and effort it takes to get through all the security hurdles. But here’s the good news: Those costs are usually one-time expenses. Once you’ve gone through the process, you’ve got a roadmap for future projects. That said, it’s still our job as integrators to help clients weigh the financial and operational pros and cons upfront.

Cost concerns also tie back to scalability. One of the cloud’s biggest advantages is its ability to scale up or down based on demand. But that scalability comes at a price. Clients need to understand not just the upfront costs, but also the ongoing expenses of running a cloud-based system. That includes everything from storage and bandwidth to licensing fees and support contracts.

We’ve seen what happens when this stuff goes wrong. Not long ago, a major failure involving a cloud storage platform made headlines. Bugs in the system weren’t addressed, and when a minor failure occurred, it cascaded into a major disaster. Massive amounts of content that was thought to be stored safely was lost. It was a wake-up call: Redundancy isn’t optional, and you can’t rely on a single point of failure, even in the cloud.

Another example comes from live production. Imagine a virtual production control room running entirely in the cloud. It’s an elegant solution—until the network goes down. Without a backup plan, the entire production grinds to a halt. These real-world failures underline the importance of planning for the worst-case scenario. Redundancy, failover systems, and robust testing aren’t just nice-to-have, they’re essential.

Looking Ahead

The future of cloud-based AV workflows is exciting. We’re seeing advances in bandwidth and security tools that will make cloud deployments more flexible and secure. We’re going to see new methods of deploying software-defined workflows that will allow us to be more fluid when it comes to what lives on premise and what lives in the cloud.

[Tech Perspectives: Videoconferencing Industry in Same Sandbox but with Different Toys]

One of the biggest innovations on the horizon is the ability to dynamically allocate workflows between on-prem and cloud environments. Right now, you have to choose: Do you run your production control room in the cloud or on the ground? Soon, we’ll have the tools to make that decision on the fly based on the specific needs of a production.

Another area of innovation is hybrid cloud models. These setups allow organizations to combine the best of both worlds: the control and security of on-prem systems with the scalability and flexibility of the cloud. As tools and technologies mature, hybrid models will become more seamless, enabling organizations to optimize their workflows like never before.

Moving AV infrastructure to the cloud isn’t just a technical challenge, it’s a balancing act. You’ve got to consider security, performance, cost, and practicality. And you’ve got to bring the right people—from security teams to integrators—into the process early.

The cloud isn’t a shiny new toy anymore. It’s a mature, deployable technology that can deliver real business value when done right. As we continue to see innovations in this space, I’m optimistic about the future. With the right planning and tools, we can create AV systems that are not only secure but also flexible and efficient.

In an interview with Systems Contractor News (SCN), Jessica McDowell, senior vice president of Business Development & Security Strategy at TD SYNNEX, said phishing remains a top threat, as cybercriminals use deceptive emails, messages, and calls to trick people into providing sensitive information or downloading malicious software. She notes that artificial intelligence can be a double-sided coin, offering enhanced security on one side and the potential for mishandling data on the other. TD SYNNEX provides industry training via its Enablement Portal TDS University and the Security Practice Builder.

It seems the security landscape changes daily. What are you seeing as the latest threats?

Phishing continues to remain the top threat, as cybercriminals use deceptive emails, messages, and calls to trick people into providing sensitive information or downloading malicious software.

Increasingly, we’re seeing these attacks involve extorting money from victims, most commonly through ransomware. Those attacks are continually evolving in sophistication as hackers find new ways around restrictions. They’re even using generative AI and machine learning to efficiently spin off new, more enhanced, and effective vectors of attack.

Long-term and highly sophisticated cyberattacks by nation-state threat actors remain a concern for government agencies and large corporations. And while finance and healthcare continue to be the top targeted industries, we’re now seeing the largest number of attacks on manufacturing as cybercriminals focus attention on Operational Technology (OT).

OT accounted for nearly 40 percent of cyber-attacks in 2022. While IT attacks steal data, OT attacks focus on industrial control systems. Criminals seek to make a physical impact as well as a monetary one.

From an integrator’s perspective, everything is now on the network, so everything must be protected. Networked audio and video also add potential threats through holes created in the network. So, it’s critically important to consider security in every application and in every vertical market.

How does AI factor into the security landscape? And where does AV fit in?

AI is a two-sided coin.

On the one hand, we believe AI could potentially enhance security solutions through automation. AI can help identify and respond to threats in real time, potentially detecting and preventing attacks more effectively. AI can do this by learning to recognize normal usage and network interactions and behaviors by analyzing vast amounts of data very quickly and accurately. The resulting reduction in false positives and negatives in threat detection means better detection of abnormal activities—both from the inside and from skilled outside attackers.

And AI can help to automate some security tasks, which reduces the workload on security teams, allowing them to focus on more complex security issues. This is particularly important to resource-constrained organizations.

Conversely, AI also presents security risks. With AI comes the need for access to large amounts of data, which raises concerns about data privacy and the potential for mishandling personal information. In addition, AI-fueled attacks have the potential to be highly sophisticated, leading to challenges in defending against them.

We’re seeing a rapid expansion of AI within the audiovisual segment. For example, AI-powered video analytics can be used for security and surveillance by analyzing camera feeds for potential threats or incidents. AI algorithms can also detect and flag inappropriate AV content, which helps platforms maintain content standards and safety.

From a physical security standpoint, an increasing number of features are getting built into cameras that allow users to monitor and track a variety of details.

With growing concern about AV devices creating security risks on the network, it’s important for AV teams to coordinate with network administrators closely, explain the purpose of the hardware being put on the network, and work with them to configure the network in a secure but functional way.

A good first step for AV integrators is to change the default passwords on devices and not use the same one on multiple devices. Good password management is a great start to any security best practice.

How is TD SYNNEX continuing to enable AV partners who want to expand their security practice?

TD SYNNEX provides industry training via our Enablement Portal TDS University and through our Security Practice Builder. Our product business management teams serve as thought leaders throughout various technology segments by creating content and delivering information about the industry and specifically how our vendors and value-added services address industry trends.

Our Next UP team is focused on new and emerging vendors. In addition to enabling our partners to sell specific vendor offerings, they offer line card consultations to help our partners identify where they may have a gap in their offerings or where they may need to beef up their offerings in a particular segment.

In fact, our services team has been incredible at helping augment our partners' capabilities in terms of delivery and support. We continue to offer complimentary Security Assessments, and more partners than ever are taking advantage of those. In addition, we recently launched a self-service portal with five assessments for partners to take with or on behalf of their customers, providing a guided plan based on the report findings.

In summary, our value to our partners is simplified into four key pillars: We help you learn, we solve for the technology ecosystem's complexity, we deliver technology solutions with versatility, and we help you evolve.

