We spend a lot of time in this industry talking about AV network security as a technology challenge. Those conversations are worth having. But they tend to skip over a prior question that may be harder to answer: in a typical enterprise, who is actually responsible for the security of the AV network?

In most organizations, the honest answer is nobody. Not clearly.

That gap has been building for years and is now showing up consistently in conversations with enterprise AV customers across verticals. IT security teams are discovering AV networks, and the AV teams are not ready for the conversation.

AV infrastructure has historically been reported to facilities management, operations, or a dedicated AV team sitting outside the IT org chart. IT teams manage corporate networking and security, but rarely have visibility into AV devices. They don't speak Dante or NDI. They haven't configured an AV-over-IP VLAN. The CISO owns security policy but typically inherits whatever boundaries the IT and facilities teams have already drawn. Often, those boundaries leave AV on the outside.

The result is a structural issue. The AV team doesn't have a security mandate, and often doesn’t have the knowledge either. The IT team doesn't have AV expertise. The security team doesn't have jurisdiction. As a result, nobody is responsible for the security of the AV network.

This was always going to happen. The AV industry spent the last decade converging with IT and adopting IP infrastructure. AVIXA's Audiovisual Network Professional certification, which is designed equally for AV professionals who need to prove networking competency and IT professionals who need to prove AV integration capability, is a direct acknowledgment that neither side currently speaks the other's language fluently enough. In higher education, AV infrastructure has already moved under IT governance in many institutions. In larger enterprises, the trajectory is the same, with hybrid models becoming common: AV teams retain operational responsibility while IT owns the security layer.

The AV/IT Convergence Conversation

The convergence conversation has mostly glossed over the fact that converging the technology doesn't automatically converge the governance. You can put AV on the same IP network as corporate IT and still have two entirely separate organizations with separate reporting lines, separate accountability frameworks, and no shared understanding of what a secure AV environment actually looks like. The infrastructure merged. The ownership question didn't.

The scenarios we're hearing reflect this. A facilities manager at a large enterprise receives a request from the CISO's office for a device inventory of the AV network. They want a list of everything connected, every open port, every remote access point. The AV team has never been asked this question and doesn't have a clean answer. A healthcare organization's AV infrastructure supporting telemedicine systems gets flagged during a compliance audit because it sits inside the network boundary but outside the security monitoring scope. A multi-site retailer's IT team flags that digital signage endpoints are pulling content across the same network that carries payment data. Nobody made a decision to do that. It just happened because decisions were made without security as a criterion.

At a customer event in Dallas recently, I asked a room of AV end-customers how many were experiencing increased pressure from IT or security leadership around their AV networks. Nearly every hand went up. A contact described a situation his team was navigating: their AV infrastructure runs on one vendor's managed switches, their corporate IT runs on another, and their IT security team demanded visibility into the AV network. If they couldn’t get that, they’d use their IT infrastructure for both IT and AV moving forward. However, replacing AV infrastructure solves the visibility problem on IT's terms but causes performance problems that the AV team is left to clean up.

My background is in network security, not AV, which means I came to this problem without the assumptions baked into either side. What I've found is that the governance gap is more entrenched in AV than in almost any other part of enterprise IT. The technology convergence is largely done. The governance convergence is not.

The organizations handling this well share one characteristic. They established clear ownership and decided deliberately what a security-compliant AV environment looks like without sacrificing the performance that the original investment was made to deliver. That means getting ahead of the ownership question before it becomes someone else's mandate to answer.

The launch of IPMX certification marks a significant step for AV over IP. With 11 manufacturers and 48 certified products at introduction, the ecosystem already spans a broad set of real-world applications, including encoders, decoders, gateways, cameras, displays, and processing platforms. These products represent the early foundation of an interoperable environment designed to work across vendors and system types. A second certification event later this year is already in planning, with increased participation expected as more manufacturers bring products forward.

IPMX now exists as a multi-vendor ecosystem with certified products available for deployment. Early system designs and evaluations are beginning to take shape around IPMX as a foundation for open, standards-based media transport. Attention is shifting toward how these systems integrate, how they are secured, and how they are managed across increasingly complex environments.

As IPMX moves into early deployment, the conversation naturally shifts from specification to system behavior. Attention centers on how devices interact across vendors, how systems are configured and controlled, and how they fit within existing IT environments. These considerations will shape how IPMX is implemented in practice and how it is evaluated by integrators and end users.

At this stage, three areas carry particular weight: trust and security, interoperability through certification, and the continued expansion of capabilities to support a wider range of applications. Each of these areas reflects ongoing work across the IPMX community and contributes to how the ecosystem develops over time.

Trust and Security

Historically, security in AV-over-IP environments has been inconsistent across vendors and system types. Manufacturers have implemented their own approaches to access control, encryption, and device trust, with limited interoperability between systems. Even widely used mechanisms such as HDCP are applied unevenly, particularly when extended beyond point-to-point connections. This has made it difficult to build multi-vendor systems that handle protected content and secure control in a predictable way.

IPMX is introducing a baseline approach to security designed for interoperability across vendors and environments. These capabilities are defined as part of the standard and can be implemented alongside vendor-specific security measures. The goal is to establish consistent methods for identity, access control, and encryption that align with modern IT practices while remaining flexible enough to support a wide range of deployments and innovations.

At the media layer, Privacy Encryption Protocol (PEP) defines a common method for encrypting content between devices from different manufacturers. This enables protected media to move through a multi-vendor system, representing the first interoperable approach to content encryption in Pro AV-over-IP environments.

At the control and management layer, work aligned with Advanced Media Workflow Association (AMWA) IS-10 defines a framework for authentication and authorization based on widely adopted IT technologies. These include TLS-secured communication, OAuth 2.0 authorization flows, and JSON Web Tokens (JWTs) for conveying identity and permissions. This model allows systems to verify device identity, control access to APIs, and manage permissions in a consistent and scalable way.

The IPMX registry contributes to this foundation by serving as a source of truth for certified devices, including what was tested and when. This allows operators and system designers to confirm that a device has been validated against IPMX requirements and to understand its expected behavior within a deployment. Planned enhancements will expand the registry to include additional product and transport-related specifications, along with tools for manufacturers to manage and update their own information. Over time, this will provide a more complete view of device capabilities and interoperability across the ecosystem.

Certification and Interoperability

Certification is central to how IPMX achieves interoperability within deployed systems. The first official IPMX Product Testing and Certification Event, held in January 2026 at the European Broadcasting Union (EBU) in Geneva, established the initial baseline for validating device behavior across vendors. This event marked the transition from pre-release interoperability work into a formal certification process, where products were formally tested against defined transport, timing, and system requirements.

The next certification event will build on that foundation with a focus on refining the process itself. Efforts are underway to improve efficiency, reduce the time required for testing, and identify gaps that impact real-world interoperability. These refinements are informed directly by the behavior observed during testing and early product deployment, ensuring that the certification process continues to reflect practical system requirements.

Longer term, the certification program is evolving to support broader participation and scale. This includes expanding testing to additional facilities worldwide and developing workflows that allow manufacturers to complete certification without requiring physical presence at a single event. These changes aim to make certification a more accessible process while maintaining consistent validation across the ecosystem.

Future Profiles and Capabilities

IPMX Profiles and Capabilities define how devices express supported formats and behaviors in a consistent, testable way. Today, this includes uncompressed video and audio, along with JPEG-XS for visually lossless compression, providing a foundation that spans high-quality production and bandwidth-constrained environments.

Several additional capabilities are approaching certification. HKEP and HDCP handling, along with PEP, have progressed through multi-vendor testing with demonstrated interoperability across implementations. Formal certification of these capabilities is planned for later this year, bringing consistent handling of protected content and encrypted media transport into certified workflows.

USB extension is advancing along a similar path, with support for USB 2.0 transport and integration with PEP to enable encrypted USB traffic. This extends IPMX into KVM and other USB-enabled workflows, with certification expected to follow closely behind as the supporting capabilities are finalized.

HEVC and AVC profiles are also nearing completion. These compression formats are a focus area due to strong industry interest and their role in enabling efficient transport across a broader range of existing product implementations.

IPMX continues to evolve through this model, with new capabilities introduced, tested, and certified in a structured way that maintains interoperability across the ecosystem.

For the AV industry, IPMX is moving from concept to something that can be specified, deployed, and evaluated in real projects. The certified product base established in Geneva gives system designers a concrete starting point for multi-vendor AV over IP work, while the parallel progress on security, USB extension, and compression profiles addresses the practical questions that come up once these systems reach the rack. In the coming year the conversation will be less about whether IPMX is ready and more about how it performs in the field, how integrators build around it, and how quickly the certified ecosystem expands to cover the full range of Pro AV applications.

Last year, the Pro AV voice was pretty clear: the industry was moving away from isolated hardware decisions and toward networked, software-aware, IT-aligned systems.

AV Technology’s “25 AV/IT Thought Leaders on the State of Networked AV” captured that mood well. The core themes were open standards, interoperability, cloud management, AI-assisted operations, phased modernization, and the continued convergence of AV and IT. In short, the market was saying: stop thinking in boxes, start thinking in platforms.

As we move through 2026, those core themes have hardened. It feels like operating in reality. AVIXA’s 2026 trends coverage points to security, AV/IT/AI convergence, interoperability, sustainability, and immersive displays as defining themes for the year. Futuresource adds an important nuance from ISE 2026: the market is shifting away from hype and moves toward governance, lifecycle management, compliance, and practical deployment.

On Standards

The biggest change in the last six months is that modern networked AV is no longer just about moving signals over IP. It is, noticeably, much more about running AV as an IT-governed service. In the 2025 AV Technology article, thought leaders emphasized open standards such as IPMX and SMPTE ST 2110, cloud-native management, predictive maintenance, and the need to avoid vendor lock-in. In 2026, that has become more concrete. AIMS used ISE 2026 to formally launch IPMX as a certifiable standard, a meaningful step for buyers who want interoperable, standards-led deployments rather than proprietary ecosystems alone.

On Security

Security has also moved up the stack. Last year, security was often discussed as one of many requirements. In 2026, it is closer to a board-level procurement filter. AVIXA explicitly names enhanced security as a top trend, and ISE 2026 launched its first CyberSecurity Summit, reflecting how connected AV systems are now being judged against enterprise expectations for risk, compliance, and resilience. That is a noticeable step-change from last year’s more general “AV meets IT” narrative.

On AI

AI, in a surprise to nobody, has changed, too. Early last year, the conversation at ISE was still full of promise: virtual assistants, smart troubleshooting, predictive maintenance, better user experiences. In 2026, the market tone seems a lot more selective. The industry is moving past broad AI claims and focusing on where AI genuinely improves workflow efficiency, reduces costs, or improves governance.

That is a healthier, more realistic phase for Pro AV. AI is still central, but now the question is less “do you have AI?” and more “where does it save labor, reduce downtime, or improve decision-making"? We see the same happening in broadcast.

On Growth

Another notable shift is commercial discipline. The Pro AV market continues to grow, but the tone is more cautious than celebratory. Growth remains real, but we are navigating a world shaped by tariffs, geopolitics, higher financing costs, and supply-chain uncertainty.

That makes AV in 2026 not just a technology story. It is more of a supply chain story, with the caveat that I am biased, as I work for a switch manufacturer. Memory costs are one example. NAND and DRAM prices have been rising, driven in part by demand for AI infrastructure. The direction of travel is clear: AI is soaking up capacity and keeping upward pressure on memory and storage costs. For Pro AV vendors and integrators, this feeds into endpoint pricing, media processing platforms, compute-heavy collaboration systems, and digital signage players.

On Geopolitics

Geopolitics is also more visible in 2026 than it was at the end of 2025. Trade policy on semiconductors, alongside broader regional instability, is shaping sourcing strategy and risk planning. Disruptions to critical inputs, including materials used in semiconductor manufacturing, add another layer of uncertainty that can ripple through AV supply chains and pricing. Should we worry about this? No, because just like the weather, you can’t influence it. But you should be aware of the repercussions.

On Mergers and Acquisitions

M&A is another signal that the industry is reorganizing around scale, services, and recurring value. Recent acquisitions of manufacturers and regional channel players highlight a clear strategic pattern: buyers want broader, or even global, service footprints, deeper managed services capability, and stronger alignment with workplace transformation and enterprise IT.

So, What is The State of Pro AV in 2026?

It is more networked and more governed. More software-defined, but also more compliance-driven. More AI-aware, but less willing to pay for AI hype. Slightly more open to standards, especially where interoperability reduces lifecycle risk. And it’s more conscious that external forces, from semiconductor pricing to geopolitics, can shape project economics just as much as product innovation can.

Barco and Extreme have partnered on a technology integration that enables organizations to securely share critical control room information across global locations. By combining Barco CTRL—an innovative all-in-one KVM-over-IP solution—with Extreme Fabric, customers gain a secure, scalable, and resilient platform for managing critical operations anywhere.

The Connected Control Room principle addresses genuine operational challenges across multiple industries. Consider offshore drilling operations, where control rooms on remote rigs must maintain constant communication with corporate refinery facilities onshore. The partnership's solution creates a secure bridge between these environments, enabling seamless information flows despite challenging maritime conditions.

Empowering remote and resilient operations: The integration enables experts to work seamlessly from anywhere, including branch offices, home, or remote sites, through SD-WAN hardware, giving them full access to control room environments. It also serves as a disaster recovery solution: if fiber connections between control rooms and Emergency Operations Centers fail, Extreme SD-WAN provides backup connectivity to keep operations running.

The power behind the platform: Barco CTRL combines sophistication with simplicity. This scalable software platform streamlines complex control room workflows through intuitive design and a robust security architecture built on Zero Trust and Shift Left principles that is ideal for the most security-sensitive environments.

Setup is guided and straightforward, while a unified interface ensures consistent functionality across video walls and operator desks. The platform scales easily by adding encoders and decoders, and redundancy options protect critical components to maximize uptime. Together with Extreme’s distributed connectivity, this ensures continuity without compromise.

Transforming critical operations: The Connected Control Room represents a fundamental shift in how organizations run distributed operations. By removing the limits of geography, companies can deploy their best people and resources wherever they’re needed, while maintaining the highest levels of security and reliability.

As industries move toward more distributed and resilient models, Barco and Extreme provide the foundation for the next generation of control rooms: secure, reliable, and intuitive connectivity for mission-critical operations.

It was bound to happen at some point. So it was, at the end of a successful trip to CEDIA 2024, I lost my tablet.

There is no one to blame but me. I broke my routine. Plane lands, PA system goes "ding," I stand up, grab my carry-on, and fill it with all the earthly possessions I took out during the flight. Pretty simple, right?

[Editorial: Some Old Things Can Be New Again]

Well, this time I did things a little differently. I had finished up Season 7 of Bosch on my earlier flight (highly recommended series, by the way) and my battery level was low. The connection time between my flights was a bit tight, so I didn't have time to juice up my tablet in the terminal. So, I pulled out a cable and used the port at the seat in my aircraft to charge my tablet during the flight. That's something I almost never do.

After the flight, I was very focused on remembering to tuck away that USB cable. It's an easy thing to forget. (Yes, irony. I get it.) As fate would have it, there was no one in the middle seat of my row, so I put my tablet there while I worked on properly stowing my Jabra headset and USB cable. Gray tablet, gray seat—and when I got home, I was seeing red.

It would have been nice if the person in the window seat had alerted me, but perhaps they didn't see it, either—or perhaps they wanted my outdated tablet for themselves. Maybe another passenger or a member of the cleaning crew took advantage of easy plunder. It could have even been thrown away by mistake and is now trying to live its best life in a landfill surrounded by half-full barf bags and Biscoff wrappers.

[Cybersecurity and Pro AV]

Attempting to talk to a human being about my lost item was an exercise in futility, but I was directed to an online portal for reporting a lost item. I was assured the airline would search its inventory of lost items. Two days later, I got a pleasant "sucks to be you" email acknowledging my lost item was still lost, and while they would keep looking, the clock was ticking. Let's just say my recovery expectations are set nice and low.

If there is a silver lining to this frustrating blunder, at least it happened at the end of my trip. And if there's another silver lining, I found a new and improved version of my tablet on sale the next day—at a lower price than what I paid more than two years ago. Considering I don't use a top-shelf tablet and its lifespan is maybe five years (based on software support), I got off easy.

It's not always that way with Pro AV equipment. Many of the tools of our trade are small—but far more expensive than my old tablet and far more important for day-to-day operations. Whether motivations are opportunistic, nefarious, or even accidental, it's not hard for someone to walk away with something as sophisticated as a PTZ camera or as innocuous as your favorite flashlight.

[On Your Business: Technology Isn't Enough]

Visually verify those conference room systems regularly. Use those Kensington slots. Embrace those sign-out sheets. Remember who's wearing the wireless mics before they leave. Your equipment inventory is your livelihood, so make sure keeping track of it is a priority.

We sat down with Paulo Francisco, vice president of engineering at Evertz AV to answer a few pressing questions about IPMX. 

What is driving the need for IPMX and what does IPMX hope to achieve?

In industries where interoperability between products from different vendors is crucial, we often see a specific technological evolution. When the industry needs a novel solution to tackle a new problem or solve an old problem differently, a small set of industrious R&D companies will take up the challenge. In time, other product manufacturers see an opportunity and do the same. Over time the existence and viability of a new market segment is proven, and end users are empowered with a multitude of solutions to choose from. Although this may be advantageous, in terms of a large product selection, it also causes confusion for end users left parsing through marketing claims as to which technology is better for their application. Eventually, there comes a need for a form of technology consolidation or a common way to ideally solve the original problem and enable multiple product manufacturers to interoperate. That is, in essence, the purpose of an open standard like IPMX. It defines one way, with open standards and specifications, to implement AV-over-IP enabling multi-vendor interoperability and empowering end users with the ability to pick best-in-class vendors with the assurance that all products will co-exist and interoperate.

Will IPMX products assure interoperability?

Well, not so fast. Like all standards, the IPMX standard is a collection of documents in a prioritized order starting with the essential components and adding, over time, less common capabilities. The published and draft TR10-XY documents can be viewed here. When several companies and engineering teams review a set of standards, it is inevitable to have different interpretations of the written text. To that end, an essential component of any standard is to define a set of testing criteria that a product must pass to be certified and claim “compliance”. This testing can come in different forms ranging from less formal “plug fests” or hosted testing events, such as what was done for 2110 via JTNM testing, to more formal and controlled independent testing by accredited labs.

At present, the testing and certification requirements for IPMX is a work in progress. All manufacturers are working together in good faith to maximize this interoperability, but it cannot be guaranteed, nor can a manufacturer claim to have a guaranteed compliant solution.