For more information, you can reach us at cybersolv@tdsynnex.com.

As a result of the changes in how organizations and people now work, the reliance on experienced, certified, and readily available technical and cybersecurity support is at an all-time high. It’s essential that all risks are continuously monitored to ensure network infrastructure is always available and secure at all times. Khipu Networks is a cybersecurity company developed in response to the need for constant support and managed services that let customers focus on project delivery, rather than be consumed by the daily tasks of monitoring and managing unforeseeable problems and cyber breaches. The company provides many services, which are overseen from the company’s 24x7x365 staffed Network Operations Centre (NOC). To that end, the company required a video wall management solution that would allow the flexibility to visualize the entirety of their data and informational feeds and replace their existing visualization solution, which couldn’t match their current and future needs. 

VuWall's disruptive approach to video wall management in AV-over-IP environments, bridging AV, IT, and IP systems to seamlessly manage and control visual content throughout organizations, was exactly what Khipu needed.

[Experts Explores How to Build New Era of Cybersecurity]

Khipu proactively monitors clients’ infrastructure and security postures to provide immediate identification of problems either before or as they occur—allowing quick alerting, action, and resolution. This means staff must have eyes on clients’ entire IT environments, which can include LAN, Wi-Fi, next-gen firewalls, RADIUS, WANs, UPS power supplies, IoT, servers, service/application, and more. Khipu’s existing solution was not flexible enough to give them the insight to allow for rapid response—with equipment failures and nagging intermittent issues becoming the norm. For example, the content could not be changed dynamically, and the user experience was clunky. The company replaced their exiting screens with six LG 55SVH7F 0.44mm bezel displays. To complete the solution, they needed a single technology solution that would allow their integrator to effortlessly build an IP-based video wall as well as provide Khipu staff with a centralized video management platform with customizable views that can be changed as needed.

To meet the demand for flexibility and modularity, the integrator on the project, Clear Visual Communications, proposed VuWall. VuWall delivers an innovative ecosystem of video wall controllers, encoders, and decoders—all managed by its interoperable TRx Centralized Management Platform (TRx). TRx eliminates the complexity of traditional video wall control and signal distribution over IP, with easy drag-and drop operations and without any programming. Easy to use, the TRx platform enables distribution of any source to any type of display in professional and mission-critical applications, which proved to be an ideal solution for Khipu’s NOC.

Yet another benefit, TRx simplifies the integration of third-party products. Already supporting a variety of AV-over-IP protocols (H.264, SDVoE, NDI) and compatible with multiple brands such as NETGEAR, Samsung, LG, IHSE, Adder, Genetec, and many others, TRx continues to grow its ecosystem, ensuring future-proof and scalable deployments.

[VuWall's Shows Off New Video Wall Collaboration Technology]

Clear Visual Communications built the much-needed video wall for the NOC by stitching together two VuWall PAK 40 video wall nodes, increasing processing scalability and flexibility while adding a layer of redundancy. The compact PAK appliance is a networked, multi-decode node that can operate as a standalone device or be stitched with other nodes to build an IP-based video wall that is infinitely scalable. It simplifies video wall deployments by reducing the number of connections and eliminating a single point of failure, reducing project risk, and offering improved reliability.

Whether the deployment is large or small, all that's required are PAK appliances, making it easy to build video walls. To increase the size of a video wall, the integrators can simply add a PAK. PAK features up to four HDp60 outputs or one 4Kp60 output and multiformat decoding up to 32 HD streams per device, including H.264, MPEG2, MPEG4, NDI, PNG, JPEG and VNC/remote desktops or virtualized browsers. PAK is designed for multiroom visualization, situational awareness, control rooms, and corporate workspaces. Its eco-friendly design boasts a compact form factor and low power consumption. PAK is small enough to be mounted behind monitors, saving rack space, and reducing extended video cable runs.

The installation also included a VuStream 150 encoder appliance and Application Server, which are also centrally configured and managed by TRx. The VuStream 150 provides single stream encoding of H.264 and H.265 sources in FHD and UHD. The VuWall Application Server is an appliance for streaming, sharing, controlling, and visualizing websites, dashboards, and applications across networks. The Application server simplifies video wall deployments by providing quick access to websites, dashboards, and applications from a centralized source—a must for the NOC. The NOC also benefited from VuWall’s ControlVu touch panel, which gives operators the freedom to change layouts and control devices with a simple touch.

[Pro AV 2023: Trends to Watch]

Clear Visual Communication’s deployment of VuWall delivered the exact flexibility and ease of use the NOC needed, aligning with the mission-critical requirement of the cyber security service provider. In addition, the company didn’t have to make addition investments for an external control solution such as Crestron or Extron.

“Our video wall is critical to our Cyber Security Operations Center," explained James Holland, UK technical manager at Khipu Cybersecurity. "We are extremely pleased with the performance and ease of use of VuWall’s PAK and TRx solution. Learning to operate and manage video wall content took minutes. The intuitive software and rich feature set will certainly improve response times and increase productivity in our control room. Knowing how easy it will be to increase the size of our video wall with PAK, as our demands change, is very reassuring. The fast and easy deployment was impressive, and we are confident that our integrator made the right choice with VuWall.”

[AV Network's top stories, product news, and expert insights] 

“As one of the very first PAK customers, we are now confident that this technology is the future of video wall deployments," added Rebecca McCartney, operations manager at Clear Visual Communications. "We were extremely impressed with the quick and easy installation of the system and the ease of system configuration, yielding to a low-risk deployment. The feedback from the end user’s cybersecurity control room operators has been extremely positive, especially with respect to performance and ease of use. We clearly made the right choice and look forward to many more control room and video wall projects with VuWall.”

In today’s era of artificial intelligence and a cyber-attacks, neither consumers nor businesses can face insecurities alone. Having protection leads to empowerment and hopefully a day of human security in all technology.

Rajeev Chand, partner and head of research at Wing Venture Capital, moderated the "Great Minds: How to Build a New Cybersecurity Era" panel at CES earlier this year in Las Vegas. The panel included Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency (CISA), and George Kurtz, CEO of CrowdStrike, and discussed cybersecurity today and where it is heading.

Unfortunately, neither Kurtz nor Easterly could deny that the number of breaches and cost per breach are on the rise. “Cybercrime totaled $6 trillion last year, is projected to be $8 trillion this year, and over $10 trillion in 2024; that’s just not sustainable,” said Easterly. “We have to take a different approach to sustainable cybersecurity, which is about technology companies creating technology that is secure by design and secure by default.”

[Cloud Power: What You Need to Know About Security in the Cloud]

“Security parallels the slope of the technology innovation curve,” added Kurtz. “As the technology curve increases in its complexity, so does the security. And that’s where the gaps come in. Hopefully programs can help aid and make it better, but sadly we’re still dealing with poor passwords and backward compatibility.”

Both Kurtz and Easterly concurred it would be nice to have a general report card but isn’t that easy. Industries like finance that are highly regulated are more prepared, whereas the electronics industry may not be.

“We have this focus on how prepared a company is. That's important,” Easterly said. “But what we need to do is to figure out how the technology products that we use every day are going to be designed to be safe with security features built in and how they are built so the number of vulnerabilities is fewer than they are now.”

“Consumers shouldn’t have to think about security,” Kurtz added. “If you’re putting the onus on the consumer, you’ve already lost. That’s built into the overall economics of what people are buying.”

Among the many other topics discussed was Russian cyberattacks and where they may have fallen short, and the double-edged sword of AI in cybersecurity.

[Mitigating Network Security Risks in the Hybrid Workplace]

“AI in general is critical in the field of cybersecurity,” said Kurtz. “And we use it for good purposes but then there are the bad guys that use it for evil purposes.” Kurtz went on to discuss what he called community immunity and how AI equates to protection through training and monitoring.

Lastly, both Kurtz and Easterly agreed that companies should not be afraid to report cyberattacks or breaches. It is about protecting the consumer and being able to analyze attacks will only further that.

“It’s not about blaming or shaming a company,” said Easterly. “It’s about protecting a company so we can do something about it. But most importantly we can use that information to protect a sector. It’s about keeping the neighborhood safe.”

“The intent is to add value, not to add burden,” she concluded. “We need to come together so that companies have an incentive to come forward. It’s about safety of Americans, not self-preservation.”

Cobalt Iron Inc., a leading provider of SaaS-based enterprise data protection, has been granted a patent on its technology for dynamic IT infrastructure optimization in response to cyberthreats. Issued on Dec. 28, 2021, U.S. Patent 11212304 describes new capabilities for Cobalt Iron Compass, an enterprise SaaS backup platform, whereby Compass will automatically reconfigure IT infrastructure when it detects cyberthreats, such as a ransomware attack. This capability keeps data safe and accessible.

Cybercriminal activities increasingly threaten the availability and integrity of critical business data. It is challenging enough to detect these activities in a timely manner, but once they are detected, businesses are often unsure of what steps to take to limit the impact of an attack and to remediate any damage. Particularly challenging is the fact that most IT infrastructures are statically configured and completely unresponsive to changing conditions and cyberthreats. 

[Cobalt Iron Named Top 10 Cybersecurity Company by CIO Bulletin]

The newly patented techniques introduce unique ransomware analytics and automated optimizations that respond to cyberthreats. They will dynamically adjust access to backup infrastructure and data to reduce exposures to cyberattacks. They also can provide analytics-based insights into an attack and automatically perform various operations to further secure data.

The techniques disclosed in this patent:

 •Continually monitor metrics, events, and conditions for indications of a cyberattack in the network.

 •Analyze metrics, events, conditions, and configurations to identify infrastructure components and data that could be impacted by or be vulnerable to a cyberattack.

 •Automatically restrict access to impacted or vulnerable infrastructure components and data.

 •Automatically create an audit report of impacted infrastructure components and data.

 •Automatically initiate remediation operations for impacted data. Remediation operations might include things such as:

  o Initiating data replication of a previous clean backup version of the data to an off-site location.

  o Initiating recovery and validation of affected data into a safe storage location.

For example, in the event of a cyberattack, Compass could detect the event, conduct impact analysis to determine which data and hardware components might be affected, restrict access to those data and components, perform other operations to remediate exposures, and generate an audit report associated with the event. 

Cobalt Iron Compass EOS allows users to search the entire enterprise backup landscape

"The Cobalt Iron Compass solution delivers backup infrastructure and data with simplicity and security at scale," said Rob Marett, Cobalt Iron's chief technology officer. "This patent discloses additional ransomware analytics, combined with automated responses. These new Compass techniques further secure critical business data and make backup infrastructure more responsive to cyberthreats. This patent extends Cobalt Iron's technology leadership in the areas of ransomware analytics and automated IT infrastructure optimizations."

Solutionz Inc. announced the launch of Solutionz Security, a full-service firm offering cybersecurity protections for small and midsized businesses, the public sector, and enterprise organizations around the world.

Solutionz Security originated from a need to provide cybersecurity protection for the customers of AV integrator Solutionz Inc.

Executives at Solutionz saw that cybersecurity-related attacks were growing in both frequency and scope. The increase in ransomware demands, supply chain attacks, and threats to internet of things (IoT) devices places even small organizations at risk as hackers exploit backdoors in smart TV firmware or software, telecommunication equipment, and cameras.

“If you think about internet traffic that you have through communication, it is no different than data. The same mechanisms that monitor communication, monitor IoT traffic. There is an easy bridge that we are creating over that chasm,” said Solutionz CEO Bill Warnick of the logical crossover from an AV-specific cybersecurity division to the need for a sister company focused on full cybersecurity programs.

[ How to Think About Network Security After COVID ]

Shawn Fernandez, Solutionz vice president of business development and leader of the initiative to develop Solutionz Security, said, “There are a lot of layers to cybersecurity. We created Solutionz Security to have 100 percent focus on cybersecurity. We took two years to develop our team of partners, experts who understand the complexities of cybersecurity both from the MSP and from the customer’s perspectives.”

Fernandez described Solutionz Security’s approach: “We are selling more than tools. We come into an organization and address their current defense posture.”

He continued, “The best money spent is the money already spent on your cybersecurity. We want to build on your success. We do not come in and say that we need to rip and replace your current solutions because our product is better. We look at what an organization has already done, the efforts already put in. We then assess the gaps that exist, and we formulate a plan, prioritizing the largest and most risky gaps, and then we solve for that.”

Warnick emphasized the importance of making cybersecurity simple for customers, “Cybersecurity does not have be hard. You don’t need a law degree to know when you need the police.” The quality of the assessment and managed services allow customers to feel confident that their digital landscapes are understood and protected without them needing in depth knowledge about cybersecurity. Solutionz Security’s cost-effective protections meet and document the various compliance requirements for payments, healthcare, corporate and government organizations.

[ Ongoing Vigilance and Improvements Characterize the State of Cybersecurity in 2020 ]

Of the many cultural buzzwords coined during the COVID-19 pandemic, the term “Zoom bombing” may be the most memorable.

Early in 2020, celebrities like Kristen Bell and Conan O’Brien popularized the practice of surprising online videoconference attendees by joining their meetings unannounced. As charming as that may be, not all Zoom bombings are innocuous. Bad actors use these virtual break-ins to secretly snoop on corporations and organizations. They may also share inappropriate images and videos meant to disrupt the proceedings.