Will IPMX interoperate with SMPTE-2110?

Throughout the definition of the IPMX open standard, every effort was made to leverage SMPTE ST 2110 and AMWA NMOS, where possible, and create extensions or relax requirements where needed. As such, there is a great deal of interoperable overlap between IPMX and SMPTE-2110, but they are obviously two separate standards with IPMX driven by the need to address the unique and wide requirements of the pro AV market and expected ease of use.

The simplest way to think of this is to start with stream compatibility. A 2110 sender, supporting only uncompressed 2110-20 video, clearly can’t send a stream to an IPMX receiver running at 1G and expecting 2110-22 compressed video. May seem silly to even describe this example but such scenarios can quickly get lost in the excitement of IPMX being stated as interoperable with 2110.

Even in a best-case scenario, such as two 2110-20 uncompressed systems, one needs to consider that pro-AV sources may be content protected and require HDCP support to be processed and sent over IP to a destination which must also support HDCP. This precludes successfully sending such a protected source to a broadcast 2110 SDI destination.

For the cases where IPMX and 2110 domains “meet,” such as a standard 1080p or 4k60 uncompressed video stream, with the usual well defined 48k audio stream, then one is almost assured interoperability provided that there is agreement on timing. IPMX does not mandate the use of PTP synchronization while SMPTE-2110 expects synchronous sources locked to PTP timing. This essentially means that a 2110 source can almost always be received by an IPMX receiver while an IPMX sender would need to ideally support PTP and run in synchronous mode to maximize interoperability. This is noteworthy because IPMX targets many applications and scope of devices, and one option is for a sender to run asynchronously and use RTCP sender reports to dynamically define the sent stream.

So IPMX and SMPTE-2110 interoperability requires a thoughtful system architecture, that takes into consideration all needed workflows, and multi-vendor IPMX interoperability requires patience and time for certification guidelines to be published, vendors to get certified and, almost for certain, a few IPMX software updates along the way.

Some say that PTP is not mandatory while others say that it is. Which is it?

So, in the end, everyone was correct. PTP is not mandatory for an IPMX pro-AV deployment thus allowing for simple low-cost topologies with consumer asynchronous free-running sources. For high-end broadcast systems, where PTP is always present, IPMX is mandated to use it.

The IPMX standard defines what essentially amounts to three possible modes of operation with the goal of providing maximum flexibility for both product and deployment complexity.

The first thing to consider is the media source itself. Classic broadcast SDI sources have a genlock capability and generate a media stream that is locked and synchronized to a housemaster clock. In the world of IP, this master clock signal is PTP. Classic pro AV sources, on the other hand, are often HDMI or Display Port and have no synchronization capability. These are asynchronous sources running under their own locally generated timing which is conveyed as part of the physical interface signaling.

IPMX cleverly allows for:

a: Synchronous sources locked to PTP
b: Asynchronous sources with PTP offset information conveyed over IP
c: Asynchronous sources with sender gateway timing offset information conveyed over IP

Scenario (a) follows a standard SMPTE ST 2110 approach. Scenario (b) uses an IPMX-specific technique called “RTCP Sender Reports” to convey timing offset, between the asynchronous source and PTP, to facilitate re-alignment at the receiving gateway. Scenario (c) is the same as (b) except that every gateway uses its own locally generated clock and although this still facilitates source switching recovery, it does not allow for frame re-alignment as there is no synchronization between the various sender gateways themselves.

So, in all cases, timing information is conveyed to a gateway receiver but the benefit varies. Scenario (a) delivers broadcast quality seamless switching and is compatible with 2110 receivers. Scenarios (b) and (c) rely on the receiver understanding RTCP Sender Reports, which is unique to IPMX, and although scenario (b) allows for frame re-alignment, scenario (c) does not.

The IPMX standard mandates that IPMX sender gateways leverage and synch to PTP if it is available. This means that only scenarios (a) and (b) are relevant in a hybrid IPMX / 2110 deployment. More sophisticated 2110 receivers will still be able to derive timing and show video for scenario (b) but interoperability and optimized performance is not guaranteed.

It's the early evening on a beautiful day in Las Vegas. While strolling along the Strip, you're captivated by a truly giant direct-view LED display broadcasting a stunning visual message. As you briefly lose yourself in the spectacle of the presentation, the video abruptly cuts out, jarringly replaced with some truly reprehensible content, which clearly wasn't intended by whomever owns that sign. As the offensive presentation persists, the crowd on the street begins to take notice, and soon, it makes the news in a way that is unique to what can happen when security breaches meet AV-over-IP.

As a bystander, this incident might leave you unnerved. But now, imagine you were the IT security manager responsible for that facility. Your concern would shift dramatically from embarrassment and shock to a rush of technical questions and security reviews. You'd immediately need to consider several key questions, including:

Server Security: Was there a breach in the server where the media files are stored? Could someone have tampered with the files?

Control Layer Breach: Was the system that controls what content gets displayed compromised?

Content Layer Vulnerability: Was there a failure in securing the content layer, allowing someone to intercept and replace the stream?

In real-time, IP media systems like those used in high-value, large-scale displays, the common security concerns found in any IT environment carry additional, unique aspects. That is why interoperable security is a central feature of IPMX, on multiple levels.

Within NMOS, and thanks to IS-10 and BCP-003-X, interoperable security specifications provide methods for securing communications within the control plane of IPMX systems. NMOS security leverages well-established protocols like OAuth 2.0, TLS, and JWT, ensuring robust authentication, authorization, and encryption across IP-based media networks.

However, when it comes to the transport layer, IPMX relies on a new protocol called the Privacy Encryption Protocol, or PEP. This protocol enables secure multicast, unicast and bi-directional distribution of digital media and data flows, protecting against unauthorized access or manipulation. It employs AES Counter Mode encryption to ensure that media streams are encrypted and securely managed and includes comprehensive key management capabilities, supporting both static and dynamic key assignments to accommodate varying security needs of media transmissions. Through these features, PEP ensures that IPMX has the security, scalability, and interoperability features required in professional AV environments. In this article, we’ll explore some of PEP’s details, highlighting its major features and some of the unique aspects as we go along.

Privacy Encryption Protocol (PEP)

When the VSF set out to address the need for privacy encryption within the IPMX framework, the first decision was whether to go with an existing protocol like SRTP or to create something new. Opting for the latter, the IPMX activity group created PEP. This decision was primarily driven by the necessity for PEP to coexist with IPMX’s HDCP feature. Unlike SRTP, which encrypts parts of the data that HDCP doesn’t touch, PEP aligns neatly with the strict requirements of the documents that define HDCP 2.3 and how it is used over IP networks, avoiding unnecessary complications and bloated hardware design when both features are present within the same device. PEP also simplifies things significantly by avoiding the key management dance required by SRTP for multicast streams, instead choosing a method that is aligned with how an NMOS-controlled IPMX setup works. In this way and others, PEP is a perfectly tailored fit for the IPMX ecosystem.

Understanding Key Management in PEP

PEP brings benefits beyond efficiency with its robust key management features. To appreciate how PEP enhances security within IPMX, it may be helpful to review some basics about encryption keys. PEP uses pre-shared keys (PSKs) that are securely installed in advance on both the sender and receiver devices. These keys are then used to derive session-specific keys using various features of PEP, including a key derivation function (KDF), which creates a privacy key from the PSK and other parameters that make up the PEP protocol. This suite of features simplifies key management while maintaining security and flexibility across various use cases. Let’s walk through a few scenarios so that we can see how PEP keeps things easy to manage, flexible and secure.

First, let’s consider a corporate campus equipped with IPMX AV-over-IP technology. In the huddle rooms, devices might be configured with a key for general employee access. In the boardroom, however, the setup could include not only the general access key but also additional keys for content that requires higher security levels. Key IDs allow these devices to identify and select the appropriate key based on the content's required access level, ensuring that each stream is accessible only to those with the correct authorization. This system enables seamless distribution of diverse content across various devices, each tailored to different security needs.

Next, let’s look at key reuse and long-running streams. While hacking to illicitly decrypt content in real-time is extremely difficult, it's possible to capture and store the encrypted stream for decryption at a later time. If the same key is used over an extended period, such as months or years, and if that key is eventually cracked through brute force or another method, the entire stream's security is compromised. This could expose past, present, and future content until the key is changed. PEP addresses this vulnerability by using parameters randomly generated whenever the device restarts, as well as with key versioning. With key versioning, keys can be periodically updated without interrupting the stream, significantly reducing the risk of compromise and enhancing the security of long-running streams.

Just as using the same key for long-running flows can pose a security risk, employing a single key across different streams or sub-streams can also compromise security. PEP addresses this concern by requiring the use of distinct encryption parameters for each stream and sub-stream, maintaining maximum security even if multiple streams and sub-streams share the same encryption key. PEP also allows for the customization of security parameters for each stream, providing distinct encryption keys and encryption parameters for each stream. As a result, while some streams might require robust encryption due to sensitive content, others can operate with lighter security measures, optimizing overall system efficiency without sacrificing safety.

Now imagine two people in the system need to communicate without the possibility that anyone else could decrypt their session, not even a system administrator. To stop other devices that have the same PSK from receiving the content, a special key could be created just for them, although that still doesn’t stop an administrator from eavesdropping. Thankfully, PEP offers a more streamlined solution using Elliptic Curve Diffie-Hellman (ECDH). ECDH is a key agreement protocol that allows each participant to generate a public-private key pair and share their public keys with one another. Without transferring any private keys, both parties can then derive a shared secret based on their own private keys and the other’s public key. In PEP, this shared secret is combined with a pre-shared key in the key derivation function to generate a unique session key that encrypts their communication. This ensures that no one else, not even the system administrator, can access their conversation, simplifying the key management process while significantly enhancing the privacy and security of their communications.

Conclusion

PEP is a significant advancement for AV-over-IP security by offering an efficient and comprehensive method for managing access to data and content streams within the IPMX framework. By integrating robust features like key versioning, sub-streams, and optional support for ECDH, PEP not only simplifies the encryption landscape but also ensures that each stream is uniquely secured against potential breaches, all while coexisting seamlessly with HDCP and NMOS control protocols.

PEP's thoughtful integration into IPMX provides stakeholders—from system integrators to end users—with a reliable, scalable, open, interoperable, and highly secure AV-over-IP solution. Together, IPMX and PEP will play an important role in the evolution of the industry, ensuring that as the complexity and scale of AV deployments grow, security is always part of the picture.

Author’s note: A special thank you to Alain Bouchard, the lead author of TR-10, for not only crafting the specification but also for his assistance with this article.

Everyone in the AV community knows HDCP, the high-bandwidth digital content protection protocol. Love it or loathe it, HDCP is now part of everyday AV working lives. It was designed by Intel and adopted by Hollywood as the method by which valued content is secured, primarily to prevent piracy in a real-time environment. In other words, whilst content is being played, as opposed to whilst moving a file. The focus is on the transmission channel, providing protection as content passes from source to sink.

HDCP addresses this with three interlinked systems: Authentication, Encryption, Key Revocation

Simply put, HDCP only allows content to move to endpoints that are legitimate and authenticated HDCP receivers and then protects the content whilst in motion. This uses a system of encryption keys that work together to secure the link.

The original scope perceived the signal distribution as being point-to-point, circuit-switched connections—via connectors like DVI, HDMI, DisplayPort, and across cables and matrices.

AV is a Moving Landscape

All security systems are challenges for people who try to break them. Each of the three HDCP sub-systems, authentication, encryption, and revocation were targets. Devices that stripped the protection soon became available. A ‘master key’ that could not be revoked found its way into circulation. And thus, despite legal action, the original HDCP system was defeated—but nonetheless was still required for compliance.

The advent of increasing resolutions and the emergence of AV-over-IP raised both an additional challenge and an additional opportunity. UHD was the new value to be protected and there would now be a much larger number of endpoints involved, (i.e., multicast). Further, due to being transmitted via a network, the connections were now packet-switched, not a continuous connection.

HDCP evolved from v1 to v2, but this was not a backward-compatible step because the content transmission architecture was different. Several parameters were left as optional alternatives. One of the aspects that was not ‘tied down’ for this multi-endpoint network environment was how to transfer HDCP messages between source and sinks. The consequence is that for direct connections (e.g., HDMI to HDMI—from player to display) all brands do it the same way, but for network connections, it tends to be ‘same brand at both ends.’

Enter IPMX. IPMX is, by design, moving high-quality video—right up to and including uncompressed UHD60—across networks. But the ‘same brand at both ends’ is not compatible with its interoperability ethos. So, a consistent method for exchanging keys needed to be defined.

Most people think that the protection provided by encryption is reinforced by not revealing the method used. The ‘magic’ of modern encryption methods is that they know exactly how it is protected—even telling them how it is done, such as putting it in an open standard—and yet they still can’t decrypt it with the resources they have. The HDCP protocol itself addresses exactly that. Their method of using the keys is rigorous. To bring inter-brand HDCP to the IPMX multicast environment, the Video Services Forum (VSF) has made a significant contribution in proposing the HDCP Key Exchange Protocol (HKEP). This is a standardized approach, or ‘method in common’ of transferring the already defined messages between IPMX transmitters and receivers. Additionally, it defines the ‘closing down’ process for a single HDCP session in that same multicast network environment.

The methodology that VSF has recommended in TR-10-5, for use in IPMX, is compatible with everything that has been agreed to so far yet is lightweight enough to be incorporated into devices that may be varied, and probably limited in processing power (to keep their cost down). The extension to the already established HDCP specs covers the exchange of HDCP control messages over TCP/IP among NMOS-based transmitters and receivers. You can think of it as a preamble to the existing HDCP protocol v2.3 which prescribes how to transfer parameters, left optional by DCP, should be used in the IPMX environment.

In an interview with Systems Contractor News (SCN), Jessica McDowell, senior vice president of Business Development & Security Strategy at TD SYNNEX, said phishing remains a top threat, as cybercriminals use deceptive emails, messages, and calls to trick people into providing sensitive information or downloading malicious software. She notes that artificial intelligence can be a double-sided coin, offering enhanced security on one side and the potential for mishandling data on the other. TD SYNNEX provides industry training via its Enablement Portal TDS University and the Security Practice Builder.

It seems the security landscape changes daily. What are you seeing as the latest threats?

Phishing continues to remain the top threat, as cybercriminals use deceptive emails, messages, and calls to trick people into providing sensitive information or downloading malicious software.

Increasingly, we’re seeing these attacks involve extorting money from victims, most commonly through ransomware. Those attacks are continually evolving in sophistication as hackers find new ways around restrictions. They’re even using generative AI and machine learning to efficiently spin off new, more enhanced, and effective vectors of attack.

Long-term and highly sophisticated cyberattacks by nation-state threat actors remain a concern for government agencies and large corporations. And while finance and healthcare continue to be the top targeted industries, we’re now seeing the largest number of attacks on manufacturing as cybercriminals focus attention on Operational Technology (OT).

OT accounted for nearly 40 percent of cyber-attacks in 2022. While IT attacks steal data, OT attacks focus on industrial control systems. Criminals seek to make a physical impact as well as a monetary one.

From an integrator’s perspective, everything is now on the network, so everything must be protected. Networked audio and video also add potential threats through holes created in the network. So, it’s critically important to consider security in every application and in every vertical market.

How does AI factor into the security landscape? And where does AV fit in?

AI is a two-sided coin.

On the one hand, we believe AI could potentially enhance security solutions through automation. AI can help identify and respond to threats in real time, potentially detecting and preventing attacks more effectively. AI can do this by learning to recognize normal usage and network interactions and behaviors by analyzing vast amounts of data very quickly and accurately. The resulting reduction in false positives and negatives in threat detection means better detection of abnormal activities—both from the inside and from skilled outside attackers.

And AI can help to automate some security tasks, which reduces the workload on security teams, allowing them to focus on more complex security issues. This is particularly important to resource-constrained organizations.

Conversely, AI also presents security risks. With AI comes the need for access to large amounts of data, which raises concerns about data privacy and the potential for mishandling personal information. In addition, AI-fueled attacks have the potential to be highly sophisticated, leading to challenges in defending against them.

We’re seeing a rapid expansion of AI within the audiovisual segment. For example, AI-powered video analytics can be used for security and surveillance by analyzing camera feeds for potential threats or incidents. AI algorithms can also detect and flag inappropriate AV content, which helps platforms maintain content standards and safety.

From a physical security standpoint, an increasing number of features are getting built into cameras that allow users to monitor and track a variety of details.

With growing concern about AV devices creating security risks on the network, it’s important for AV teams to coordinate with network administrators closely, explain the purpose of the hardware being put on the network, and work with them to configure the network in a secure but functional way.

A good first step for AV integrators is to change the default passwords on devices and not use the same one on multiple devices. Good password management is a great start to any security best practice.

How is TD SYNNEX continuing to enable AV partners who want to expand their security practice?

TD SYNNEX provides industry training via our Enablement Portal TDS University and through our Security Practice Builder. Our product business management teams serve as thought leaders throughout various technology segments by creating content and delivering information about the industry and specifically how our vendors and value-added services address industry trends.

Our Next UP team is focused on new and emerging vendors. In addition to enabling our partners to sell specific vendor offerings, they offer line card consultations to help our partners identify where they may have a gap in their offerings or where they may need to beef up their offerings in a particular segment.

In fact, our services team has been incredible at helping augment our partners' capabilities in terms of delivery and support. We continue to offer complimentary Security Assessments, and more partners than ever are taking advantage of those. In addition, we recently launched a self-service portal with five assessments for partners to take with or on behalf of their customers, providing a guided plan based on the report findings.

In summary, our value to our partners is simplified into four key pillars: We help you learn, we solve for the technology ecosystem's complexity, we deliver technology solutions with versatility, and we help you evolve.

For more information, you can reach us at cybersolv@tdsynnex.com.

Legato Security, headquartered in Salt Lake City, Utah, is a security services firm that provides comprehensive cybersecurity expertise and managed security services. From political campaigns and local governments to small businesses and Fortune 100 companies—Legato Security extends and augments clients’ existing security operations to help them tailor an effective security approach and achieve a responsible security posture. 

Jesse Stoltz, Security Operations Center (SOC) manager at Legato Security, and his team of experienced security analysts ensure 24/7/365 monitoring for their clients. The SOC acts as a hub for overseeing client data and network traffic, and if needed, for actively mitigating security events.

The team at Legato recently came to the realization that their company’s legacy AV system was no longer meeting their high standards for performance. “Prior to implementing a Haivision video wall solution, the Legato SOC utilized a series of independent monitors mounted to the wall,” explained Stoltz. “It was frustratingly slow and tedious to display the needed information. We were less able to work on behalf of our customers quickly and actively.”