Like other computer and network hackers, Zoom bombers rely on human fallibility and poor judgment to gain access. The most common entrance is right through the front door, either because the host neglected to use safety protocols such as requiring a password, or because they failed to sequester attendees in a queue so they could be verified before being allowed into the meeting. Sophisticated hackers can mimic profiles of actual guests, making it harder for the host to kick them out of the call.

“The best way is to have at least one step of authorization, but two steps can ensure that there isn’t a breach or someone who is not authorized in the meeting,” said Steve Greenblatt, CTS, president and founder of Control Concepts. “A lot of these steps take time and effort, make conferences less convenient, or make more work for people, but they will result in a more secure outcome and allow hosts to avoid those types of embarrassments, as well as potential security breaches.”

Zoom bombing is just the tip of the proverbial iceberg of new network security threats. As workers return to office environments after a year or more of working at home, they may bring devices with them that have not been vetted by IT staff. Tim Albright, chief marketing officer at Conference Technologies Inc. (CTI) and CEO of AVNation, said that the potential for third-party peripherals to compromise an organization’s network is the single biggest security issue integrators are dealing with heading into late 2021 and 2022.

[ Staying Secure in the New Hybrid Work World ] 

“Up until a year and a half ago, the IT department was also the procurement department for everything that was on the network,” said Albright. “Now, a year and a half later, folks have gotten equipment on their own to make their work-from-home [situations] work. That stuff is going to start finding its way to the office and onto the office network.”

Organizations have ways of locating unapproved peripherals, such as by deploying tools that continually scan the network for known and unknown MAC addresses and can alert IT or the AV integrator when an unauthorized device is connected. But those measures are purely reactive. Greenblatt says proactive maintenance can prevent security threats from infiltrating the network in the first place.

[ The Integration Guide to Secure AV ] 

“Vulnerabilities are happening all the time, and computers these days are getting updates and security patches to address new threats,” he said. “It’s very possible that becomes part of a maintenance agreement. In my business, for example, we have somebody who looks at our website every month to make sure we don’t have vulnerabilities, that we’re updating our software to make sure that somebody can’t come in and hack our website. If we apply that idea to an AV system, you look at the devices or the setup [and determine if] they need to be better secured. What was in place when the system was turned over may not be as effective now because of new vulnerabilities or issues that may have been identified since then.”

In addition to regular audits and multifactor authentication, integrators can set up a VLAN, or virtual local area network, to help protect against security threats. VLANs allow partitioning of a server so that different classes of connected devices can be grouped together. “The challenge with that, though, is that there are still some ports that need to be open” to allow certain local devices to be able to access the internet, Greenblatt said. “There are also AV over IP devices that need to be able to traverse the network to be effective, so while VLAN can be very powerful, there’s always going to be a need to open up access outside of it.”

Simple practices many people ignore, like changing devices’ default usernames and passwords, can also help prevent network hacks. It’s relatively easy for a hacker to match default IDs to Wi-Fi routers and other connected devices, and AV systems are particularly susceptible to distributed denial of service (DDoS) attacks in which vast numbers of devices across many networks are manipulated simultaneously.

These “zombie attacks” can be large in scale, and costly to fix. A well-known example in 2016 took down Netflix and many other networks along the East Coast. In the mix of devices exploited in the attack, Albright noticed something troubling to the AV business: zombie web cameras and network-compromised speakers. “When I saw that, it’s like, yes, the AV industry certainly has an issue with this,” he said. “We have an issue because our devices are getting put on the network more frequently, which means we need to make sure we’re doing the simple things, such as changing the login and password. You’ve got folks who can take control of these because they’re public-facing, on the network, on the internet.”

On the horizon, the increasing numbers of internet-connected smart devices create more network vulnerability. “You’re talking about yet another entry point that could be a vulnerability, and if it happens that an [Amazon] Echo or another type of voice interface is listening, then [hackers] can know what you’re talking about and be able to track what is happening,” added Greenblatt. “As we try to make systems intelligent, we have to be concerned about them having access to information that gives them more power than we know.”

As networks grow more complex and devices more sophisticated, vigilance in the fundamentals of network security will be more important than ever.

“The rule of thumb I think everybody goes with is that you’re only as strong as your weakest link,” concluded Greenblatt. “We do a good job of having technicians [pull wiring], and we have experts who know how to set up products and make sure an image looks good and the room sounds good, but we should also have an IT or cybersecurity specialist who can give our clients confidence because they know they’ve brought somebody in who’s going to protect them.”

Click here to read more stories from the August 2021 issue of SCN.

Focus on Network Security

Improving AV Device Security on Converged IP Networks • How can system designers and integrators collaborate more effectively with tech managers to improve AV device security on converged IP networks?

Keeping Sensitive Information Secure on the Network • As more networked devices join the AV space, many network administrators in all industries are expressing concerns about the efficiency of the network.

Staying Secure in the New Hybrid Work World • As AV/IT managers adapt to the new hybrid workforce model, more personalized approaches to technology are needed, opening up new potential network security vulnerabilities.

"Even smaller universities and colleges, as well as those without an emphasis on research, are prime targets for this type of cyberattack. Regardless of whether an institution considers its data to be valuable, chances are that cybercriminals do."

Read More

WHY THIS MATTERS:

Education is the most affected sector for malware attacks when compared to other industries like business and professional services, retail and consumer goods, and high tech. An analysis of ransomware campaigns within higher education found that ransomware attacks against colleges and universities have more than doubled since the onset of the coronavirus pandemic.

Good AV/IT tech managers know that addressing security concerns makes for a stronger relationship between their organization and the security team—and for smoother deployments. But it doesn’t stop there: when you’re well-versed in IT security concepts, you’re well-positioned to gain access to higher-level business discussions. One route to developing security expertise is through certification, and AV Technology recently explored what’s involved in earning what’s widely considered the gold standard of security certs: the Certified Information Systems Security Professional, or CISSP. 

Azeem Khan is senior consultant of application development (AV) at CIBC, a financial institution headquartered in Toronto. With a background in both security and AV, he is currently pursuing a CISSP—a logical step forward, he said. He believes that security knowledge is necessary in today’s networked environment, and holding a CISSP proves that one is capable of implementing and managing enterprise-level information security. “Nowadays at the enterprise level when we are putting all of these AV devices [on the network], it is our responsibility as AV specialists to be able to point out the security risks that we see when devices are communicating with each other,” he said. “As an AV specialist, you know how people interact with those devices, so you have more perspective on the security risk that comes from those devices versus people who are not from the AV domain.” 