Customized and Comprehensive

Plagued by visual monitoring delays and the lack of transparency needed to address threats to client data, Legato Security could not risk the negative impact on their delivery of services and client satisfaction. Recognizing the critical need for an advanced visual collaboration solution, Legato Security chose Haivision to customize and install a video wall system that would fit their SOC needs, scale as the company grows, and enhance information security monitoring for their clients.

“We communicated the dimensions of our space and worked with Haivision in an iterative process to understand and evaluate our needs until we collectively landed on a tailored solution,” said Tom Boyden, co-founder, and CEO of Legato Security.

The focal point of the SOC is a Haivision six-by-two video wall which includes 12 55-inch LCD monitors powered by CineNet video wall management software, an Alpha FX Edge processor, CineLink Encoder, and two CineAgent Servers. This combination of software and hardware is fully integrated with Legato Security’s Security Information and Event Management (SIEM) platforms and web/URL sources to facilitate the capture, selection, control, and display of content. The result is situational awareness, real-time monitoring, and analysis of remote and on-premises security events for Legato Security clients.

Stoltz emphasized that the video wall has been an absolute game-changer for alleviating clients’ cybersecurity concerns. “The Haivision MCS video wall system addressed challenges around immediacy and transparency of critical data and events,” he said. “Simply put, we are better equipped to deliver a better service to our customers.”

With regards to situational awareness in particular, Stoltz elaborated that the complete Haivision solution allows them to respond to emerging security threats at a moment’s notice. “We can receive and act on notifications much more quickly,” said Stoltz. “This has accelerated our delivery of security products and services.”

Ease of Use and Advanced Control

Haivision solutions have helped Legato Security standardize its security operations and foster collaboration by collating a variety of data inputs for visualization on a single technology platform. With CineNet’s intuitive browser-based user interface, SOC analysts value the ability to quickly customize the display in response to dynamic security needs and setup alerts for tracking of security events. The ability of off-site analysts to monitor network activity is another key feature of the Haivision installation, according to Stoltz: “This allows remote workers to manipulate what is visible on the video, which enables collaboration between local and offsite teams.”

[Haivision Awarded DoDIN Approval for Video Distribution Solutions Portfolio]

Ease of use also eliminates the need for programming or extensive training and creates a smooth onboarding process for new analysts. As an added benefit, GuardianCare is available 24/7 to provide expert support for their system if the need arises.

After his overwhelmingly positive experience installing Haivision displays in the Legato SOC, Stoltz had a few words of wisdom for those looking to install video wall solutions: “Peers in our sector should look for video wall technologies with robust, approachable management software. It's important the tools do not get in the way of the product itself,” he said. “Quality of hardware is also very important. Given the large format of many of these solutions, it's important that brightness, resolution, and viewing angle do not negatively impact the solution's effectiveness."

Hacked. Data breach. Cyberattack. These words are getting more and more airtime. A look at recent headlines reveals corporations, K-12 schools, universities, healthcare organizations, and financial and government entities have all been victim of expensive cyberattacks. In fact, they’re at an all-time high, according to IBM’s recently released Cost of a Data Breach Report. While the financial industry has received the lion’s share of attacks, the report found that healthcare data breaches are among the costliest, with a record-breaking price tag of $10.1 million, on average. Many breaches are shown to be a result of employee error, complicated technologies, and third-party vendor solutions that are bridged into the network. Now with the hybrid workplace and bring-your-own-device (BYOD) becoming the norm, it’s more likely the doorway will be left open to more prevalent attacks. The best defense is prioritization on specifying ultra-secure meeting room technology, namely wireless presentation systems. 

For any organization looking to replace cables, the best wireless presentation systems (WPS) must be able to support existing and future technology, as well as make the displays in the room work harder. Features like touch-back control, and the ability to split a screen to share information from two presenters or more at the same time are critical to effective collaboration. With new 4K displays and the increased use of video – good video and high resolution are also a must. But for any company that has been subject to ransomware, data breaches, or handles sensitive information, the security functions of a system are often the most important part of evaluating any WPS.  

Let’s look closer at what’s happening in the hybrid workplace, meeting rooms, and why security is such an important consideration. Typically, employees aren’t coming into the office for the same work they can complete at home. Rather, their focus is to meet and collaborate with colleagues and conduct presentations in-person. That means that their time in the office is limited and they’re tasked with squeezing out every minute of productivity during that time. They can’t waste it setting up or troubleshooting complicated presentation technology. They need to be able to present from their device as quickly as possible without cables. That’s why more and more companies are adopting WPS.

A WPS has the benefit of allowing a user to present from their own device without plugging an HDMI cable into their device. There are many WPS options on the market, and not distinguishing between them is where security can fall apart. The most common systems use a custom software application to mirror the screen on a laptop or computer through the organization’s network. This hardware-free option has advantages in cost, but it can impact performance and security—more on that later. A second approach, and one that’s most popular for larger businesses and government organizations, is to use a hardware-based button that connects to a device and users simply tap it to present to the screen. These systems, however, have critically different architectures and interfaces when it comes to security.

While the app/network approach seems simple and clean since there are no buttons or hardware, it can create unanticipated security risks for IT. First, because these devices are connected to the network, hackers can exploit any vulnerabilities in the device either from in the room or via the internet. In fact, many of these systems have already been shown to have vulnerabilities that allow a hacker to gain control of the network—or shut it down. To protect against this, companies have become reliant upon and overly confident in expensive subscription programs to keep the system constantly upgraded. While these types of systems may be cheaper to buy, they can be much more expensive to own. For example, most app/network systems recommend setting up a VLAN to isolate the network from the main network to keep it more secure. Let's look closer at that.

VLANs can only provide basic protection and can be vulnerable to hackers looking to penetrate the system. For example, Rice University will not allow a wireless presentation to use the network due to this risk, especially after U.S. retailer Target had to notify over 40 million customers that their customer data was stolen in 2013. That attack was done by a hacker who accessed an air conditioning controller that was connected to one of the Target networks and then used it to bridge into the most sensitive data servers of the company. 

Now let’s look at wireless presentation systems that use a combination of USB buttons and network connectivity to enable screen mirroring. USB ports have significant security risks. In fact, the Department of Defense restricts the use of USB—a ban that was issued after a virus was found to be spreading through military networks by copying itself from one removable drive to another. Here’s why: If a hacker can access the receiver connected to the display, then there is a risk that someone can access the presentation outside the room. The presenter has no idea that their presentation is being shared outside the room. It has been advised that customers using these systems secure access to the receiver to keep this from happening, which can be expensive and impractical—especially if it is mounted on a projector or the back of a display.

The third approach for button-based systems is using the HDMI port to connect to a device. Besides not having to connect to a network or load an app to make it work, it has the built-in advantages of high security. It’s certified against known threats that exploit both the network and USB button architectures. While it does require hardware, a button-based approach delivers the simplicity and speed required for meetings in the age of hybrid. Plus, it’s a main reason these types of buttons are used in meeting rooms at Toyota, the father of maximizing production efficiency.

 But if the Target attack and subsequent high-profile attacks that have occurred since have taught organizations anything it’s that security demands a multi-layered approach. In addition to utilizing an HDMI technology, there are a few other technologies now available in these systems that lead the way in delivering the ultimate in security protection—protection that is strong enough to meet the rigorous requirements of financial and bank institutions. 

Wi-Fi 6 and WPA3 Authentication

Wi-Fi is a common and comfortable word, thanks to the proliferation of the wireless technology in our homes and mobile devices. However, there’s a marked difference between the authentication and encryption found in our domain, which primarily uses WPA2 and is not appropriate for high-security network deployments, and Wi-Fi 6. Higher security Wi-Fi network deployments must be configured for WPA3 authentication, which—along with AES 128-bit security encryption — ensures that any intellectual property remains private and safe from tampering or unintended disclosure—guaranteeing that presentations are absolutely secure.

Common Criteria (CC), Evaluation Assurance Level EAL6 Augmented (EAL6+) Standards CC refers to the EAL, which has seven levels graded from EAL1 to EAL7. For any device connected to a network – such as a networked printer all the way up to a Cisco network switch, companies certify the security level of these products using the global EAL standard. For example, an enterprise-class router or firewall might have an EAL 4 level, while a bank card payment device might have a higher rating of an EAL 5 or 6. For wireless presentation systems, a solution tested and certified under the rigorous EAL6+ standard is the highest protection possible outside of being military grade. Why is common criteria EAL6+ certification critical? The data breaches the majority of companies have suffered from in the past years came from unsecured wireless devices like printers, scanners, mobile phones, or laptops connected to their Wi-Fi network since cyber-attacks aim at these devices as the weakest points to get “way in” to a business network. In addition to WPA3, financial services generally use EAL6 augmented (or EAL6+) security compliance in their payment systems to justify the additional costs spent when handling high value protected assets that are transmitted in high-risk situations.

Federal Information Processing Standards (FIPS)

State and federal government agencies are most likely familiar with FIPS. It’s the standard for handling sensitive data, such ensuring a private taxpayer return doesn’t get leaked onto the Internet as well as other sensitive private and government communications. Financial and healthcare institutions and other regulated industries are often required to use this standard. Currently there’s only one WPS on the market to meet the stringent requirements of this encryption standard, the BenQ WDC30, which ensures the wireless transmission is encrypted with an encryption key generated by the unit and a new encryption key is created every time it is used. It is the only wireless presentation system that can be used with sensitive government information. As such, it keeps millions of government employees from having to share a cable when presenting in sensitive environments.

As organizations look to deliver greater workplace agility that ensures a plug-and-play experience when presenting and collaborating, security is key. Until now, security and ease of use were mutually exclusive benefits in the presentation technology marketplace. Meeting rooms and other collaboration areas have traditionally relied upon expensive matrix systems that were complicated to use and severely limited. Users were chained to a cable that had to be passed among other presenters.

The WPS category introduced freedom, but some models do so at price. Systems reliant upon software, apps, and network logins allow users to present from anywhere, but they’re needlessly complicated. IT and tech staff have to download and configure software/app and users have to log into the network. As this article has shown, those are complicated and risky steps today. USB-based hardware buttons don’t completely eliminate those risks. The best bet as companies look to safeguard data, their network, and user devices in the era of the hybrid workplace is a hardware-based HDMI WPS built from the ground up to be certified in critical security standards in operation for organizations handling sensitive data. At the same time, users need to be equipped with tools that aid in meeting efficacy. Those tools include a tap-to-present meeting experience with no software or logins required, quad split screen to allow up to four attendees to share to the screen simultaneously, touch back control that grants presenters the ability to control the connected device directly from a compatible interactive screen, and clear, stable transmission of audio and video. Users don’t waste any time collaborating, and data and the network are completely safe.  

The BYOD and BYOM of 2019 will seem tame by comparison to The Big Return of 2022 as workers enjoy the benefits of working between the office and home office. They will bring their favorite devices, software, and platforms, exponentially increasing vulnerabilities to the enterprise network. And while working from home and sharing files, who is defending the castle?

The #WFH VPN Vulnerability 

For more than two decades, companies have relied on the encrypted connection a virtual private network (VPN) provides to enable employees to access corporate email and safely transmit data over the internet while traveling or working from remote locations. 

Matthew Rakes, managing director, Information Technology and Cybersecurity at Unity Aluminum, suggested that depending on how well the IT department has defined route policies, a VPN might not mitigate all risks. “One of the problems you can run into is if someone has a compromised local network or device and they attach via VPN to the enterprise, then that device now has traffic flowing into your network.”

There's a degree of Big Brother that has been assumed acceptable when employees are on corporate property. “This is where I think we need to train users' expectations to understand better that when you're using a particular application, that we are going to be Big Brother, even if we are going to be hands-off of the rest of your network,” Rakes said. 

The term “Big Brother” often conjures the idea that evidence is being gathered against the user. “I often think that the best view of this is quite the contrary,” Rakes added. “We should actually be seen more as defenders of the castle.” A strong, secure IT department should first and foremost aim to protect employees and the company data equally. “We should seek to not only protect data, but we should seek to help protect and defend the people that represent your company, and the best way to do that is providing them with secure tools that help them to know that they don't find themselves in a compromising situation,” he said. 

Security-first

Rakes is taking a long-term approach to adding technologies as employees return. “We are looking at what solutions and technologies we can acquire now that alleviate our immediate pain, but will allow us to better transition into higher efficiency once people come back to the office.” Post-COVID, Unity Aluminum will continue to have a flexible remote work policy. “But we recognize that one of many benefits of being in the office is collaboration,” Rakes said. “We are leveraging tools from Mersive, Cisco, and Microsoft, which helped us to bridge the gap.”

Whenever possible, Rakes deploys a cloud-first model for IT and AV solutions. “That takes a lot of onus off IT departments when you don't have to worry about security patches because Microsoft Azure is already handling that for you,” he said. 

Unity leverages a suite of Cisco technologies for its wired and wireless on-premise networks. “We use Cisco identity services and Cisco capabilities that work as an umbrella that can identify known pieces of hardware and dynamically insert them on the correct VLAN, regardless of what network they initially connect to,” Rakes said. Moving toward a “zero trust” security model, “with Cisco Duo Security, you're able to achieve a dynamic resilience, so when someone connects to a network, enters their credentials to authenticate to that network, then it says, ‘Oh hey, I know who this person is. I can dynamically put them on the correct VLAN,’” he said. 

When choosing AV solutions, Rakes looks to companies with a security-first approach. “One of the things we like about Mersive is the way they handle the communication from the Solstice client back to a pod is different than many other AV solutions,” Rakes said. “Mersive went from the approach first of, ‘How do we secure the transmission of that traffic?’ and then, ‘Now let’s make sure that the audio-video protocols work.’” 

[ How to Think About Network Security After COVID ]

Verify and Enforce

When it comes to security and BYOD/BYOM devices, the primary challenge is the verification and enforcement of an organization’s security policy. “Organizationally owned assets can be standardized and remotely managed. This allows the organization to enforce security best practices on network devices,” AV/IT industry consulting solutions architect of AVCoIP, Paul Zielie, said. “BYOx devices could bring in malware, which once inside the organizations, can do serious damage.”

The best way to mitigate risk is to require a security package run on the BYOD hardware. “If employees want to use these devices on the organization’s network, require that the security package needs to be running while connected,” Zielie said. “You then use a port level security protocol like 802.1x, which checks that it is running before data is passed.” 

[ Shure on the Importance of Networked Audio Security ]

Next-Gen Firewall

"It is not realistic to add protection services to every device that may be added to a collaboration space, but there are still several steps AV/IT managers can take to enable safe, secure, and seamless collaboration and productivity," said Nathan Holmes, senior manager of Training at Snap One. Segregating remote connectable collaboration areas from the rest of the corporate network, employing a Next-Gen firewall solution with unified threat protection services, and ensuring that your IT team is up to date on cybersecurity threats and employs best IT practices are some easy first steps to securing your corporate networks while supporting a remote workforce.

AV/IT managers are accustomed to creating an Information Security (InfoSEC) plan for their respective businesses, but these plans are typically based upon most, if not all, employees residing within the controlled corporate network hardware area. With the move toward BYOD and BYOM, the InfoSEC plan should include strategies that allow employees to join the collaboration space through devices that may not employ protection services. To mitigate security threats for all devices, we recommend the following course of action: The development and execution of a comprehensive security policy that includes unified threat protection, provides each employee with the networking equipment they need to work remotely, ensures devices include active information security services, actively manages and updates these services, provides secure VPN access for each employee, and ensures there is a specific policy and procedure for connecting non-company-owned equipment to the corporate network."

Robust Encryption

"A modern collaboration platform should include a suite of security features to guard against a variety of risk scenarios," said Brian Cockrell, Intel Unite Solution Product Owner and Co-founder at Intel. Robust encryption should be in place. The Intel Unite solution uses end-to-end TLS (transport layer security) encryption between a participant’s device and a room hub, whose connection to the server—on-prem or cloud—is also end-to-end TLS encrypted. In addition to encryption, there should be protections against unauthorized access to sessions, such as a rotating PIN, and the ability for participants to lock a meeting, as well as expel unwanted participants. Other security features include keystroke lockout, protected guest access, and the ability to authorize use by individual. Finally, content shouldn’t leave the organization’s network and use data should be anonymous. These protections should be embedded in software that is easy to learn and use. Otherwise, disuse becomes the primary protection. Good for security, but bad for collaboration. The Intel Unite solution is a good example of a collaboration platform that includes all these features. 

When a new collaboration platform is combined with peripherals and plugins—especially in BYOD, BYOM, and remote environments—the result is a staggering number and variety of potential risks—some foreseeable, others novel. Do the research and choose tech wisely. Has the software been vetted by other users? Where is data going and is it sufficiently protected? What data is collected and where is it stored? Once the risks and benefits are fully understood, weigh those against a risk profile and choose the tools that provide the best balance."

Felix Media Solutions is expanding its service offerings to include security systems design and integration after acquiring regional security dealer Big Star Security, LLC. FMS hired Big Star's owner, Scott Zuniga, to serve as the FMS director of Security Sales.

[Bluewater and Felix Media Solutions Form Strategic Alliance]

Zuniga has 17 years of experience in the industry, having spent most of his career focused on designing and implementing service programs that provide superior peace-of-mind to clients with security needs.

"The last few years of Big Star's business was focused on helping our clients migrate their legacy alarm, access control and camera systems to the cloud," Zuniga said. "Joining forces with [FMS] allows us to continue this mission on a larger scale."

[Bazaarvoice Taps Felix Media Solutions and LG for Austin HQ]

FMS CEO Lionel Felix said he noticed that adding security design and installation services helps FMS in its goal to provide simple, stress-free and easy-to-use solutions for clients from inception to integration.

"I think with the rise in crime lately--especially locally--there has been an urgent demand for service," Felix said. "Security systems integration is a natural outgrowth of our existing technical knowledge and a great way for us to do what we do best--help our clients."

[How to Avoid Security Breaches Within the IT Department (EdTech Magazine)]

Citing his deep client base and expertise, Felix said Zuniga was "the perfect choice" to help FMS develop its roster of security services.  "He's been a hands-on team member, helping to grow the skill base of our work force and challenging us to grow in new directions from a system-design perspective. I can't wait to see where this takes us."

Bogen Communications LLC is issuing Nyquist C4000 Version 4.0 software. Nyquist C4000 Version 4.0 is designed to meet the unique communication needs of today's commercial environments. The Nyquist C4000 is a software-centric, state-of-the-art, IP-based paging and intercom solution that leverages the latest software technologies and third-party integrations to address the fast-evolving safety and security challenges facing today's businesses.