[Staying Secure in the New Hybrid Workforce Model]

(ISC)2, headquartered in Clearwater, FL, is the professional organization that offers the CISSP. The CISSP comprises eight domains: security and risk management; asset security; security architecture and engineering; communication and network security; identity and access management (IAM); security assessment and testing; security operations; and software development security. (ISC)2 requires that candidates have five years of paid work experience in two of the eight domains (there are exceptions; visit the (ISC)2 website and download the CISSP Certification Exam Outline for more details).

“In IT and AV—and I consider AV part of IT—cybersecurity crosses many fields,” said Toni Hahn, content development manager at (ISC)2. “I feel everyone should know something about cybersecurity.” The CISSP, she explained, covers cybersecurity concepts, and the exam requires candidates to apply them. “AV could fit into almost every domain on the CISSP.”

The CISSP is not, however, for everyone. Damon Drake, content developer at (ISC)2, noted that sometimes organizations require job candidates to hold CISSPs for positions that don’t really require them. “We’ve seen [situations] where a company will have an entry-level position with entry-level pay requiring a CISSP certification,” he said. “It’s really a managerial-level cert. You’ve got to be able to look at risk management: how does that affect your physical security? How do you do access control—both physical and cyber?” There’s a lot to it, and as Drake puts it: “it’s not a beginner cert.”

Drake and Hahn should know. Both are ex-military (he was in the Air Force, she’s former Navy). While in the military, both worked in AV and IT. Once out, both worked in security engineering and management in mission-critical environments. Both failed the CISSP twice.

Drake recounts that when he first decided to prepare for the CISSP, he took an online course featuring many videos. When he didn’t pass his first exam, he did a boot camp. That didn’t bring the desired results either. 

[AV Network Nation Panel Addresses Networked Audio Security]

“A lot of it comes down to—and this is probably going to sound counter-intuitive—the more diverse your career is, the more you can get jaded by what companies do, as opposed to what the right thing to do is,” Drake said.

Because the questions on the CISSP exam are largely scenario-based, the “right thing to do” is the primary focus, Drake explained. But if you’ve been working in a company that has refused to invest in the application of security best practices, you may have developed a belief system that negates their necessity. This won’t be much help with the CISSP. “A lot of our questions are worded like, ‘What is the best? What is the most appropriate? What is the greatest?’ And although those are subjective terms, that is putting you in the best practice mindset. All of our questions are written that way to really focus on the best practice for whatever concept is being presented at the time. It’s really stepping back and almost being mentored by a manager and understanding the business functions, and then applying the cyber concepts to those.”

Like Drake, Hahn took a boot camp and failed her first exam. “Then I said, ‘well, I’m just going to study all these books and these practice questions,’” she recalled. “I thought I was really ready. They put the test in front of me and I actually asked the proctor—because this was back in the paper/pencil days—‘Are you sure you gave me the CISSP?’ He looks at the exam and he says, ‘Yup.’” After yet more studying—and another boot camp—the third time turned out to be the charm. 

[Byte-Sized Lesson: Security and TCP Handshakes]

Both Drake and Hahn agree that candidates should plan for a year’s worth of exam preparation. “One single boot camp, one class, one book, or one video series is probably not enough,” Hahn said. She advises people to cross-study and take the practice exams. Although they may not contain what is on the actual exam—sometimes practice exams focus on definitions, like “What is a disaster recovery plan?” rather than the scenario-based questions the CISSP exam tends to favor—she said that it helps people gain a deeper understanding of the concepts. “It all starts clicking. And so by the time you do sit for the exam, you know the concept—you’re not just memorizing [the definition of a disaster recovery plan]. You know the actual concept, and when you’re asked the [scenario-based] question, you can say, ‘You know what? This is what I would do.’”

Anishia Gopi, senior consultant of infrastructure engineering at CIBC, is also in the process of preparing for the CISSP exam. In addition to the official study guide and other materials, she has also participated in study groups. “Some people prefer to just sit with their book and go through it,” she said. While she said the book and online materials are definitely necessary, exchanging with other candidates helps to solidify the concepts. “If you have a group of people, you can share knowledge and tackle the scenario-based questions in a better way.” She also counsels candidates to examine the tasks they perform daily at work, and how they may relate to the exam preparation material. 

For Gopi, the CISSP provides the opportunity for meaningful professional development. “This is not just about adding a certification tag on your resume—it’s not just that,” she said. “You are taking a step toward being involved in making business decisions. It’s not easy—some of the modules are so difficult that you can easily give up. But I would say that if you are serious about that bigger goal, then it’s easier to pursue.”

Additional CISSP Tips

Hahn recalled that when she was working in AV, she was hands-on, ready to connect cables, configure systems, and perform the plethora of physical tasks associated with deploying a system. There is an element to the CISSP, she said, that more traditional AV professionals may be unfamiliar with. 

“They have to touch on the paperwork side,” Hahn said. “How do you do a business continuity plan? What is a disaster recovery plan? Is there anything I need to know about configuration management? What is a risk assessment? It’s more the paperwork—the policies, the procedures—that an audiovisual professional may have to study a little more. And probably the cryptography—it’s not its own domain anymore, but it is on the exam.”

Carolyn Heinze is a freelance writer/editor. 

NordVPN recently launched a National Privacy Test to gain insights into the global level of cybersecurity awareness and found that Americans are fourth in the world in terms of their cybersecurity skills and knowledge.

The U.S. got 68.5 points out of 100 in the National Privacy Test and was outplayed by three European countries: Germany, the Netherlands, and Switzerland.

Watch the video below to learn more about the top five cybersecurity insights gained from the research.

Americans have demonstrated a great knowledge of how to behave when facing direct threats online (87.3/100). For example, 92.9 percent of respondents understand that the bargains on streaming service accounts you can find on eBay are stolen credentials and should not be bought. 

What Americans fell short of the most was habits. A third of respondents (30.6 percent) proceed without “wasting” their time on reading the privacy policy, while 31.0 percent postpone software updates indefinitely.

NordVPN says 48,000 people from 192 countries participated in the National Privacy Test, and analysis was performed only on countries where the number of respondents was higher than 400. 

For more information or to view the full report, visit https://nordvpn.com/national-privacy-test/

Organizations are building confidence that their cybersecurity practices are headed in the right direction, aided by advanced technologies, more detailed processes, comprehensive education, and specialized skills, new research from CompTIA finds.

Eight in 10 organizations surveyed for CompTIA’s State of Cybersecurity 2020 report said their cybersecurity practices are improving.

At the same time, many companies acknowledge that there is still more to do to make their security posture even more robust. Growing concerns about the number, scale, and variety of cyberattacks, privacy considerations, a greater reliance on data, and regulatory compliance are among the issues that have the attention of business and IT leaders.