[Bogen Software Update Strengthens Campus Communications]

Bogen Communications' Nyquist C4000 Version 4.0 emphasizes ease of use via its highly intuitive user interface. It empowers mission critical performance through automated server failover capabilities and powerful scripted automated action sequences, known as Routines. Nyquist C4000 Version 4.0 delivers simplified system configuration and a highly automated upgrade process to enable customers to quickly deploy important new features. Once upgraded to Version 4.0, users have access to over 50 new features and enhancements, including a variety of new Routine actions. Additionally, Routine actions can now be conditionally executed based on numerous real-time variables for even more targeted responses to critical events as they unfold. Other important new Version 4.0 features include a 72-hour backup tone/event schedule embedded in all the system's audio appliances that automatically activates upon a server or network failure to ensure notifications are seamlessly distributed until the server or network can be restored.

[New Bogen Paging and Intercom System Enhances K-12 Campus Communications]

Nyquist C4000 Version 4.0 supports various National Weather Service alert-driven visual and audible notifications. The notifications are based specifically on a weather event's location and severity, allowing commercial environments, such as retail, healthcare, hospitality, and retail markets, to distribute shelter-in-place or other emergency instructions in a timely manner. In addition to the traditional audible alerts, the automated notifications are also delivered through the Nyquist system's administrative phone display, desktop web UI and combo clock/message displays which can be located throughout a facility or business complex.

To improve the view in four security rooms, Daktronics has partnered with Qatar-based ELV systems integrator Techno Q to deliver 1.2-millimeter, narrow pixel pitch (NPP) LED video walls to Hamad Medical Center (HMC) in Doha, Qatar. Three of the four installations are complete and provide closed caption television (CCTV) feeds to officials at Cuban Hospital, Heart Hospital and Al Wakrah locations. The Al Khor display will be installed in the coming months.

[Daktronics Delivers a Mammoth Video Experience to U. of Maryland]

The displays installed in HMC locations at Al Khor, Heart Hospital and Al Wakrah each measure 1.37 meters high by 5.49 meters wide and the display at Cuban Hospital will measure 1.37 meters high by 6.71 meters wide. These displays all feature a tight 1.2-millimeter pixel spacing to provide high-resolution imagery to the CCTV feeds allowing for improved details and image quality in those critical locations.

[Daktronics Expands Narrow-Pixel-Pitch Line]

"Direct LED in control rooms is new technology to HMC," said HMC design project manager Mubarak Solkar. "We trust Daktronics to be our partner for this new technology and deliver the right solution to us."

"HMC is keen to furnish its facilities with the latest and greatest technologies to offer its visitors and users ease of operation and a second-to-none experience," added Daktronics regional manager Ahmad Dahmash.

[Daktronics Digital Banners Highlight Messaging at Emaar’s Marina Mall]

Daktronics NPP product line features pixel spacings ranging from 2.5-millimeters down to 0.7-millimeters to meet the specific needs of audiovisual customers in multiple applications.

Bogen Communications is issuing Nyquist E7000 Version 7.0 software update. This latest update is designed to meet the unique communication needs of today's school campus environments. The Nyquist E7000 is a software-centric, state-of-the-art, IP-based paging and intercom solution that leverages the latest software technologies and third-party integrations to address the fast-evolving safety and security challenges facing today's educational environments.

The E7000 Version 7.0 software release emphasizes ease of use via its highly intuitive user interface, and mission critical performance through automated server failover capabilities and powerful scripted automated action sequences known as Routines. Simplified system configuration, coupled with a highly automated upgrade process, enables customers to quickly deploy important new features. Once upgraded to Version 7.0, users have access to over 50 new features and enhancements, including new Routine actions that can be conditionally executed based on numerous real-time variables for even more targeted responses to critical events as they unfold. The new release also features a 72-hour backup bell schedule embedded in all the system's audio appliances that automatically activates upon a server or network failure to ensure class change schedule continuity until the server or network can be restored.

With this latest Nyquist E7000 update, users can also create various National Weather Service alert-driven visual and audible campus notifications based specifically on a weather event's location and severity, allowing schools to issue shelter-in-place or other emergency instructions in a timely manner.  In addition to the usual audible alerts, these automated notifications are also delivered through the Nyquist system's administrative phone display, desktop web UI and combo clock/message displays, which can be located throughout the school campus.

Nice, a global manufacturer of smart home, security, and home & building automation solutions, has acquired Nortek Security & Control from Melrose Industries.

With the acquisition of Nortek's brands—including 2GIG, ELAN, Linear, MightyMule, Proficient, SpeakerCraft, Gefen, Xantech, Panamax, Furman, numera and IntelliVision—Nice expands its portfolio to provide a suite of integrated solutions for residential, commercial, industrial, and government customers, from consumer DIY to custom and professionally installed specialized products and high-security applications.

The move substantially strengthens Nice's presence in the North American market and doubles its R&D capacity to  accelerate innovation and expansion of platform-based integrated solutions, considerably enlarging the Nice customer base globally in a fast-growing market. The partners of Nice and Nortek Security & Control will experience an enhancement of their current relationships through a larger organization with an even stronger commitment to the channel. Nice is a global company with a regional presence to focus on its local markets and partners. 

Founded in the 1960s as Linear Corp., Nortek Security & Control has a vast portfolio of products, over 200 patents, and 12 leading brands across security, access control, AV, power management, smart home, AI and personal health.

In March, Nortek Security & Control released the 2GIG EDGE Security and Automation Panel with AI and edge analytics, winning several industry awards. The new panel for the pro-install security market delivers secure face recognition touchless disarm. Developed with edge processing, the panel's engineering ensures homeowner's biometric data stays secure by saving it only on the panel.

In North America, the portfolio of brands under Nice includes Abode, Nice and HySecurity in addition to well-established gate, door, sunshade, and smart security offerings. The acquisition instantly increases reach and scales growth through existing Nice distribution channels and with those of Nortek Security & Control. Partners of each organization will experience streamlined communication from one brand to the next and, in time, will have access to a broader portfolio of integrated solutions.

Business will be conducted as usual throughout 2022. The North American organization will immediately begin collaborating with the Nortek Security & Control team on blending portfolios and operations to emerge fully integrated in 2023.

The transaction, valued at $285 million, is the largest investment to date by Nice.

There are a lot of discussions and even more headlines about the lack of network security. Tales range from high-profile network breaches to private data from a number of organizations being accessed by unauthorized parties. IT has long protected the network and the data on it, but now, these security breaches can come from unexpected places, including devices such as wireless presentation systems.

Wireless presentation systems (WPS) are on the rise, giving integrators fresh opportunities across verticals and within an entirely new product category. They offer an affordable alternative to installing expensive matrix switches and pulling HDMI cables. With a WPS, multiple presenters share the screen during a meeting through a simple transmitter device connected to their notebook or software and at a much lower cost than traditional HDMI cables. The big caveat is that they can pose network concerns. If the WPS isn’t secure, it opens the door to possible network attacks and what was a device designed to save customers money becomes an expensive battle that goes beyond technology.

In the last year, cybersecurity and privacy company F-Secure and the well-respected technology blog Tenable found several network vulnerabilities in wireless presentation systems available from recognized brands. These vulnerabilities posed two specific threats: one, that systems connected to the network can be used to break into an organization’s network; and two, any content being shared over the system can be recorded and stolen.

There are a lot of discussions and even more headlines about the lack of network security. Tales range from high-profile network breaches to private data from a number of organizations being accessed by unauthorized parties. IT has long protected the network and the data on it, but now, these security breaches can come from unexpected places, including devices such as wireless presentation systems.

Wireless presentation systems (WPS) are on the rise, giving integrators fresh opportunities across verticals and within an entirely new product category. They offer an affordable alternative to installing expensive matrix switches and pulling HDMI cables. With a WPS, multiple presenters share the screen during a meeting through a simple transmitter device connected to their notebook or software and at a much lower cost than traditional HDMI cables. The big caveat is that they can pose network concerns. If the WPS isn’t secure, it opens the door to possible network attacks and what was a device designed to save customers money becomes an expensive battle that goes beyond technology.

In the last year, cybersecurity and privacy company F-Secure and the well-respected technology blog Tenable found several network vulnerabilities in wireless presentation systems available from recognized brands. These vulnerabilities posed two specific threats: one, that systems connected to the network can be used to break into an organization’s network; and two, any content being shared over the system can be recorded and stolen.

As an AV designer, programmer, or installer, not only is it important to understand how these presentation solutions work and the differences between them, but also how each model mitigates these risks. Avoiding these risks and an having a security-first mentality is especially important for shepherding customers through a new era of technological innovation and cybersecurity, as well as for ensuring repeat business down the road.

MITIGATING RISK

With the prevalence of security risks, it’s important to select models that follow industry best practices. When evaluating these systems, make sure it’s a model that follows these primary ones:

1: Minimize the Organization’s Attack Profile

For any organization, their network and the content on their network are among their greatest assets. Minimizing the attack profile basically means minimizing network exposure and safeguarding these assets. Look for a model that can operate independently of the network and without proprietary software or apps. Both of these will reduce the risk of a hacker gaining access to the organization’s network via a wireless HDMI receiver or through cloned software apps. A system that doesn’t require network access also reduces the time and resources to set up network protections for users and visitors who need to log into the network to use the system. Without network access, visitors aren’t able to access the organization’s VLAN. Although VLANs are able to segment traffic, they aren’t always effective protection against hackers. New tools make it possible for hackers to crawl and hop from one VLAN to another and gain access to sensitive content. If the system requires software or an app, security becomes even more questionable. For example, if the WPS or company is sold to another company, that company could rewrite the software and open up the potential to suck out data. That’s an extreme scenario but it illustrates how granting network access can become problematic later.

2: Limit Access to Content

The saying “content is king,” should be “encrypted content is king.” Imagine that an organization with a disgruntled employee or someone working from a flexible workspace is streaming content wirelessly over a network. Maybe they’re not viewing the next iPhone concept, but it could be a video stream of salary reviews, for example. Although that content is intended for only the eyes in that room, without 100-percent encryption 128-bit AES at the receiver, anyone can access it. Some systems, for example, enable a remote view of the collaboration session by entering the receiver’s IP address into a web browser, while others do not encrypt or field access to content sent over the network at all. Some inexpensive wireless HDMI casting systems even send content over the web and back to the receiver. These require up to 20 or 30 ports to be open at a time and make even the least security-conscious managers concerned. To prevent unauthorized people from getting on the network and being able to gain access demands a 100-percent encrypted system. Encryption guarantees that another person can’t see that stream and find out information that could be used inappropriately.

3: Minimize Data Interaction

The USB port is a powerful and convenient Swiss Army knife of a port. It can connect almost anything to a computer. From the user perspective, they make life simple. However, from a security perspective, they can be quite a nightmare because they can exchange data and introduce any number of loopholes for hackers. Many wireless presentation systems use USB ports, but integrators should be sensitive of how USB is being utilized. Choose a system that can enable an TCP/IP option for the USB to be turned off and to only provide power. For high-security environments, such as military, police, or other sensitive defense contractors that typically blacklist all devices requiring access to a USB ports, ensure that the system also is capable of being powered independently of USB.

Minimizing data interaction also means eliminating devices that require proprietary software and apps. Many popular wireless presentation systems depend on a proprietary app that is loaded onto the computer that captures all the information, manipulates it, then sends it to the receiver. Savvy security managers know that any software where they don’t have the actual code can represent a risk to secure information. Software apps can be cloned, or injected with malware in hostile environments, and many apps can share to more than one screen on the network—either deliberately or accidentally—creating a potential security risk when presenting. Choose an option that doesn’t use an app or where no extra data is required to be loaded onto a presenter’s notebook before they can use the system.

>> Focus on Network Security

• Improving AV Device Security on Converged IP Networks • How can system designers and integrators collaborate more effectively with tech managers to improve AV device security on converged IP networks?
• Keeping Sensitive Information Secure on the Network • As more networked devices join the AV space, many network administrators in all industries are expressing concerns about the efficiency of the network.
• Staying Secure in the New Hybrid Work World • As AV/IT managers adapt to the new hybrid workforce model, more personalized approaches to technology are needed, opening new potential network security vulnerabilities.

The Right Support

While the network and content are the greatest direct threats, there’s a third seemingly innocuous security risk: manufacturer support. Today, in a lot of manufacturing industries—not just technology—products are often purchased and white-labeled by other companies. It’s a common occurrence, but a shampoo or bathroom vanity sold under another name doesn’t pose the same risk or custom service woes as an AV device. When problems arise, integrators need the support and expertise, which they may only find for a limited timeframe or with a hefty subscription fee. For a company that has invested in 50 wireless presentation systems for their conference rooms, they could be stuck with a solution that isn’t quite what was sold to them. Technology professionals must do their homework to find a manufacturer that has invested in the engineering of their wireless presentation system from the ground up to prevent security risks and with a proven track record of support. 

The wireless presentation system market continues to explode with incredible opportunity: analysts Futuresource Consulting reported 10 times the growth of other AV devices and 40 percent growth year over year. While security threats will never go away, AV designers and integrators have to be smart about what solutions they choose that can manage these risks. Customers will expect that that their tech team will have their best network welfare at heart. By ensuring that all the boxes have been checked—that the wireless presentation system encrypts every frame, minimizes network exposure, and operates independent of software and apps—they’re helping customers make sound security decisions that can last a lifetime.

Bob Wudeck serves as Senior Director, Business Development for BenQ, a global leader in visual display solutions.

Of the many cultural buzzwords coined during the COVID-19 pandemic, the term “Zoom bombing” may be the most memorable.

Early in 2020, celebrities like Kristen Bell and Conan O’Brien popularized the practice of surprising online videoconference attendees by joining their meetings unannounced. As charming as that may be, not all Zoom bombings are innocuous. Bad actors use these virtual break-ins to secretly snoop on corporations and organizations. They may also share inappropriate images and videos meant to disrupt the proceedings.

Like other computer and network hackers, Zoom bombers rely on human fallibility and poor judgment to gain access. The most common entrance is right through the front door, either because the host neglected to use safety protocols such as requiring a password, or because they failed to sequester attendees in a queue so they could be verified before being allowed into the meeting. Sophisticated hackers can mimic profiles of actual guests, making it harder for the host to kick them out of the call.

“The best way is to have at least one step of authorization, but two steps can ensure that there isn’t a breach or someone who is not authorized in the meeting,” said Steve Greenblatt, CTS, president and founder of Control Concepts. “A lot of these steps take time and effort, make conferences less convenient, or make more work for people, but they will result in a more secure outcome and allow hosts to avoid those types of embarrassments, as well as potential security breaches.”

Zoom bombing is just the tip of the proverbial iceberg of new network security threats. As workers return to office environments after a year or more of working at home, they may bring devices with them that have not been vetted by IT staff. Tim Albright, chief marketing officer at Conference Technologies Inc. (CTI) and CEO of AVNation, said that the potential for third-party peripherals to compromise an organization’s network is the single biggest security issue integrators are dealing with heading into late 2021 and 2022.

[ Staying Secure in the New Hybrid Work World ] 

“Up until a year and a half ago, the IT department was also the procurement department for everything that was on the network,” said Albright. “Now, a year and a half later, folks have gotten equipment on their own to make their work-from-home [situations] work. That stuff is going to start finding its way to the office and onto the office network.”

Organizations have ways of locating unapproved peripherals, such as by deploying tools that continually scan the network for known and unknown MAC addresses and can alert IT or the AV integrator when an unauthorized device is connected. But those measures are purely reactive. Greenblatt says proactive maintenance can prevent security threats from infiltrating the network in the first place.

[ The Integration Guide to Secure AV ] 

“Vulnerabilities are happening all the time, and computers these days are getting updates and security patches to address new threats,” he said. “It’s very possible that becomes part of a maintenance agreement. In my business, for example, we have somebody who looks at our website every month to make sure we don’t have vulnerabilities, that we’re updating our software to make sure that somebody can’t come in and hack our website. If we apply that idea to an AV system, you look at the devices or the setup [and determine if] they need to be better secured. What was in place when the system was turned over may not be as effective now because of new vulnerabilities or issues that may have been identified since then.”

In addition to regular audits and multifactor authentication, integrators can set up a VLAN, or virtual local area network, to help protect against security threats. VLANs allow partitioning of a server so that different classes of connected devices can be grouped together. “The challenge with that, though, is that there are still some ports that need to be open” to allow certain local devices to be able to access the internet, Greenblatt said. “There are also AV over IP devices that need to be able to traverse the network to be effective, so while VLAN can be very powerful, there’s always going to be a need to open up access outside of it.”

Simple practices many people ignore, like changing devices’ default usernames and passwords, can also help prevent network hacks. It’s relatively easy for a hacker to match default IDs to Wi-Fi routers and other connected devices, and AV systems are particularly susceptible to distributed denial of service (DDoS) attacks in which vast numbers of devices across many networks are manipulated simultaneously.

These “zombie attacks” can be large in scale, and costly to fix. A well-known example in 2016 took down Netflix and many other networks along the East Coast. In the mix of devices exploited in the attack, Albright noticed something troubling to the AV business: zombie web cameras and network-compromised speakers. “When I saw that, it’s like, yes, the AV industry certainly has an issue with this,” he said. “We have an issue because our devices are getting put on the network more frequently, which means we need to make sure we’re doing the simple things, such as changing the login and password. You’ve got folks who can take control of these because they’re public-facing, on the network, on the internet.”

On the horizon, the increasing numbers of internet-connected smart devices create more network vulnerability. “You’re talking about yet another entry point that could be a vulnerability, and if it happens that an [Amazon] Echo or another type of voice interface is listening, then [hackers] can know what you’re talking about and be able to track what is happening,” added Greenblatt. “As we try to make systems intelligent, we have to be concerned about them having access to information that gives them more power than we know.”

As networks grow more complex and devices more sophisticated, vigilance in the fundamentals of network security will be more important than ever.

“The rule of thumb I think everybody goes with is that you’re only as strong as your weakest link,” concluded Greenblatt. “We do a good job of having technicians [pull wiring], and we have experts who know how to set up products and make sure an image looks good and the room sounds good, but we should also have an IT or cybersecurity specialist who can give our clients confidence because they know they’ve brought somebody in who’s going to protect them.”

Click here to read more stories from the August 2021 issue of SCN.

Focus on Network Security

Improving AV Device Security on Converged IP Networks • How can system designers and integrators collaborate more effectively with tech managers to improve AV device security on converged IP networks?

Keeping Sensitive Information Secure on the Network • As more networked devices join the AV space, many network administrators in all industries are expressing concerns about the efficiency of the network.