Two factors—one anticipated, the other unexpected—have contributed to the heightened awareness about the need for strong cybersecurity measures.

“The COVID-19 pandemic has been the primary trigger for revisiting security,” said Seth Robinson, senior director for technology analysis at CompTIA. “The massive shift to remote work exposed vulnerabilities in workforce knowledge and connectivity, while phishing emails preyed on new health concerns.”

[The Integration Guide to AVoIP]

Robinson noted that the pandemic accelerated changes that were underway in many organizations that were undergoing the digital transformation of their business operations.

“This transformation elevated cybersecurity from an element within IT operations to an overarching business concern that demands executive-level attention,” he said. “It has become  a critical business function, on par with a company’s financial procedures.”

As a result, companies have a better understanding of what do about cybersecurity. Nine in 10 organizations said their cybersecurity processes have become more formal and more critical. Two examples are risk management, where companies assess their data and their systems to determine the level of security that each requires; and monitoring and measurement, where security efforts are continually tracked and new metrics are established to tie security activity to business objectives.

The report also highlights how the “cybersecurity chain” has expanded to include upper management, boards of directors, business units, and outside firms in addition to IT personnel in conversations and decisions.

Within IT teams, foundational skills such as network and endpoint security have been paired with new skills, including identity management and application security, that have become more important as cloud and mobility have taken hold. On the horizon, expect to see skills related to security monitoring and other proactive tactics gain a bigger foothold. Examples include data analysis, threat knowledge, and understanding the regulatory landscape.

[The Technology Manager's Guide to the State of AV Over IP]

Cybersecurity insurance is another emerging area. The report reveals that 45 percent of large companies, 41 percent of mid-sized firms, and 37 percent of small businesses currently have a cyber insurance policy. Common coverage areas include the cost of restoring data (56 percent of policy holders), the cost of finding the root cause of a breach (47 percent), coverage for third-party incidents (43 percent), and response to ransomware (42 percent).

State of Cybersecurity 2020 is based on a survey of workforce professionals at 425 U.S. companies conducted in August and September 2020. The complete report is available at comptia.org/content/research/cybersecurity-trends-research.

AV integrator Solutionz, Inc. has launched SecureAV, a new cybersecurity service. Enormous amounts of critical information are commonly exchanged via electronic meeting rooms, as well as unified communication environments every day. SecureAV protects organizations from inherent known vulnerabilities that exist in AV equipment. Through SecureAV, Solutionz proactively prevents, detects, responds, and reports on security concerns specific to an organization’s AV/UC environment.

[Playing IT Safe: The State of Networked AV Security]

SecureAV is designed to address these specific security needs and protects that information on an ongoing basis, without utilizing scarce IT/security resources. SecureAV looks at every data packet coming into and out of the environment and uses machine learning to determine if the traffic is a threat. It then reacts according to personalized policies and protects the IoT environment against common attacks including eavesdropping, botnets, denial of service attacks, man in the middle attacks, LAN hopping, open relays, and other common security issues.

According to Shawn Fernandez, vice president of cybersecurity business development, “We have been watching and assessing the ever growing problem of malicious threats to the IoT environment for some time now, and are acutely aware that AV is now a part of every organization’s IoT landscape. We feel that it is imperative to respond with a service that will protect our customers from these growing threats.” Shawn will continue to expand the cybersecurity portfolio at Solutionz.

“I am excited about what this game-changing new managed service offers to our customers,” said Bill Warnick, chief executive officer of Solutionz. “We have partnered with some of the brightest minds in cybersecurity to provide the best possible protection for AV and UC environments. SecureAV gives our customers the confidence that Solutionz is on the job, vigilantly monitoring and taking action against any online threat.”

Solutionz’ SecureAV managed service offering is available to organizations regardless of where their AV/UC equipment was purchased. It offers remote support 24/7/365 and is fully customizable to meet budgetary needs.

Non-Disclosure Agreements (NDAs) are becoming very common in business—and not just pro AV, but all business. Not understanding all of the terms of an NDA and how to manage the information can cause damage to your company, your clients, and your reputation.

There are multiple items to consider when entering into an NDA. A few questions I ask are: Is it for the company overall, or just the person? Is it a single-sided NDA or is it mutual or bidirectional? Do you need to have subcontractors sign the NDA? These will typically be called out in the NDA itself. That is the first thing that most people neglect to do before signing: read the entire document. I have distributed and received many NDAs; I am always amazed by how many people don’t understand them…and sign them anyway. Some of the NDAs bind the company, some bind the individual. As a company principal, it is folly to have someone binding the company without a review first. Any questions and clarifications must be documented in the form before signing.

I prefer that NDAs be signed by all parties involved, even if it is companywide. The main reason is that I feel it helps all of the people understand the seriousness of the agreement. If everyone does not understand the requirements, how can the conditions be met? I also caution people that the NDA might have repercussions that are unexpected. When working with a publicly held company, the E.U., the U.S., and others have regulations to control financial information. This condition might seem far-fetched; however, think what would happen if someone knew where a company’s new headquarters was going to be built based on purchasing hundreds of conference room systems.

Now that a company has privileged information, managing it is imperative. Having been involved in projects that experienced information breaches, proactive information management is critical. The basic question I ask is: “Does this person need to know the project?” And about 95 percent of the time, they do not. After I have determined who needs to know, I then hand them a copy of the NDA to sign.

While managing information goes beyond the digital world, securing the computer data is one of the first steps to take. Not only should access be restricted, but I’d take it a step further and encrypt the data. Yes, information needs to be secure during transport and storage. The standard operating systems enable encryption of a hard disk; I do that on all my drives. I also consider encrypting the file with PGP or GPG encryption, just in case. Multiple layers of security are key.

That seems easy enough, right? There is much more to be aware of when dealing with confidential information. If there are hard copies—such as drawings or plans—keeping those secure is essential. Sometimes it’s as simple as not leaving said hard copies unattended on a desk or at the printer. If hard copies are needed, store them in a locked filing cabinet or room. After using the documents, shredding the materials is a must. Don’t forget to apply this due diligence to erasing your whiteboard or digital collaboration system—you have to ensure your information is not just laying around the office.

Headed out on the road? Don’t forget your security processes while traveling. Do not have phone calls in public that reveal privileged information; the same approach goes for using a computer in public where people can shoulder surf. Don’t talk about the project when at lunch, even if it is just you and coworkers. While people are typically not malicious, the idea of gossip and sharing a secret is just human nature. People will share a secret they know to feel important.

Think I’m being a little overzealous about the security of data and keeping it secret? Think back to last year when Equifax let down its guard—now think about how much it has sullied its own reputation. By following the rules of the NDA, I do not worry about my reputation. It is the only thing I can control. I don’t want someone else screwing it up by violating the NDA; that is why I am proactive.

No Assumptions

Do not assume that everyone working for the same company knows everything. This may seem very obvious, but when you think about the difference in responsibilities between the shipping department and the design department, you know those employees don’t know all of the same confidential information. Less apparent is that people within the same design department might not know about their coworkers’ projects.

Think of a significant integration firm with multiple locations. Why does the New York office need to know what the New Jersey office is doing? The same goes for end users or clients. Not everyone knows what is going on in every division. Just because it is the same company, do not share the information unless you know that you are allowed to share.

About to blab? Call the person you signed the NDA with and ask if you are allowed to share the information with another party. This will also help build your reputation—it will reinforce that you are cognizant of NDA requirements.

Don’t forget about subcontractors. If you are using them, ensure people critical to the NDA are aware subcontractors are now involved. And make the subcontractor has signed the same NDA, then file it with the originator.

Note: I am not an attorney; this column is not meant to provide any legal advice. Please consult your legal team for counsel. This piece is my opinion. I am not speaking for anyone else, including, but not limited to: my employer, System Contractor News, or Future plc.

Former Pennsylvania Governor Tom Ridge will be the keynote speaker at NSCA's third annual Pivot to Profit event on Oct. 23-24 in Atlanta.

Ridge, alliantgroup chairman of cybersecurity and technology, first U.S. Secretary of Homeland Security, and 45th Governor of Pennsylvania, kicks off the event by sharing insights regarding how the industry’s businesses and clients can protect themselves while still implementing the technologies needed to compete on a global level.

His session—“Manage Cyber Risk Before It Manages You”—teaches integrators how to play offense vs. defense when it comes to data breaches. Pivot to Profit attendees will learn how to do as much as possible to equip and defend themselves against this new style of warfare.

During a long and distinguished career that has spanned the public and private sectors, Ridge has established himself as an authority in areas as diverse as intelligence analysis, national security, economic development, education, health, and the environment.

In response to the tragic events of Sept. 11, 2001, Ridge was appointed by then-President George W. Bush as the first director of the newly formed Office of Homeland Security. In January 2003, the Office of Homeland Security was designated by the Bush administration as an official cabinet-level department. Ridge was appointed as the nation’s first Secretary of Homeland Security.

At Pivot to Profit, integrators will also hear from technology experts about:

• Merging digital and physical workplaces
• Ways to create immediate recurring monthly revenue streams
• What’s moving to the cloud next
• Smart buildings and their stress on network infrastructure
• How managed services change marketing/client messaging
• Healthcare, K-12, and higher-education technology solutions of the future
• Building a managed services sales machine

“For years, we’ve talked about how change is coming for systems integrators,” said Chuck Wilson, NSCA executive director. “That time of change is here, and it’s time for integrators to examine their technology, services, processes, and structure. Governor Tom Ridge will help them do that, and give them tips and strategies they can use to prepare for these changes.”

Registration for the two-day event is $295 through Aug. 31, 2018. After Aug. 31, pricing goes up to $495. For more information, contact NSCA at 800.446.6722 or visit www.nsca.org/p2p.

Now that AV is consistently placed on the network, it is paramount that installers, integrators, and end users take extra care to ensure these devices don’t create vulnerabilities in enterprises’ security. With AV innovations and confidential information on the same network, how do we ensure the performance of the former doesn’t compromise the integrity of the latter?

Find out more about cybersecurity.

First and foremost, AV professionals need to remember that network security is a large concern that should be considered at the earliest stages of system design. Private data—think employee social security numbers—is held on corporate servers, right alongside AV on the network. Not in an office? Those with technical skills and malicious intentions can create embarrassing situations for integrators and installers. Remember that time someone hacked a large touchscreen at Washington, DC’s Union Station and visitors were exposed to several minutes of adult videos in the middle of rush hour?

John Pescatore, director of emerging security trends at the SANS Institute, thinks AV pros should remember the basics: ensuring information AV systems are continuously updated and security controls are only accessible by authorized users. For sensitive systems, he cautioned, “authorized users should be required to use strong authentication, and not just reusable passwords.”

“Quite often, phishing attacks target system administrators and obtain their passwords—and the attackers are off to the races,” said Pescatore. “Strong authentication can be as simple as requiring receipt and entry of a text message in addition to a password, or require the use of a hardware token, like a USB key.”

A vital aspect of security is communication. All stakeholders should sit down together to discuss the goals of the AV systems, potential implications for security, and how the AV devices will be managed. Once devices are chosen, Pescatore says to “ensure manufacturers have a documented process for providing software updates, and make sure you have a process for rapidly installing the updates; generally, these should be installed in one week or less.”

Another workaround for AVoIP is to keep the products on an isolated network; Pescatore recommends using a firewall to provide only minimum access and to log all connections.

When it comes down to it, there’s no one-size-fits-all for network security. Integrators, IT professionals, and end users need to work together to determine what is the best solution for every single installation.

Find out more about cybersecurity.

Need to Know More?

Have a burning question about cybersecurity — or maybe request for a different topic you’d like to see us tackle? Email us at needtoknow@nbmedia.com and we’ll put our top minds on it!

More from Future on cybersecurity:

• Cybersecurity and Television [TV Technology]
• Cybersecurity and Retail [TWICE]
• Cybersecurity and Radio [Radio World]
• Cybersecurity and Cable [Multichannel]
• Cybersecurity and Residential Integration [Residential Systems]
• Cybersecurity and Pro Audio [Pro Sound News]
• Cybersecurity and Education [Tech & Learning]

Another day, another crippling global cybersecurity breach. Just as these words are being written, the world is reeling from the current cyberattack of the moment, the so-called WannaCry malware. An estimated 200,000 victims were cited across 150 countries by the European police agency Europol. The auto manufacturer Renault shut down, and hospital computers across the United Kingdom were frozen. As per usual, the pundits are calling it a teachable moment, but how many such learning experiences are really needed before the world at large takes serious action in defense of data and information security?

With AV’s continued migration to IP infrastructure (AV over IP), suffice it to say that the risk is clear and present, and the need to secure AV systems from malicious software is critical. Cybersecurity for audiovisual systems is new territory for the AV integration community, but you don’t need to be a security expert to implement key safeguards from the outset of your system designs.

“AV security issues are mainly focused around network segmentation and management—if they are focused on security at all,” said Theresa Payton, CEO of Fortalice Solutions and former White House chief information officer. “The main priority is the network traffic for audiovisual data and ensuring delivery and quality. However, as my team has seen through experience, that lack of security makes them extremely easy to disrupt.”