Staying Secure in the New Hybrid Work World • As AV/IT managers adapt to the new hybrid workforce model, more personalized approaches to technology are needed, opening up new potential network security vulnerabilities.

Good AV/IT tech managers know that addressing security concerns makes for a stronger relationship between their organization and the security team—and for smoother deployments. But it doesn’t stop there: when you’re well-versed in IT security concepts, you’re well-positioned to gain access to higher-level business discussions. One route to developing security expertise is through certification, and AV Technology recently explored what’s involved in earning what’s widely considered the gold standard of security certs: the Certified Information Systems Security Professional, or CISSP. 

Azeem Khan is senior consultant of application development (AV) at CIBC, a financial institution headquartered in Toronto. With a background in both security and AV, he is currently pursuing a CISSP—a logical step forward, he said. He believes that security knowledge is necessary in today’s networked environment, and holding a CISSP proves that one is capable of implementing and managing enterprise-level information security. “Nowadays at the enterprise level when we are putting all of these AV devices [on the network], it is our responsibility as AV specialists to be able to point out the security risks that we see when devices are communicating with each other,” he said. “As an AV specialist, you know how people interact with those devices, so you have more perspective on the security risk that comes from those devices versus people who are not from the AV domain.” 

[Staying Secure in the New Hybrid Workforce Model]

(ISC)2, headquartered in Clearwater, FL, is the professional organization that offers the CISSP. The CISSP comprises eight domains: security and risk management; asset security; security architecture and engineering; communication and network security; identity and access management (IAM); security assessment and testing; security operations; and software development security. (ISC)2 requires that candidates have five years of paid work experience in two of the eight domains (there are exceptions; visit the (ISC)2 website and download the CISSP Certification Exam Outline for more details).

“In IT and AV—and I consider AV part of IT—cybersecurity crosses many fields,” said Toni Hahn, content development manager at (ISC)2. “I feel everyone should know something about cybersecurity.” The CISSP, she explained, covers cybersecurity concepts, and the exam requires candidates to apply them. “AV could fit into almost every domain on the CISSP.”

The CISSP is not, however, for everyone. Damon Drake, content developer at (ISC)2, noted that sometimes organizations require job candidates to hold CISSPs for positions that don’t really require them. “We’ve seen [situations] where a company will have an entry-level position with entry-level pay requiring a CISSP certification,” he said. “It’s really a managerial-level cert. You’ve got to be able to look at risk management: how does that affect your physical security? How do you do access control—both physical and cyber?” There’s a lot to it, and as Drake puts it: “it’s not a beginner cert.”

Drake and Hahn should know. Both are ex-military (he was in the Air Force, she’s former Navy). While in the military, both worked in AV and IT. Once out, both worked in security engineering and management in mission-critical environments. Both failed the CISSP twice.

Drake recounts that when he first decided to prepare for the CISSP, he took an online course featuring many videos. When he didn’t pass his first exam, he did a boot camp. That didn’t bring the desired results either. 

[AV Network Nation Panel Addresses Networked Audio Security]

“A lot of it comes down to—and this is probably going to sound counter-intuitive—the more diverse your career is, the more you can get jaded by what companies do, as opposed to what the right thing to do is,” Drake said.

Because the questions on the CISSP exam are largely scenario-based, the “right thing to do” is the primary focus, Drake explained. But if you’ve been working in a company that has refused to invest in the application of security best practices, you may have developed a belief system that negates their necessity. This won’t be much help with the CISSP. “A lot of our questions are worded like, ‘What is the best? What is the most appropriate? What is the greatest?’ And although those are subjective terms, that is putting you in the best practice mindset. All of our questions are written that way to really focus on the best practice for whatever concept is being presented at the time. It’s really stepping back and almost being mentored by a manager and understanding the business functions, and then applying the cyber concepts to those.”

Like Drake, Hahn took a boot camp and failed her first exam. “Then I said, ‘well, I’m just going to study all these books and these practice questions,’” she recalled. “I thought I was really ready. They put the test in front of me and I actually asked the proctor—because this was back in the paper/pencil days—‘Are you sure you gave me the CISSP?’ He looks at the exam and he says, ‘Yup.’” After yet more studying—and another boot camp—the third time turned out to be the charm. 

[Byte-Sized Lesson: Security and TCP Handshakes]

Both Drake and Hahn agree that candidates should plan for a year’s worth of exam preparation. “One single boot camp, one class, one book, or one video series is probably not enough,” Hahn said. She advises people to cross-study and take the practice exams. Although they may not contain what is on the actual exam—sometimes practice exams focus on definitions, like “What is a disaster recovery plan?” rather than the scenario-based questions the CISSP exam tends to favor—she said that it helps people gain a deeper understanding of the concepts. “It all starts clicking. And so by the time you do sit for the exam, you know the concept—you’re not just memorizing [the definition of a disaster recovery plan]. You know the actual concept, and when you’re asked the [scenario-based] question, you can say, ‘You know what? This is what I would do.’”

Anishia Gopi, senior consultant of infrastructure engineering at CIBC, is also in the process of preparing for the CISSP exam. In addition to the official study guide and other materials, she has also participated in study groups. “Some people prefer to just sit with their book and go through it,” she said. While she said the book and online materials are definitely necessary, exchanging with other candidates helps to solidify the concepts. “If you have a group of people, you can share knowledge and tackle the scenario-based questions in a better way.” She also counsels candidates to examine the tasks they perform daily at work, and how they may relate to the exam preparation material. 

For Gopi, the CISSP provides the opportunity for meaningful professional development. “This is not just about adding a certification tag on your resume—it’s not just that,” she said. “You are taking a step toward being involved in making business decisions. It’s not easy—some of the modules are so difficult that you can easily give up. But I would say that if you are serious about that bigger goal, then it’s easier to pursue.”

Additional CISSP Tips

Hahn recalled that when she was working in AV, she was hands-on, ready to connect cables, configure systems, and perform the plethora of physical tasks associated with deploying a system. There is an element to the CISSP, she said, that more traditional AV professionals may be unfamiliar with. 

“They have to touch on the paperwork side,” Hahn said. “How do you do a business continuity plan? What is a disaster recovery plan? Is there anything I need to know about configuration management? What is a risk assessment? It’s more the paperwork—the policies, the procedures—that an audiovisual professional may have to study a little more. And probably the cryptography—it’s not its own domain anymore, but it is on the exam.”

Carolyn Heinze is a freelance writer/editor. 

The What: Vivotek's new CC9380-HV day/night surveillance camera with Trend Micro IoT Security is an update of the company's CC8370-HV, now available in 5MP with H.265 compression.

The What Else: To meet the demands of harsh outdoor applications, the CC9380-HV is also armed with IP66-rated housing to help the camera body withstand rain, dust and high-pressure water jets from any direction, while its IK10-rated housing provides robust protection against acts of vandalism.

Additional CC9380-HV features include: 5-megapixel CMOS sensor; 20 fps @ 2560 x 1920 (WDR On), 30 fps @ 2560 x 1920 (WDR Off); WDR Pro (120dB) to provide extreme visibility in high light contrast scenes; ±25 degree tilt lens; built-in microphone; 3D noise reduction for low-light conditions.

The Bottom Line: The CC9380-HV is a true 24-hour camera, with a removable IR-cut filter and Supreme Night Visibility. Through the use of a single fisheye lens set to a 180-degree horizontal panoramic view, the seamless image provides a very large vertical field of view. This allows for close range surveillance coverage in a low-profile design.

As the workforce returns to the office, it's estimated that up to 50 percent of employees will be remote for part of the workweek, while others will remain remote full time. In 2021 and beyond, we will see a true hybrid workforce.

AV/IT managers are planning to create more collaboration rooms to facilitate a new work dynamic and an ecosystem to ensure seamless collaboration and productivity—near and far. As more AV equipment and solutions are added to the network and workers move between the office and home, bringing their favorite devices, software, and platforms, company data becomes exponentially more vulnerable.

Mitigating #WFH Risk

For more than two decades, companies have relied on the encrypted connection a virtual private network (VPN) provides to enable employees to access corporate email and safely transmit data over the internet while traveling or working from remote locations. 

In March 2020, when the workforce at large was sent home to work, home Wi-Fi networks, personal laptops, and devices became the mode of connection and workflow. Matthew Rakes, managing director, Information Technology and Cybersecurity at Unity Aluminum, suggested that depending on how well the IT department has defined route policies, a VPN might not mitigate all risks. “One of the problems you can run into is if someone has a compromised local network or device and they attach via VPN to the enterprise, then that device now has traffic flowing into your network.”

There's a degree of Big Brother that has been assumed acceptable when employees are on corporate property. “This is where I think we need to train users' expectations to understand better that when you're using a particular application, that we are going to be Big Brother, even if we are going to be hands-off of the rest of your network,” Rakes said. 

The term “Big Brother” often conjures the idea that evidence is being gathered against the user. “I often think that the best view of this is quite the contrary,” Rakes added. “We should actually be seen more as defenders of the castle.” A strong, secure IT department should first and foremost aim to protect employees and the company data equally. “We should seek to not only protect data, but we should seek to help protect and defend the people that represent your company, and the best way to do that is providing them with secure tools that help them to know that they don't find themselves in a compromising situation,” he said. 

Mitigating a Hybrid Office Security Risk

As AV/IT managers prepare to increase the number of meeting rooms to enable seamless collaboration and videoconferencing for hybrid environments, they will be adding networked AV equipment, and dealing with an influx of personal devices. 

Rakes is taking a long-term approach to adding technologies as employees return. “We are looking at what solutions and technologies we can acquire now that alleviate our immediate pain, but will allow us to better transition into higher efficiency once people come back to the office.” Post-COVID, Unity Aluminum will continue to have a flexible remote work policy. “But we recognize that one of many benefits of being in the office is collaboration,” Rakes said. “We are leveraging tools from Mersive, Cisco, and Microsoft, which helped us to bridge the gap.”

Whenever possible, Rakes deploys a cloud-first model for IT and AV solutions. “That takes a lot of onus off IT departments when you don't have to worry about security patches because Microsoft Azure is already handling that for you,” he said. 

Unity leverages a suite of Cisco technologies for its wired and wireless on-premise networks. “We use Cisco identity services and Cisco capabilities that work as an umbrella that can identify known pieces of hardware and dynamically insert them on the correct VLAN, regardless of what network they initially connect to,” Rakes said. Moving toward a “zero trust” security model, “with Cisco Duo Security, you're able to achieve a dynamic resilience, so when someone connects to a network, enters their credentials to authenticate to that network, then it says, ‘Oh hey, I know who this person is. I can dynamically put them on the correct VLAN,’” he said. 

When choosing AV solutions, Rakes looks to companies with a security-first approach. “One of the things we like about Mersive is the way they handle the communication from the Solstice client back to a pod is different than many other AV solutions,” Rakes said. “Mersive went from the approach first of, ‘How do we secure the transmission of that traffic?’ and then, ‘Now let’s make sure that the audio-video protocols work.’” 

When it comes to security and BYOD/BYOM devices, the primary challenge is the verification and enforcement of an organization’s security policy. “Organizationally owned assets can be standardized and remotely managed. This allows the organization to enforce security best practices on network devices,” AV/IT industry consulting solutions architect of AVCoIP, Paul Zielie, said. “BYOx devices could bring in malware, which once inside the organizations, can do serious damage.”

The best way to mitigate risk is to require a security package run on the BYOD hardware. “If employees want to use these devices on the organization’s network, require that the security package needs to be running while connected,” Zielie said. “You then use a port level security protocol like 802.1x, which checks that it is running before data is passed.” 

In Their Own Words

We asked experts from leading AV/IT manufacturers and providers with a security-first approach to share their insight on the new era of AV/IT security.

Access Networks

Nathan Holmes, Director of Training and Development

It is not realistic to add protection services to every device that may be added to a collaboration space, but there are still several steps AV/IT managers can take to enable safe, secure, and seamless collaboration and productivity. Segregating remote connectable collaboration areas from the rest of the corporate network, employing a Next-Gen firewall solution with unified threat protection services, and ensuring that your IT team is up to date on cybersecurity threats and employs best IT practices are some easy first steps to securing your corporate networks while supporting a remote workforce.

AV/IT managers are accustomed to creating an Information Security (InfoSEC) plan for their respective businesses, but these plans are typically based upon most, if not all, employees residing within the controlled corporate network hardware area. With the move toward BYOD and BYOM, the InfoSEC plan should include strategies that allow employees to join the collaboration space through devices that may not employ protection services. To mitigate security threats for all devices, we recommend the following course of action: The development and execution of a comprehensive security policy that includes unified threat protection, provides each employee with the networking equipment they need to work remotely, ensures devices include active information security services, actively manages and updates these services, provides secure VPN access for each employee, and ensures there is a specific policy and procedure for connecting non-company-owned equipment to the corporate network.

Aurora

Paul Harris, CEO/CTO

When choosing new products and solutions to integrate into collaboration rooms, taking into consideration the “new norm” will be especially important. COVID-19 is our first modern day pandemic and will not be the last. Being ready at a minute’s notice to shift from in-office to remote in a collaborative fashion will be key to a successful business. As we have learned, it is not just about remote, but the safety of the rooms where people do have to gather. 

Touchless-based systems are now crucial to keeping employees safe and successful. Aurora Multimedia has developed several technologies to address these needs. Aurora started with thermal temperature readings with gestures, and then migrated that technology into conference rooms. Aurora’s RXM-1, ReAX Media Server will allow voice commands, hand gestures, and QR codes for remote control pages on a user’s cell phone or laptop, as an example. Selecting sources is as easy as raising your hand. But it goes into deeper details, such as telling how many people are in the room, so as to not violate occupancy maximums. 

Additionally, the use of real-time facial recognition allows access into the system and even can restrict individuals that do not have authorization/access—providing enhanced security. During the process, it reads the temperature of the occupants, as temps can change during the day and most systems currently are focused on initial entry for detection. Overall, this enhanced technology makes it possible for a safer, more sophisticated, and more secure workplace that is now easier than ever to use.

Avocor

Dana Corey, SVP and GM

This year, companies were faced with many unforeseen challenges when the pandemic first prompted stay-at-home orders. From technical and security issues, to ensuring teams had the appropriate software and hardware technologies, to simply trying to manage team communication and efficiencies within a distributed workforce—they were forced to figure out a new way to work, with little time to plan for it.

With this increase in remote work and a hybrid workforce, organizations big and small are looking to invest in the most practical tools that enable team-wide communication and collaboration from anywhere, and this transition is requiring AV/IT managers to rely on data to support their plans for business continuity and return to work.

Workspace intelligence analytic solutions are a critical component to this movement, as they will allow decision-makers to take immediate action to re-evaluate the meeting room, UC hardware and software ROI, as well as guide future planning, which is especially helpful for the return to work and hybrid work strategy planning happening all around the world right now.

Available in Q1 2021, Avocor Aquarius provides real-time business intelligence of meeting space usage and environmental data, such as presence detection, attendee impact on room temperature, humidity, and light conditions—data that can be leveraged by AV/IT facility managers to make critical decisions about space management, find real-time cost savings in heating and cooling, and future hardware and software purchases.

Barco

David Martens, Enterprise Product Security Architect

AV/IT managers should look for vendors who have product security embedded in their DNA. Good product security means integrating security in all phases of the lifecycle of a product. Security requirements have to be taken along from the very start—together with the functional requirements—and even after the product has been released, the implementation of a patch management strategy and a responsible disclosure policy will allow customers to keep their product secure. Product vendors have to be transparent about how they manage product security.

When it comes to the BYOD device used to participate in the meeting—it has to be well managed, and the latest security patches have to be applied—otherwise a malicious hacker could gain access to confidential data. A second challenge is the diversity of UC&C platforms; the host should set up the meeting with the correct access permissions to prevent any unwanted participants by configuring enforcement of access credentials, the use of a lobby room, etc.

Of course, remote working poses its own unique set of security challenges. Quite a lot of organizations had to go remote almost overnight, and this has been a huge task for a lot of IT teams. Though setting up a VPN infrastructure is one thing—configuring it correctly, maintaining, and patching it are crucial to prevent malicious actors entering your network. Migration to the cloud for office applications is being adopted rapidly to enable the hybrid working model, but it nevertheless opens up serious security risks. Phishing attempts get more and more sophisticated, which requires the enforcement of multi-factor authentication to mitigate. A more recent attack vector is the roll-out of malicious Azure apps, that, once granted permission, can access your emails or personal files. A strict corporate policy on which kinds of applications employees are authorized to install is crucial to keep your endpoints healthy.

BenQ America Corp.

Bob Wudeck, Senior Director of Business Development 

When selecting new products and solutions to integrate into collaboration rooms, ensure they follow the latest IT network best practices. Every solution in the room should minimize the organization’s attack profile, limit access to content and data, and reduce data interaction.

For example, wireless presentation systems (WPS) are a hot item, as they complement the BYOD and BYOM trends—allowing multiple presenters to collaborate simultaneously, and they are an affordable and more flexible alternative to HDMI. However, many WPS are shown to have several network vulnerabilities. To avoid this, AV/IT managers should utilize a WPS that operates independently of the network, doesn’t require proprietary software or apps, and has 100-percent 128-bit AES encryption. InstaShow includes these features and more for use in even the most high-security applications. It prevents unexpected access and helps organizations comply with emerging personal information laws. 

When you go remote, you face significant cybersecurity challenges. According to Threatpost, the majority of cyberattacks target apps and devices with known vulnerabilities. As a result, IT managers closely monitor and limit the apps and hardware that run on their company’s network. However, IT managers have much less control over the apps and devices remote workers use. A recent survey by Malwarebytes found 28 percent of respondents use personal devices for remote work instead of company-approved equipment—a problem known as “ghost IT.” Exacerbating this are home Wi-Fi networks running on consumer-grade modems without a dedicated firewall. IT managers must ensure employees are using secured devices, and prevent the download of unscreened apps.

Biamp

Rashid Skaf, President, CEO, and Co-chairman

I recommend that when looking at new solutions, you ensure that the products or the vendors that you’re looking at are adaptable, flexible, and manageable. When it comes to security, that has to be part of the DNA of the company you’re talking to. Security is not something that you can “add” to the mix. It’s not an ingredient; it is an underlying, foundational piece that you need to put into place, and if you don’t feel like that’s part of what you’re looking at, then you should keep looking.

Part of what we do at Biamp is have customer panels and advisory boards from banks, government facilities, and education facilities globally that help ensure our security protocols will allow us to be on their network. That is always helpful, because security standards are not something that are static, but get modified over time, so you have to be able to adapt to new standards.