Improving AV device security on converged IP networks

Many of the basic steps to help protect AV systems data are simply a matter of taking the time and adding an extra step. Changing default passwords is a top recommendation—so basic, it’s often overlooked. “If you need remote access, make sure it is secure. Even small changes to the firewall could expose your customer to gaping security holes with a huge impact, so you need to understand them intricately,” advised Kirk Nesbit, vice president, design and support services, SYNNEX Corporation. “A best practice would be to have the firewall administrator give you SSL VPN access to the network, and then you administer your device instead of poking holes in the firewall for direct access.”

While IoT has dramatically changed the game for information security, it presents a host of challenges. “It is best to install only devices for which the manufacturers have provided a way for resellers to perform updates to underlying OS for security in addition to feature enhancements,” Nesbit added. “Then, have a plan to apply security patches on a regular basis. Many IoT devices released to the public can’t be updated, and could be running some three-year-old unpatched version of Linux—the lowest hanging fruit for hackers.”

A close examination of the customer’s network should be made in order to make recommendations that apply to their specific needs, noted Scott Allard, managing partner, AVNOC, a remote monitoring and service management software solution provider. Ingress and egress—or inbound and outbound network access either by an automated device or manually by a person—or accessing the customers network by using tunneling products should be avoided if not approved by the customer. “Those products allow access to a network basically undetected and information can travel without encryption,” he said. “Although it’s usually just to an AV system, it still can leave opportunity for undesirables. There are more secure solutions for remote access that give the end customer full control without providing VPN or allowing a remote desktop to exist in their network.”

Optimizing AV over IP in corporate network installations

Specifics of the use case are a key consideration for Josh Srago, audiovisual design consultant, TEECOM. “Understanding the needs of the client and the devices when it comes to which require access to a network that touches the outside world versus those that can remain self-contained is vital,” he said. “Is the device using Microsoft Exchange for access? And don’t forget, there’s still the physical element—how does the client handle physical loss of a device with access to networked systems?”

Beyond the usernames, passwords, and controlling access, paying attention to methods or remote access for control, service, and support are top priorities, according to Mike Maniscalco, vice president of product, Ihiji, a remote monitoring SaaS provider for AV integrators. “Additionally, integrators should be sure to disable insecure communication protocols like telnet, HTTP, and unencrypted VPN, and opt for more secure protocols such as SSH, HTTPS, and SSL.”

Educating Clients

Oftentimes end users can be their own worst enemies in the world of information security. Everyone wants the AV at work to function like the gadgets they know and love at home. The harsh reality is that this presents difficulties when a company’s intellectual property and means for conducting business could be held at ransom. Talking to clients about the risks their devices of choice present and the necessary precautions they need to take can be a delicate dance.

“Client education is key because ‘wetware,’ or the human-factor, is often the biggest risk to security,” Maniscalco said. “Limiting physical and remote access to devices is a best practice for securing any system. Be sure to educate clients on proper passwords and password management. Lastly, talk to your clients about the phishing schemes and the risk they pose to account security. These types of schemes can result in costly breaches and ransomware attacks.”

IP network convergence requires that AV pros gain IT networking skills

Srago starts by talking to clients about how they want to use IoT in their workspace. “Once it’s established what systems they want to interact, it becomes an exercise in working with the IT department to determine how to mitigate as much risk as possible.”

He explicitly calls out the fact that a 100 percent secure network does not exist. “If a device is connected, it is a potential vulnerability. This doesn’t mean that if you connect a smart device to the network, they will get your private data, but it doesn’t mean they won’t, either.”

Working with IT and not attempting to work around them is a crucial strategy for Srago when it comes to isolating systems through VPNs or VLANs or using their existing firewalls to your advantage, instead of seeking ways through it. “Knowing things like what ports are being used by the manufacturers and whether that’s going to be in conflict with other systems on the company network if the port number can be reassigned, is something simple that we can do to help make deployments easier and show that we are their partners with their best interests in mind.”

One simple add-on service integrators can provide or help facilitate is a vulnerability assessment or penetration test. “At Synnex, we have been running free vulnerability assessments for our resellers and their customers for up to five public IPs,” Nesbit said. “The results have been bittersweet: after running several hundred scans, we’ve found only two percent of the networks were secure and had no vulnerabilities. This has opened the eyes of many resellers, and they are now actively incorporating vulnerability assessments into their projects.”

AV and IT must collaborate for successful IP network convergence

The harsh reality is that no system can be considered beyond breach. This admission can be the first line of defense, followed by detailed action plans to have ready for not if, but when. Making false promises to clients about their systems’ security is a dangerous path down an inevitably precarious journey. A good dose of common sense, practical precautions, and informed processes will go a long way in the battle for cybersecurity.

What Questions Do You Need to Ask Your Vendors?

AV manufacturers have an important role in promoting network security. For many of them, it’s just as new and different a skill to employ as it is for integrators. Communication among all parties is necessary to ensure AV systems are capable of supporting clients’ information security needs. The process requires due diligence, and integrators and consultants need to hold their vendors accountable.

The experts interviewed for this article provided a wide range of questions for integrators and consultants with which to query their vendors.

• Does your product support secure communications?
• Are logins encrypted?
• Can the devices be updated?
• Can the underlying OS and applications be updated?
• Do firmware updates break any preexisting security setups?
• What data is being tracked, polled, or accessed by your products? Is that information being stored somewhere? If so, is it on premises, or are you storing it on your own servers or cloud service? Who has access to that information at your company? How are you using that data?
• Are you encrypting any data being transported?
• Can credential names and passwords be changed on the devices?
• If accessing via a web browser, are you masking the device’s IP address?
• Are you using two-factor authentication for access to admin accounts?
• How do you build security into your devices?
• How long after a vulnerability is discovered in the underlying OS or applications will the vendor have a patch available?
• If a security researcher discovers a vulnerability on your product, is there a way for them to report it to you? Is that process documented?
• How do you disclose and communicate known security exploits with your devices?
• Do you publish a security and privacy policy?

Choose Wisely

In many cases, there are a lot of manufacturers to choose products from, and that selection involves new requirements with network security considerations. “AV professionals should evaluate vendors for patching frequency, and understand the lead times and testing required before critical security patches can be deployed on AV networks. They’ll want to be sure that they are carefully managing applications that can be deployed on those networks that could cause network traffic and interference with time sensitive AV data.

With technology evolving at breakneck speed, integrators should always consider what’s next when selecting products. “Looking toward the future, which really is here now, the integration of home automation and voice-activated systems with AV systems means that there are increasingly major privacy issues with these systems, as they may capture personal information or conversations that need to be protected,” said Max Everett, managing director of Fortalice Solutions and former White House chief information officer. “So AV professionals need to be sure to ask vendors about the privacy implications of these systems. Who is protecting customer data? This is especially important as data is now more likely to be passed to cloud services.”