Harman

Jamie Trader, VP, Global Product Line Management–Video and Control

One thing is certain in today’s blended work environment: Collaboration happens on the network. Organizations go to great lengths to secure their network. Best practices and regulatory compliance combine into a shape of highly curated security goals, aimed at preventing impact to CIA (confidentiality, integrity, and availability) of data.

No longer nice-to-have, there is organizational expectation that any networked device—AV or IT—is able to, and will, maintain a security posture in alignment with those security goals. So, what does that mean for the AV/IT manager who today has a vast spectrum of networked AV devices to choose from? It’s simple. 

AV/IT managers today need to evaluate how legitimately a product supports the IP and network protocols that have been long-established for delivering defense in layers—whether talking about the AAA of access control (authentication, authorization, and accounting), adherence to standard IP protocols like VLAN tagging for segmenting traffic, or perhaps evaluating what types of encryption is available and what traffic is being encrypted. Not all products are created equal, and some that claim enterprise-level security don’t always provide mitigation capabilities to conform to your particular security posture. 

Reputable solutions will possess these attributes—being available and supportable by the manufacturer. The AV/IT manager selecting new products doesn’t need to define the security posture—they will just need to be able to implement the risk mitigation actions outlined for them. Make sure the products you choose support those actions.

Intel

Brian Cockrell, Intel Unite Solution Product Owner and Co-founder

A modern collaboration platform should include a suite of security features to guard against a variety of risk scenarios. Robust encryption should be in place. The Intel Unite solution uses end-to-end TLS (transport layer security) encryption between a participant’s device and a room hub, whose connection to the server—on-prem or cloud—is also end-to-end TLS encrypted. In addition to encryption, there should be protections against unauthorized access to sessions, such as a rotating PIN, and the ability for participants to lock a meeting, as well as expel unwanted participants. Other security features include keystroke lockout, protected guest access, and the ability to authorize use by individual. Finally, content shouldn’t leave the organization’s network and use data should be anonymous. These protections should be embedded in software that is easy to learn and use. Otherwise, disuse becomes the primary protection. Good for security, but bad for collaboration. The Intel Unite solution is a good example of a collaboration platform that includes all these features. 

When a new collaboration platform is combined with peripherals and plugins—especially in BYOD, BYOM, and remote environments—the result is a staggering number and variety of potential risks—some foreseeable, others novel. Do the research and choose tech wisely. Has the software been vetted by other users? Where is data going and is it sufficiently protected? What data is collected and where is it stored? Once the risks and benefits are fully understood, weigh those against a risk profile and choose the tools that provide the best balance.

Mersive

Christopher Jaynes, PhD, Founder and CTO

The new hybrid workplace will need Bring Your Own Meeting (BYOM) solutions in more spaces than ever before, so it’s critical that enterprises select vendors and solutions that are secure and scalable to large numbers of rooms. Security models that focus on the personal device and how it works in concert with a secure platform, then, are more important than they were in the past. IT must view the personal device ecosystem as a new part of the enterprise infrastructure. AV/IT managers must look closely at collaboration technologies that are secure and scalable under these new conditions.

There are several key attributes that can be found in solutions that are hybrid workplace-ready. These include capabilities like exponential response times on communication ports to dent brute force attacks, code obfuscation, enterprise-grade encryption ciphers, and even methods to log suspicious events to inform managers of attempted attacks. I recommend looking not only at security features, but at the company’s security legacy. Unfortunately, multiple meeting collaboration platforms were in the news for security breaches in the last couple of years.

Security is never a one-time consideration, and can’t be only defined by a set of fixed features; instead, it’s an exercise in diligence. New vulnerabilities are being explored every day and countermeasures must be looked at almost continuously. Look for vendors that perform regular penetration tests and continually harden their solutions with new layers of security capabilities. Software-based solutions have become increasingly important, as they allow vendors to roll out continuous updates as new security features become available.

Shure

Ronald Rousseau, Manager, Platform Product Management

To provide the best network security, AV/IT managers should look for conferencing systems that feature audio encryption. For example, Shure features products that include Shure Network Audio Encryption to help protect networked audio connections from security breaches. The technology safeguards confidential content without compromising audio quality. It is based on the AES-256 algorithm that has been widely adopted by leading financial institutions, government agencies, and healthcare providers that are concerned with data security.

Until now, however, such robust security was not available to protect networked audio signals. With the right software, like Designer, it is easy to configure features and activate, while being compatible with current technology. For IT managers who want more control and uniformity, the use of encrypted audio helps level the playing field, and it can be used for wired and wireless encryption.

While no network is completely secure, an IT manager can take steps to improve security. Network audio encryption can be combined with other network security measures like device access control and network partitioning to create a multi-layered security solution.

Utelogy

Nicole Corbin, Director of Product and User Experience

There are a number of important considerations when choosing new solutions to integrate into collaboration rooms; chief among them is security. Utelogy has introduced a program called Utelligence, which is intended to drive a higher level of security standards, create more robust APIs, as well as offer complete and meaningful metrics. Devices with a rich API provide ease of management and monitoring and even remote fixing, which ultimately means more uptime, a better user experience, and significantly reduced support costs. I would recommend any devices which adhere to these standards above all others.

BYOD/BYOM, security challenges such as data leaks, malware, unsecure networks, et cetera are nothing new, however they have become more prominent in the work-from-home era. Your IT department should be well versed in the importance of implementing MFA, SSO, VPNs, MDM, keeping device software up to date, and setting stringent password protocols. It would also be beneficial to choose devices (Utelligent devices) that use secure protocols such as SSH, HTTPS, and WSS. These security strategies need to be well thought through, audited periodically, and distributed to all employees. 

Remote work opens up different kinds of security threats and concerns. Since your company should now have established BYOD/BYOM protocols, you can begin creating your remote office policy. A few recommendations would be to make sure all employees lock their screens before leaving their work area, use headphones on calls if they are not alone, keep a tidy workspace, dress appropriately if on video, and ensure they have access to adequate Wi-Fi. These recommendations not only help with security threats, but will also mitigate threats on a company’s image and brand reputation.

WolfVision

Andrea Mayer, Inside Sales Manager

When the workforce does return to the office, hybrid meetings will be the norm. It is paramount for meeting participants to be able to have a secure, positive experience in the physical meeting space, while also having the ability to interact easily with remote workers at the same time.

Bring Your Own Device/Bring Your Own Meeting was already popular, but since the pandemic, it is now essential and here to stay. People want in-room, “touchless meetings” with simple, secure, fully encrypted wireless connectivity, and they expect a consistent, secure meeting experience—whether they are participating in-person or remotely.

Reducing in-room infrastructure and focusing on single-box, multi-functional, all-in-one appliances such as WolfVision Cynap—that include built-in, encrypted, room-to-room streaming capability, Zoom, Teams, and WebRTC functionality, and that can be easily controlled and administered remotely using proprietary software—help to simplify the task of AV managers in delivering a secure, flexible collaboration solution.

Like Cynap presentation and collaboration solutions, selected products should have a range of security features—preferably customizable—that can meet a diverse range of enterprise security policies. For example, it should be possible to disable network interfaces not in use, restrict browser access, and disable any features, such as streaming, recording, snapshots, USB ports, et cetera, if they are not required. When a meeting ends, it is critical that no data is ever stored on the system. A closed operating system is also desirable, such as the Cynap Linux system, that does not permit installation of any third-party applications.

When it comes to transporting AV signals over the network, it’s audio that’s been leading the way. But with this pervasive deployment of networked audio comes concerns of security. This was the subject of the AV Network Nation panel “Securing Your Networked Audio,” which tackled the many ways systems can become exposed, and what you can do to keep them locked down. 

Moderated by AVNation’s Tim Albright, panelists included Bradford Benn of Advisist Group, Bob Ehlers of Audinate, Rebecca Sullins of Pro Media Audio Video, and Ronald Rousseau of Shure.

The panelists agreed that the biggest hurdle to overcome in a secure system is the users. “The first thing is being able to have an educated user and support base that knows about network management from top to bottom,” said Audinate’ Ehlers. “It doesn’t do any good for us to talk to people about security when they don’t really understand what good security hygiene is.” 

Benn agreed: “The first thing I would say is that security starts with the user. It’s way before any of these layers that get put on top of it; that’s the good hygiene. If everyone has the same password, if everyone has the same login name, your security is pretty broken.”

Human error extends to the person setting up the tech, as well. “Be aware of everything you’re putting on the network and how it can be accessed,” said Sullins. “And that even gets down as far as buildings that don’t allow wireless microphones, because that audio can be intercepted. It starts with understanding the level of physical securities for the design before you even get into encryption certificates, passwords, and the like.”

Beyond user training, it’s also key for integrators and tech managers to have a better understanding of the technology. “I think we need to have certification training around network administration and security,” Ehlers said. “There is a level of base understanding that everyone should have and we [Audinate] try to impart that in the training that we do.”

“We really care about education,” Shure’s Rousseau echoed, urging AV techs to reach out to vendors to inquire about their educational offerings. “You’d be surprised the quality of training they have,” he said. “And it’s from people who either developed the product or product managers, so those people can not only tell you how it works, but why we’ve decided to make it work that way.”

Benn argued that the best kind of understanding is higher level: “Learn the concepts, not the commands,” he said. “I do not know how to configure a Cisco switch, an HP switch, or a Netgear switch; however, I know to tell people ‘I need to go in and set up quality of service, we need advanced encryption standards.’ I made sure I understood what the acronyms meant and how they were being used.”

In addition to a lot of discussion over acronyms, other topics included balancing the tradeoffs between security and ease of use, and using Wireshark to understand network traffic. 

“One thing I stress is that this doesn’t have to be difficult,” Benn said. “If we start talking with the IT partners and working with them, we can solve a lot of these issues.”

All of the AV Network Nation content—including the exhibit hall—is available on demand for the next four weeks. To learn more, visit avnetworknation.com.

Get your free copy of The Integration Guide to Secure AV.

Securing the Network

With remote work, video conferencing technology, and connected devices dominating the new “digital” workplace, many companies are looking to their technology integrators for advice in ensuring they have the proper cyber security protocols in place. 

Product Showcase

Check out secure AV products from companies like Harman.

At Issue

Experts from industry-leading companies like Synnex share how integrators can keep up with the latest security protocols.

DOWNLOAD THE INTEGRATION GUIDE TO SECURE AV. 

As part of its efforts to mitigate evolving security threats, BenQ recently received ISO 27001 certification for its InstaShow wireless presentation system. ISO 27001 is an internationally authoritative standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of an organization, thereby ensuring that data remains secure, complete, and usable. After undergoing stringent reviews by the British Standards Institution (BSI), BenQ was awarded the ISO/IEC 27001:2013 certification on Sept. 14, 2020.

"The wireless presentation system market is growing quickly, giving customers an abundance of options that may undermine their security best practices," said Bob Wudeck, senior director of business development at BenQ America Corp. "Information security has always been at the heart of BenQ R&D, and that mission has established InstaShow as a leader in the field. It's the first ISO 27001-certified solution to be affordable, operate without the requirement of risky software applications, and offer a unique alternative for sending a wide variety of HDMI sources around a room wirelessly."

Related: BenQ Debuts InstaShow S Model for Conference Rooms

InstaShow was designed to provide users with an HDMI-based collaboration solution that proactively minimizes threats that cause information breaches and expensive fallout. It's well suited for security-oriented businesses such as banks, law firms, and accounting firms, as well as government, military, and educational institutions. Unlike many solutions on the market, it is entirely hardware-based, requiring no setup or drivers, which means no unauthorized or malicious software will make its way into the user's computer.

With InstaShow, users can connect any device with an HDMI or USB-C output to wirelessly mirror content to the room's display without risk to the device or the network. It works with any OS or hardware platform, including PCs, Macs, and Chromebooks, while promising absolute data security via measures such as WPA2-PSK protection with 128-bit encryption and secure handshake procedures. Furthermore, Onward Security, a leading ISO 27001 and ISO17025-certified security lab, tested the InstaShow wireless encryption system for KRACK attack vulnerability — vulnerabilities that were found in competing wireless presentation systems — and found none. Helping customers safeguard their data and privacy, the current ISO 2700 certification strengthens InstaShow's continuous prioritization and improvement in upholding security best practices.

InstaShow offers meeting room flexibility due to its ability to connect to non-computer devices without an app. In addition to supporting the latest notebooks, tablets, and phones, the InstaShow HDMI button can be connected to Blu-ray players, document cameras, AV receivers, Chromebooks, BrightSign or Scala digital signage players, digital microscopes, as well as monitors and projectors with HDMI out ports. The InstaShow USB-C port can support the native output of digital cameras as well. The system can also be used to replace a traditional wired HDMI switcher since it supports up to 32 different input sources.

This month, we shift our focus to an important security issue. We will combine some information about IP addresses, the TCP three-way handshake, and the role of the firewall. This security issue is important if you have an encoder, camera, or other device that periodically goes back to the manufacturer’s website to register its license or get updates. First, we require some background information.

There are two broad classes of IP addresses: public and private. Public addresses are intended for use outside private networks and are used in the public internet. Private addresses are to be used only on private enterprise networks such as those of schools, businesses, and hospitals. Addresses beginning with 192.168, 10, or 172.176 are nearly always private addresses. The firewall or residential gateway acting as a firewall, usually is placed between the public network (outside) and private network (inside). (We will interchange the terms “firewall” and “gateway” for this discussion.) One of the major roles of the firewall is to convert private addresses to public address and vice versa. 

Related: Byte-Sized Lesson: Troubleshooting Connectivity

Two more facts are important. A TCP session is uniquely identified by four number patterns: the source IP address, the source port number, the destination IP address, and the destination port number. The client treats these four numbers as tags on the session and the server does the same thing. When the first packet in a session is sent from the client to the server, the firewall intercepts the flow and acts as a proxy. It will act as the end point of the session for the client by replacing the server’s IP address with its own address using a different port number. Then, it will forward the connection request to the server using the ISP’s public address that was assigned to the client’s location.

This may seem complicated. So, we’ll use this example (see the diagram above for reference). Your camera is assigned the address 192.168.3.31. The server is at 138.11.2.65. Your gateway is likely 192.168.3.1. Finally, your ISP assigned the address 202.16.32.59 to your gateway interface. Using the common notation (IP address: port number), the connection between the client and the gateway might be (192.168.3.31: 5050) to (192.168.3.1:5454) and then (202.16.32.59:4040) to (138.11.2.65:2090). Note that the internal connection uses only a private address. Likewise, the external connection uses only public addresses.

Now, consider the security implication of this procedure. The TCP handshake that establishes a connection is comprised of a three-way exchange of packets to negotiate the parameters to be used in the session. The first packet is simply a request by the client to open a session. The response from the server acknowledges the request and usually agrees with the set of parameters. The third packet, sent by the client, confirms the receipt of the second packet.

Now, it is practicable for the firewall to determine whether the initiator of the session is inside or outside. If the first packet is sent to a public address, the client is inside. If the first packet is sent to a private address, the client is outside. In the latter case, the session will be denied by directly dropping the packet. We don’t want sessions established by devices in the public internet.

Frost & Sullivan’s recent analysis, Global Network Access Control Market, Forecast to 2024, finds that the proliferation of the Internet of Things (IoT), the convergence of information technology (IT) and operation technology (OT), and customers’ migration to the cloud at a faster pace are rapidly driving the NAC market. The sector is estimated to increase by two-thirds, reaching $2.21 billion by 2024 from $1.35 billion in 2019, at a compound annual growth rate (CAGR) of 10.4 percent.

With 60.2 percent market share, North America will continue to be the largest market for NAC until 2024; APAC is the fastest-growing region and its share of the global NAC market is estimated to increase from 9.9 percent in 2019 to 11.9 percent in 2024. The COVID-19 pandemic will cause a severe slowdown in 2020. Thereafter, the NAC market is expected to regain annual double-digit growth rates as organizations settle into a “new normal.”

Related: Solutionz Launches SecureAV Cybersecurity Managed Service

“Security vendors are working closely with their customers in order to support them in this unprecedented transition to work from home (WFH),” said Tony Massimini, senior industry analyst at Frost & Sullivan. “They are focused on ensuring their clients’ business continuity, and the pandemic has underlined the value of cloud services in delivering and deploying security solutions to remote devices. However, the cloud environment needs security as well. Having a remote workforce highlights the need to leverage NAC. Large cybersecurity vendors with broad product portfolios will want to add this solution as well.”

Vendors should continue to innovate cloud security, work closely with AWS, Azure, Google Cloud, and other tech vendors, and focus on virtual appliances and NAC as Software-as-a-Service (SaaS). Additionally, NAC is adapting to a more mobile environment as enterprises expand beyond the traditional secure walls. 

The complexity of 802.1X deployment (one of the best methods for authentication), surging diversity of IoT devices, and increasing NAC solution costs for large enterprises are likely to hinder the market. NAC vendors’ move to work beyond the traditional IT perimeter and innovation in other technologies will boost growth opportunities via:

• Incorporating NAC into OT to improve security tools for better coordination and to leverage IoT technology.
• Focusing on virtual appliances and SaaS for customers’ quick migration to public and private clouds.
• Instrumentalizing the concept of zero trust networking (ZTN)—the never trust, always verify principle—so security vendors, including NAC, can promote their capabilities via integration of their product portfolios.
• Capitalizing on use cases of IoT, BYOD, and mobility, which are increasing at a significant rate. Most IoT devices do not have the resources to handle an agent, so agentless technology is required.

Global Network Access Control Market, Forecast to 2024 is the latest addition to Frost & Sullivan’s Information and Communications Technology research and analyses available through the Frost & Sullivan Leadership Council, which helps organizations identify a continuous flow of growth opportunities to succeed in an unpredictable future.

AV integrator Solutionz, Inc. has launched SecureAV, a new cybersecurity service. Enormous amounts of critical information are commonly exchanged via electronic meeting rooms, as well as unified communication environments every day. SecureAV protects organizations from inherent known vulnerabilities that exist in AV equipment. Through SecureAV, Solutionz proactively prevents, detects, responds, and reports on security concerns specific to an organization’s AV/UC environment.

[Playing IT Safe: The State of Networked AV Security]

SecureAV is designed to address these specific security needs and protects that information on an ongoing basis, without utilizing scarce IT/security resources. SecureAV looks at every data packet coming into and out of the environment and uses machine learning to determine if the traffic is a threat. It then reacts according to personalized policies and protects the IoT environment against common attacks including eavesdropping, botnets, denial of service attacks, man in the middle attacks, LAN hopping, open relays, and other common security issues.

According to Shawn Fernandez, vice president of cybersecurity business development, “We have been watching and assessing the ever growing problem of malicious threats to the IoT environment for some time now, and are acutely aware that AV is now a part of every organization’s IoT landscape. We feel that it is imperative to respond with a service that will protect our customers from these growing threats.” Shawn will continue to expand the cybersecurity portfolio at Solutionz.

“I am excited about what this game-changing new managed service offers to our customers,” said Bill Warnick, chief executive officer of Solutionz. “We have partnered with some of the brightest minds in cybersecurity to provide the best possible protection for AV and UC environments. SecureAV gives our customers the confidence that Solutionz is on the job, vigilantly monitoring and taking action against any online threat.”

Solutionz’ SecureAV managed service offering is available to organizations regardless of where their AV/UC equipment was purchased. It offers remote support 24/7/365 and is fully customizable to meet budgetary needs.

As audiovisual technology pervades our lives to an ever-increasing degree, it often falls into two categories: things designed to solve problems, and stuff engineered to amaze. Occasionally, though, there comes a special integration that does both equally. Fishtech Group’s cybersecurity operations center (CSOC) is one such installation.

The Kansas City, MO-based data-driven cybersecurity solutions provider recently opened a world-class facility packed with tech designed to both serve the company’s clients and wow new ones. And the centerpiece is a massive, 32-foot-diagonal video wall, on which the company’s security analysts vigilantly monitor threats. 

“Our clients are blown away by the Cyber Defense Center,” said Andy Jones, Fishtech director of digital solutions. “Most people have never seen anything like it here in the Midwest; it’s pretty remarkable.”

Detecting Potential

CEO Gary Fish founded Fishtech Group in 2016 as a successor to his previous company, FishNet Security, which was primarily a product retailer. Fish wanted his new venture to capitalize on the broader services side of cybersecurity as well. 

“Fishtech is focused on services,” said Matt Skeen, director of information technology. “We take an overarching approach to our customers’ challenges. And rather than just throwing a product at the problem, we provide a solution and the path to get there.”

In addition to this consultative branch and the company’s product vendor business, the third arm of the group is CYDERES—an acronym for cyber defense and response.

“CYDERES uses a security-as-a-service platform as a managed SIEM [security information and event management],” said Skeen, who has worked in enterprise IT for more than a decade, including at FishNet. “The platform ingests logs across various different security technology platforms, so analysts can provide feedback to our customers about potential security threats and vulnerabilities. Often times, we then take action on a manual and automated level to mitigate those threats.”

A New Vision

To execute the CYDERES branch of the company required a new space, and Fishtech began planning the facility two years ago. The 20,000-square-foot operations center, which sits next to the company’s main headquarters, was to feature open-concept work spaces, private offices, meeting rooms, an executive briefing center, and, of course, the CSOC with its massive 7-by-7 video wall.

“Gary [Fish] envisioned a security operations center that other companies could enlist rather than having their own,” Jones said. “And he wanted to build one bigger and better than any before it. Hence the two-story video wall, which, really, the whole SOC was built around that video wall concept.” Jones, who began his AV career doing high-end residential integration and has worked with Fish for more than a decade, took on the task of leading the installation of the wall.

With a project this size, the process involved more than just hanging displays. “I worked closely with the engineering firm pre-construction to ensure that we really bolstered that wall that it’s mounted to,” Jones said. “I also worked closely with the electrical and HVAC engineering firms to ensure ample power and avoid creating a furnace on the wall. That space has to be comfortable for employees to work in as well as for clients to visit and use.” 

Jones and the HVAC company created a system with ventilation below an elevated floor, and a suction system at the ceiling that pulls hot air up from behind the video wall. 

Jones also underwent a nearly yearlong process of evaluating options for the wall displays. “We wanted something that was easily serviceable, that looked great, and that was reliable,” he said. He eventually settled on Barco’s UniSee. “You can slide the wall up, pull a screen out, and just pop it back in if you have to. With a wall that size, everything has to be laser perfect.”

Another challenge remained: enabling current and prospective clients to view the operations center without seeing private customer information on the analysts’ computer screens. “The solution was to put a viewing platform in that room above our analysts,” Jones said. “Our potential clients can now walk within that viewing platform. They can see the huge screen and even interact with a nearby touchscreen on a podium. They get to see this state-of-the-art facility and we don’t reveal any proprietary or sensitive data.”

Securing the Security

As a cybersecurity company, it was paramount that the screens in the CSOC not only stayed operational, but that the signals feeding them would be impervious to threats as well.

“The video wall was mission critical to our CSOC environment,” Skeen said. “The data displayed on that screen is potentially customer-impacting—from alerting to our managed SIEM platform. We had to ensure that that those screens would always be up, and that the data transferred to those screens was always secure. We took a 5,000-foot view to see how we could architect that not only securely but efficiently and effectively.”

Through the company’s established relationship with Crestron, they were aware of its NVX AV-over-IP platform. “NVX could provide not only government-grade security around the actual networking side of the house, but also reliability and availability in the ways they actually manage that product,” Skeen said. “Crestron NVX’s security definitely went above and beyond what we were looking for.”

Meeting Needs

Crestron solutions permeate the rest of the facility as well. With only a little more than 100 out of the company’s 220-odd employees based in the CSOC, robust conferencing capability was key.

“We use Crestron for scheduling our conference and huddle rooms and managing the content,” Jones said. “Screens in all those areas allow employees to bring their own device and just plug right in.” The team settled on Zoom Rooms with Crestron Flex hardware, including its wall-mount UC Video Conference Smart Soundbar & Camera, and displays from Sharp, LG, and Christie. “Zoom Rooms fit pretty well for some of our large conference spaces, where 10 to 20 clients at a time sit in a room and talk remotely to their remote staff and our remote staff.”

Of course, standardization is crucial. “We needed it to be the same user experience in every room, for the most part,” Jones said. “We’re still kind of tweaking it and improving it constantly, but we’re doing pretty good keeping that user experience the same everywhere.” Jones said that Fishtech is currently considering migrating from Zoom to Microsoft Teams, as the company uses Microsoft Office 365 for the rest of its communications. 

To ensure the technology would be well received by employees, Jones and Skeen took a proactive approach to developing a training regimen. “When we built out the building, we went to our facilities team and said ‘Sit down in these rooms and let’s go through how it works,’” Skeen said. “Consequently, we developed a five-step process of things to do to make the rooms work.”

Brand Building

In addition to the CSOC video wall, Fishtech’s new facility has another room to show off what the company is all about, the executive briefing center (EBC). “There’s a stage in there, and eight restored cars—our owner is a car guy,” Jones said. “We have professional stage lighting, video presentation equipment from Blackmagic, microphones, and more.” The centerpiece is a large Christie LED wall, and the space is used for various purposes, including events that are livestreamed, called “Disruption Theater.”

“Our marketing team uses the theater to record Fishtech initiatives and expert panels; we record it and put that out,” Jones said. These videos are published to YouTube and Vimeo, and occasionally broadcasted leveraging Zoom’s livestreaming capabilities. The space is also used for internal all-hands meetings.

Refining the Systems

Since opening in early 2019, the reception to the facility has been overwhelmingly positive. Beyond the amazement experienced by clients on their tours, Skeen said the employees have been happy with their new systems as well. “The Crestron systems and scheduling outside of all our conferencing rooms makes it absolutely fantastic for our end users who need to have an impromptu meeting,” he said. “And having the same technology within each of those rooms makes the end-user experience repeatable and efficient every time they go into those rooms.”

Naturally, no technology implementation is without its issues. “Things will never go 100-percent smoothly,” Skeen said. “Even though we’ve documented and trained users, there’s still some challenges.” Another issue revolved around the hundreds of Crestron endpoints across the company’s multiple facilities—a challenge that’s being addressed using Crestron XiO Cloud management platform. “Before XiO Cloud there was no way to centrally manage those well, from a software upgrade, a firmware upgrade, a code upgrade perspective,” Skeen said. “We believe XiO Cloud will be able to solve a lot of the challenges we had from an implementation perspective. The ability to centrally manage all of those devices more effectively is a huge win for us.”

Looking a step further down the road, Jones said he’d like to see a platform like XiO Cloud that could aid in the management of all the devices under his purview. “We are constantly leveraging and interfacing with 160 cameras, IP-controlled door access system, security system, Four Winds Interactive digital content management for our signage, and many other platforms,” he said. “We’re always looking for a better solution to manage all of that together.”

The What: SnapAV has launched the Luma 410 Series HD outdoor surveillance IP cameras. 

The What Else: The Luma 410 Series comes in bullet, dome, and turret models with multiple color options. Along with 4K imaging, the cameras feature Wide Dynamic Range to eliminate shadowy areas, advanced motion technology that follows large objects through a scene for up to five minutes, and a third video stream independent from the main stream optimized for HD control system streaming.

“We’re excited for the possibilities that the Luma 410 Series brings,” said Alex Patrao, category manager for SnapAV Surveillance & Security. “Offering 4K surveillance in a budget-friendly design allows dealers to install premium video for more of their customers, further expanding their surveillance business by leveraging a new price point. This is something dealers have been asking for, and we’re excited to fill this gap in the market so dealers can expand their operations with 4K surveillance on every job.” 

The Bottom Line: The 410 Series enhances the X10 camera line by giving dealers a budget-friendly HD solution and providing high-quality video for more customers than ever before. The 410 Series is designed to provide clarity and peace of mind with 8MP 4K resolution and a dedicated third video control stream in a low-profile housing.

Cybercrime has consistently outpaced violent crimes as the number-one threat Americans fear in the past decade by a large margin, according to an annual Gallup study. It’s no wonder why. The threats persist as security breaches seem to increase in frequency and severity. 

Networked audio and video systems provide a legitimate vulnerability, and AV pros need to brush up on their information security standards. The issue is even more complex for education institutions as they are subject to regulations like FERPA, the Family Education and Rights and Privacy Act, established to protect the privacy of student education records. Photos and videos of students are considered part of their education records, as well as any other part of their digital footprint on campus.

Education technology managers are challenged by the demand to enable easy collaboration while ensuring the security of student data. But it’s certainly not just collaboration devices to be concerned with. “Almost any software that’s out there in the cloud, there’s going to be a security risk,” said John O’Brien, assistant director of academic technology, technical support services at Montclair State University in New Jersey. 

While FERPA certainly gets the most attention, there are myriad other regulations with which education institutions must comply, according to Bill Britton, vice president of information technology, CIO and director of Cal Poly’s Cybersecurity Center. Any college or university that maintains health records on student athletes fall under HIPAA regulations. Research working with corporate partners may be handling intellectual property data, thus subject to IP law privacy standards. For those postsecondary schools working with government entities, there’s the ITAR (International Traffic in Arms Regulations), which regulates defense and military-related technologies in the interest of national security. 

Then there are state regulations. California, for example, has some of the strictest privacy laws in the country. The California Consumer Privacy Act is known as GDPR Light, a nod to Europe’s sweeping data privacy law. The Student Online Personal Information Protection Act (SOPIPA), which took effect in 2016, prohibits sharing K-12 student data for targeted advertising.

When it comes to complying with regulations, there are just so many different rules with each one. They all report to different offices, and often, IT people aren’t even drawn into the conversation—until, of course, there’s a breach. “Organization and structure are really important in this conversation,” Britton said. “Smart organizations have coworking groups,” which function across departments. 

The issue presents a sense of urgency behind the move to converge AV and IT departments.

Cal Poly is fortunate to have a much larger IT department than most universities, comprising three sub-groups: policy and governance, which works with the rest of the university; tech support; and forensics, which responds to incidents and proactively seeks vulnerabilities. The audiovisual team resides under the governance group’s Accessible Technology Initiative (ATI), a policy making IT resources and services accessible to all, as well as guiding proper implementation of technology. “ATI and cybersecurity are tied at the hip now,” which is very rare, Britton noted. 

At Montclair State, the AV department was absorbed into IT back in 1998. When the AV team seeks to onboard a new device, they have a detailed system in place. They’re required to provide a host of information to their IT colleagues. “We have a security checklist that new [vendors] have to fill out,” he said. “They have to meet the Montclair State University standards.”

The process covers the methods a device uses to get on the network, how it functions, MAC address, SSL, and all other security protocols. This is all in addition to automated network monitoring software, Cisco’s ISE (Identity Services Engine), which simplifies identity management across diverse network devices. Additionally, if an IP device hasn’t been used in a while, say, for two or three months, it gets knocked off the network. 

Policy is Fundamental

Internal policies play an important role after devices are onboarded. The policy at Montclair State is to share content on the learning management platform, Canvas, which is private and protected by internal servers. Content posted to Canvas is only available to students and faculty who have access to that specific course. Despite clear rules being in place, there is still potential risk of violation with some adjuncts or others if they were to obliviously post videos or photos on a social media platform without written permission. That’s a clear violation of the policy putting the university at risk of FERPA violation. 

“People who use Canvas all should know that videos you’re going to share with your students should be in Canvas—not on Facebook, not YouTube,” O’Brien said. “It all has to be behind some type of authentication. This goes to all student work.”

Two teams are involved in reviewing new networked devices at Cal Poly, so they can check accessibility and security at the same time, adding a layer of redundancy to the process—a rare and important safeguard. Automated tools also monitor network usage at all stages. “Student devices are more of the Wild West,” Britton noted. Cal Poly scanners pick up those devices without reading any packets or information, but there’s still an inherent risk. “Say a student pokes a hole in the firewall, and we find out, but it’s a series of violations of university policy.”

The Responsible Use Policy defines access to Cal Poly’s IT resources as a privilege for faculty, staff, and students to support studies and official duties, further outlining rules for use. “But technology is changing so fast, you don’t realize you’re breaking the rules,” Britton said. The key is communications and open discussions. “In the academic world, you have to be more flexible, but you have to be reactive.”

Indeed, the education risks are much different than those of a commercial business or government for these reasons. As MSU’s O’Brien stated, “You can’t lock everything down and be a public institution.”

Applying Best Practices

When it comes to evaluating and deploying networked AV devices, there are a number of best practices to follow. First and foremost, “Ensure you have good governance in place,” Britton advised. “Without the ruleset, [people] can do anything they want. The governance should be to review before accessing.”

Secondly, have a review group in place, so the entire university is aware of those capabilities. Thirdly, “Audit, audit, audit, audit,” Britton said. “Manually, technically, physically, ensure devices are doing what they’re supposed to be doing and not being misused.” 

For vendors, the onus is on them to communicate what connections their devices or software make. Having great relationships with vendors is hugely beneficial. Britton cites an exceptional relationship Cal Poly has with Oblong. They directly collaborated on R&D, physically testing solutions in the university’s cyber lab, and further validating use cases in advance of deployment. 

O’Brien points to vendors like Biamp and Crestron that send equipment out for testing prior to any purchase. He also extolled the exceptional service support from Zoom, which has helped authenticate security protocols, among many other supporting efforts. 

Continuous Education 

With a technical subject as dynamic as cybersecurity, ongoing education is invaluable. Trade journals and online resources are great places to start. Britton recommends ISACA, a nonprofit global association serving information systems, as well as leading conventions and media sources like DEF CON and RSA as his top-three resources. 

O’Brien relies on a wide range of resources available to the education technology community, including NJ Edge, a local nonprofit technology partner; Internet2, a member-driven technology community founded by leading higher education institutions; and the Consortium of College and University Media Centers (CCUMC). For AV industry-specific resources, he strongly encourages every young person coming into the industry to join AVIXA, the AV User Group, and the IMCCA. O’Brien said that he has benefited greatly by participating in all of these organizations.

While the networked AV world opens up endless opportunities for advanced communications, the benefits carry a host of additional responsibilities. AV technology managers in education must continue to upgrade their skills, knowledge, and policies to meet the ever-evolving demands for data privacy.

Lindsey M. Adler is a writer, editor and journalist who produces a wide range of content about the audiovisual industry.

Ten years ago, AV and IT departments on college campuses remained distinct entities, rarely if ever having a need to work together. But with trends including IP network convergence, AV over IP, BYOD, wireless classrooms, and more collaborative and interactive learning environment, IT is present in classrooms in a way it has never been before.

With this blending of two distinct disciplines that now find themselves married, there are bound to be some hiccups along the way. With the bandwidth AV takes up on the IT network, there will be inevitable tensions between the two departments. Here, we're profiling two AV departments that demonstrate successful interdepartmental relationships with their respective IT departments.

Modern Classrooms Reflect Enterprise Trends

Tristan Cary, director of technical services at Wentworth Institute of Technology (WIT), said that although he’s been at WIT more than seven years, there are still some challenges. WIT has around 4,500 students and provides each with a laptop when they start classes. The laptop program creates a modern and interactive classroom experience where multiple users are expected to project material or work in collaborative groups simultaneously. But creating these mediated classrooms is always a challenge for the AV team. With a team of two technicians and a handful of student workers, they are responsible for over 100 mediated classrooms, six auditoria or large meeting places, and dozens of conference rooms and breakout spaces.

At Columbia University Medical Center, Jonathan Kornberg, director of instructional technology, and his team serve eight buildings, 50-plus rooms, and auditoria and amphitheaters. With 10 years in his role, Jonathan was able to anticipate the early stages of a move toward AVIT in his space and was proactive in planning for it alongside his IT team. That early planning has paid dividends later.

Kornberg said the merging of AV and IT at Columbia has exploded over last five to 10 years. He started preparing several years ago by gradually adding new switches of 1Gb or higher to accommodate the AV devices. Because beamforming, QOS and opening ports are moving quickly, these new access points are a necessity. Kornberg works to create understanding for his networking team of how AV is changing and why their cooperation and insight is critical to success. 

AV over IP convergence: What you need to know

Kornberg admits it took a long time to get everyone on the same page, and for IT to fully understand why AV needed their own subnet and VLAN. But in time, as Kornberg patiently worked to educate the IT team, they eventually developed an understanding of AV’s needs. (In other words, AV and IT must collaborate for a successful IP network convergence.) Now everything is streamlined and easy, and issues are quickly resolved with a help ticket.

At WIT, Cary reported that getting the ball rolling on an AV project never seems to be a large challenge. He believes this is due in part to the luxury of having a technical-minded school interested in advancing pedagogy with technology. The biggest challenge at WIT is not an uncommon one: getting everyone to agree and come to terms with a solution. 

When working on something of great benefit to many, such as an AV-over-IP solution, it becomes clear to WIT’s technology services staff how vital it is to advance the work and keep classrooms online. Being able to diagnose a classroom instantly over the phone rather than having to walk across a campus creates more time for innovation, experimentation, project completion, and training users on new technologies. It brings the day-to-day work down to a minimum allowing more institutional knowledge to take place, and that’s a universal win for WIT.

Best Practice: Continually educate your IT department about the latest AV technologies so they can begin to understand how vital it is to work together for success. Get their advice and input on the front end about how best to ramp up for new technology.

Practical Ways to Enhance Understanding

Physical proximity of the two departments can go a long way toward encouraging education and understanding. At WIT, AV is housed within IT, ensuring constant communication. Having a network operations team sit right next door to the AV technicians allows them to see some of the challenges and pain points. Cary noted that typically IT staff are wired to find and solve challenges—so he leveraged that close proximity, solid teamwork, and collaboration to make AV problem solving more of a group effort. 

“We started doing daily five-minute standups with our network operations team just to catch up on any issues throughout the day,” Cary says. “That brought our Help Desk, Media Services, and Network teams into a more collaborative partnership where they had a voice in how issues could be addressed to move us toward a common goal.”

Similarly at Columbia, AV used to be part of IT, so there was a good understanding of what AV was doing. Sometimes, Kornberg said, IT will simply provision the switches and VLAN to expedite things. At other times, they don’t understand exactly what AV is doing, but there is a level of trust; for example, when AV has an OS running through IT’s security protocol. In boardrooms and digital signage projects, IT has a good understanding of what AV is trying to do and is able to jump right in to problem solve.

Improving AV device security on converged IP networks

Best Practice: Schedule a series of brief sessions where members of the AV and IT departments gather to discuss issues, so that you’re there together working through problems, installations, and upgrades. It encourages more frequent communication on important issues, and builds a level of trust with day-to-day interactions.

Communication Is Key

Cary explained that one of the best ways to ensure the WIT team is working toward the same goal is to clearly define direction. The media services team works closely with AV to plan those mediated classrooms, an upgrade schedule, and a defined budget for the year, all while allowing flexibility in the technologies inserted into those rooms. 

AV has a clearly defined direction and they all work closely on what projects will be tackled next. Once projects are prioritized, they work on creating a project team, getting stakeholders involved as early as possible, and ensuring that communication is taking place at each step of implementation. Setting an example is the best way to push forward teamwork and have other teams mimic that behavior, so Cary is conscious of trying to lead the charge when it comes to communication.

Columbia’s team meets several times a year to review plans and scope of projects. The team uses a ticketing system: when it’s time to provision things, IT assigns AV what they need. As an example, things were very streamlined and quick moving to Crestron XiO Cloud; everything was provisioned quickly, even the interface on the back end happened fast. 

Best Practice: Clearly define AV direction, projects and timelines, and then set up a mechanism to communicate that to all stakeholders, whether through short, frequent meetings or larger overviews. 

Issue Resolution Strategies that Work

Working through issues and resolutions is always a challenge. Cary works to mitigate problems by getting as many stakeholders involved as early in a process as possible. He brings together IT teams, facilities, deans, chairs, faculty, and any executives who want to be apprised of the next AV project. 

Embracing IT innovations for AV applications

WIT also relies heavily on its AV partner, AVI-Pro from Nashua, NH. Having an outside partner with knowledge and insight helps find the answers to the bigger challenges. Often, it means finding the real cause of the issue. Working together to find a solution can be challenging, but it’s also an exciting opportunity to show what teamwork can do.

At Columbia, there is a VLAN hotline so IT is able to switch things on the network right away—and it can be done remotely. AV shares the Columbia University hospital network, so AV has a provisioned autonomous VLAN so there is no crossover. There are cable pullers and network installers onsite, which Kornberg calls “a huge luxury.” All these factors contribute to very rapid response times. Kornberg makes sure to show appreciation to the IT team for their responsiveness.

Best Practice: Get stakeholders involved early to mitigate issues. When problems do arise, consider having an outside partner who can lend expertise. It’s also helpful to have a process and resources in place to get issues resolved quickly

Culture Matters

At WIT, Cary emphasizes a sense of inclusion within the department, showing everyone’s opinions are valued. If a conflict should arise, Cary personally sits down with the concerned parties and listens to their potential solutions. This culture where everyone’s opinion has value has created a safe place for people to discuss different issues that arise so that they can move forward as a team.

Kornberg also promotes a culture of strong interpersonal relationships and mutual support. Webinars together are one method that’s been particularly helpful. New people in the department take time to ramp up on the culture. A strong culture starts with the leadership, and Kornberg follows the ticketing protocols so things can be tracked just like the rest of the team.

Best Practice: Create a culture where people’s opinions are valued and team members support one another. Help new people to adapt to the culture, and lead by example.

Successful AV and IT interdepartmental synergy takes some time to develop, but will certainly be a necessity to keep campus environments moving forward. Strong communication, close physical and relational proximity, well-defined processes and a culture of inclusiveness are a few of the essential ingredients to make sure AV and IT solutions continue to play well together. When all these elements are in place, it might just be an amazing marriage after all.

Say “AV” in the same breath as “network security” among AV/IT professionals and you’re bound for a lively conversation. Securing AV devices on the network for AV over IP transmission is arguably one of the last major sticking points to true AV/IT convergence, and one that presents a number of challenges to tech managers striving to adhere to their organizations’ security policies. Is it because today’s AV gear doesn’t live up to IT security mandates? Is it because IT professionals don’t always understand the quirks of AV? Yes, and yes ... and a few maybes.

Segmenting Traffic

Jim Smith, CTS-D, director of technical and application development at Sound Control Technologies, a voice and video technology solutions provider headquartered in Norwalk, CT, noted that one significant issue is that port-scanning software is often configured to recognize devices such as computers, which run on operating systems like Windows or iOS, without taking AV devices into account. 

“The typical AV device does not have an operating system [and] doesn’t have any access vulnerability, but the active scanner will report that there’s a flaw in that device because it sees a port active that isn’t on the white list,” he explained. Predictably, the enterprise security team’s reaction is to either close or block that port, or remove the device from the network, necessitating an isolated network for AV devices, which “leads to other problems [related] to data sharing and content access.”

It also presents a chicken-or-the-egg-type scenario, according to Paul Zielie, an IT and AV systems engineer and consultant based in Dallas, TX. “I personally believe in isolated networks and segmenting off AV networks as a best practice, but it is not the responsibility of an isolated network to provide device-level security,” he said. “It’s the responsibility of the device to provide device-level security, and it is very rare for that to happen.”

AV over IP convergence: What you need to know

The Cloud and Passwords

Then there’s the cloud: while it provides organizations with a convenient, and in many cases, more cost-effective approach to enterprise IT, cloud-based AV solutions don’t always make following security policies easy. “Some of the more recent devices don’t even try to integrate with anything on the local-area network—they will communicate directly out to the cloud—and that has caused me some interesting discussions here,” said Stuart Mitchell, senior analyst in the IT/AV department at ECMWF—European Centre for Medium-Range Weather Forecasts, a meteorological research and reporting institution based in Reading, England. Generally, enterprise networks require traffic to flow through firewalls and proxies before connecting to the internet, “and a lot of the equipment I’ve been playing with recently doesn’t work well in that environment. They assume connectivity directly out to their cloud configuration service, and so getting them connected to an appropriate location on a network in an appropriate way, in some cases, has been quite a struggle.” 

Passwords continue to be another challenge for AV/IT managers, since, as Smith points out, some AV equipment still won’t accommodate strong passwords or pass phrases. He also notes that some AV control and management solutions don’t make it easy for tech managers in environments where the security policy mandates frequent password changes: when someone changes a password, the interaction between the controller and target devices is often compromised. 

Keeping your converged IP network secure

Encrypting Traffic

All this said, AV tech developers are working toward improving the security of their solutions, according to Mathew Slack, enterprise AV service owner at CIBC, a global financial services institution headquartered in Toronto, Ontario, Canada. “A lot more manufacturers are embracing things like 802.1X encryption, and secure ways of communicating with devices like TLS and SSH,” he said. (However, he added that he’d like to see more documentation on how to implement the certificates required for 802.1x, as well as information on how to effectively manage large fleets of AV devices using this protocol.) Slack added that an increasing number of devices support Active Directory and remote monitoring, and SNMP and syslog are becoming more widely available. “That’s definitely helping a lot with improving the security posture of AV.”

Turning AV over IP challenges into opportunities

One area that requires some rethinking, Slack believes, is related to traffic flows; with a network-centric model, he argues that traditional AV system line drawings are becoming less important than Vision diagrams showing network traffic flows. “Essentially, every device is connecting with the network ports—we’re moving away from needing a lot of HDMI cables and SDI connections,” he said. With this in mind, he said it would help tech managers if system designers and integrators could provide drawings that illustrate all of the network-connected devices, and how they interact with one another. “[They should] show protocols and traffic flows so that the AV/IT teams on the enterprise side can use that to more easily implement these solutions.” 

Plan and Coordinate

Smith argues that improving AV device security on the network is very possible, but that it’s an exercise that requires a holistic approach. “There are network access tools that provide isolation and protection, but those have to be designed into the network,” he said. “If somebody wanted to put in an active firewall, or a border controller, or some other device that did network isolation and firewall mitigation, those can be put in.” It’s necessary, however, to account for this in the overall architecture, rather than patching in these features later on. “It’s this notion of taking an active role and making sure that the IT managers are aware of the limitations and intent.”

AV and IT must collaborate for successful IP network convergence

This requires solid communication with all AV/IT stakeholders in the earliest planning phases before a deployment. “Your solution portfolio, enterprise, and security architects should be involved before you even go to an integrator or a consultant to design a system,” Slack said. “Get them involved early and work with them to document how these systems are connected on the network. I’ve seen a lot of cases where the security and network architects get brought in very late, and it’s very difficult for them to get up to speed and provide an effective network solution that works for the AV system.

AV, IT and Security: What Can You Do?

With the AV industry slow to adopt an IT-centric approach to security, tech managers are left to strike the balance between providing their users with the technology required to move business forward while adhering to their organizations’ security policies. But when the tech in question doesn’t live up to these policies, what is a tech manager to do?

IP network convergence requires that AV pros gain IT networking skills

“The biggest ‘what you can do’ is to move the security discussion into the tender or the design phase,” said Paul Zielie, IT and AV systems engineer and consultant. “There is language that [you can apply in tender documents] that says that there will not be a sign-off to start building the system until the security criteria is agreed upon. Because what happens is nobody has that discussion: the customer assumes that the integrator and consultant have [built the system] to IT standards, it gets deployed, and they do a functional test for sign-off. Then six months later when an audit comes through, [there are problems] all over the place and the customer has to bear it. If there’s anything tech managers can do, it’s to front-load that security discussion, and to lay out into absolute measurable deliverables that can be confirmed as part of the sign-off and payment process.”

Carolyn Heinze is a freelance writer/editor. 

Volutone will be conducting a ribbon-cutting ceremony at its new Riverside location on March 28th, 2019 between 4:00-8:00pm.

The new, state-of the-art warehouse, staffed by a knowledgeable and dedicated team, builds upon the Volutone and SnapAV promise of making local distribution a reality for more dealers. This is Volutone’s seventh location across Southern California and Las Vegas. 

“Riverside will be a great resource for dealers in the area, and one we are proud to be opening,” said Trevor Hansen, Volutone president.

The 10,000 square foot warehouse will be fully stocked with more than 150 product lines. It will also feature exclusive SnapAV product lines like Wattbox, Episode, and MoIP, which will be on-display for live demonstrations. 

In addition to a same-day delivery service, which brings products directly to a dealer’s office or jobsite, the Riverside location will soon open a 24-hour Will Call. 

“Our dealers are busier than ever,” said Hansen. “Sometimes they need a product right away, and we’ve worked hard to make that happen. Our goal is to make shopping with us as convenient as possible.” 

A vast training room on-site will be able to accommodate up to 50 participants, allowing dealers to expand their product and industry knowledge through a host of trainings and seminars. This facility provides an education experience unmatched in the industry, always at no cost to customers. 

Continued Hansen, “Everything in our new Riverside location was crafted with today’s integrator in mind. From education to purchase, we’re here to help them and their business succeed.” 

Volutone Riverside is located at 3960 Garner Road Riverside, CA 92501 (909) 418-6716. 

The What: Christie has added to its lineup of LCD flat panel displays with the new Secure Series, designed for use where top security is paramount.

The What Else: The new Christie Secure Series of flat panels is designed for secure facilities including government, corporate, and military environments, and other facilities that require security at all times. Trade Agreement Act (TAA) compliant without RF functionality, the first two models available are the Christie SUHD551-L and Christie SUHD651-L.

“Government customer requirements for a professional secure display without RF is going largely unmet in the US market,” said Jim Hall, senior product manager, Christie. “This feature-rich series offers business grade features and performance at a competitive price to better meet customer needs including compliance with current TAA requirements. The panels do not have radio frequency functionality, so no unauthorized users can access the system—adding an extra layer of security.”

Crestron supported, both models come with a three-year parts and labor warranty backed by Christie’s customer service. 

The Bottom Line: Well suited for meeting rooms, control rooms, and digital signage applications, the Secure Series includes professional features such as OPS slot, UHD resolution, and USB playback in a secure, reliable, and affordable package.

The What: Zytronic has unveiled a new version of its rugged, customized touch screens is now available to support secure PIN entry applications via its development partner, Cryptera. The new PCI PTS (PIN Transaction Security) compliant product, named CryptoTouch Unattended has been co-developed with Cryptera.

The What Else: Cryptera CryptoTouch Unattended is available in any design of Zytronic touch sensors between 10 – 24” diagonal, enabling authenticated payments to be handled completely via the touch screen in ATMs, kiosks, and other payment terminals without the need for a separate encrypting mechanical PIN pad (EPP).

The Bottom Line: The solution includes an Encrypted Touch Controller and a Secure Touch sensor purpose-designed to meet PCI 3.x and EMV requirements. CryptoTouch Unattended links with a Secure Chip and PIN or Contactless Card Reader in order to allow support for offline PIN verification.

No matter what the project, an AV integrator’s directive typically boils down to one thing: enable the crystal-clear flow of information. So it’s not surprising that the topic of encrypted audio can feel a little counterintuitive in a profession that’s dedicated to optimal sharing of sights and sounds.

But the fact is that there are numerous scenarios where an AV project would necessitate the inclusion of encrypted audio. The science of making information secure in the presence of adversarial forces, cryptography makes secure communication possible. A cipher—a.k.a. a code—is employed to encrypt data, audio, or video, ensuring that those elements are meaningless to your enemies unless they hold the secret key that will decrypt them.

Encryption is not a complete confidentiality solution by itself, but it is an essential component of a larger security system. Gathered under the encryption umbrella are a range of security services including confidentiality, integrity, authentication, and non-repudiation.

In the realm of executive conference rooms, huddle spaces, and videoconferencing, an increased learning curve has emerged for the successful implementation of encrypted audio. “There is a new world for AV integrators to be aware of in terms of connecting to networks,” says Josh Siegle, wireless product manager for Shure. “It isn't like the old days where everything was hooked up with analog wires with maybe one or two boxes that would connect to a phone or VoIP network. Now the actual microphones themselves and the audio processing are on the network, IP-addressable, and software configurable.

“That brings in a certain amount of convenience and ability to repeat similar installs that work the same across multiple rooms and multiple venues,” Siegle continued. “But along with that comes the need to protect the devices connected to the network. In the network solutions space, there's a cyber security element, and one way to help protect things in that space is by using some form of encryption.”

When to Protect

According to Paul Zielie, manager, enterprise solutions, Harman Professional Solutions, there are certain projects that will have a propensity for encryption.

“Any corporate or government client should be interested in encrypted audio when the audio transmission extends beyond the known boundary of the room,” he noted. “When you start to go across or between rooms, then audio potentially needs to be protected from undisclosed people. This is especially important because, with the exception of AVB, the tendency is that these audio streams are multicast. In that case, once a stream is on a network, the network forwards it to anyone who subscribes to that multicast address, which theoretically makes it easier to discover. That’s why the gold standard when you're protecting content is to be able to control who can decode it.”

Also important for AV integrators to consider is the various states in which coded audio can live. “There's encryption in transport, in storage, and for access—each one has its own challenges and importance,” explained Bradford Benn, an AV industry veteran with more than 25 years of experience. “One of the ways that encrypted audio has become easier to deploy in AV is that people are aware of it, and the infrastructure is now able to support it. We can place it on a VLAN that's segregated. We can do it through a VPN for a certain quality of audio so that it is truly an encrypted packet, which makes things relatively easy because most of the current audio-over-IP uses current standards."

“Where it's gotten more difficult is that a lot of people make assumptions about what's encrypted and what's not, and the level of security that's actually possible,” added Benn. “For instance, imagine audio is traveling over a digital network: unless you limit the access to some of the control software, once an adversary can get on the network, they can capture the streams and mess with them—listen to or replace them. Certain protocols have a four-digit pin to prevent that, but, not to sound too nefarious, that's under a minute of a script going in and just running all 10,000 combinations and seeing what the results are. People say, ‘Oh, you're being paranoid,’ and my response is, ‘Yes, but if you're talking about a bank with million-dollar discussions, [finding] someone to do that is not a problem.’"

A Stricter Signal Path

In practice, setting up an encrypted audio path entails both fundamentals and finer points. “Typically, it is a two-ended situation where you need to have both the transmitting entity and the receiving entity synced up on the encryption keys,” said Shure’s Siegle. “If you can't do that then you’ve basically stopped any usability of that audio content. In most cases, as encryption implementation goes, it's generally a good idea to stick with a certain manufacturer depending on how complicated, big, or distributed the system is, because you know that manufacturer will support both ends of the operation. It makes it less of an unknown, versus having a couple different brands of devices and then figuring out what it takes to make those two play nice together.”

No matter the pairings and the quality of encryption employed in an installation, Siegle points out that there's a responsibility on the part of the client and/or the integrator to ensure that passwords are changed consistently. As well, firmware must be kept up to date so that solutions like the Shure P300 IntelliMix audio conferencing processor run with the latest protections against code-cracking adversaries.

“As CPU processing gets better, it becomes more viable to crack encryption algorithms,” he says. “Encryption complexity does change over time, and that's one of the reasons why you want to look at the firmware update capability of whatever you're buying, because the chances are within five years or less, a newer, more powerful encryption algorithm will be made available.”

Incorporating Encryption

For AV integrators, the ability to confidently offer encrypted audio solutions can reflect a deepened understanding of their clients’ needs, beyond the plugged-in conferencing systems they’ve worked so hard to perfect.

“You have to be privy to the fact that once things are in the network, there's ways to get to them that weren't available on the analog equivalent,” said Siegle. “As [AV integrators] look at a customer they’ve served for years, the type of business they do, and the sensitivity of what they're saying, they can make a recommendation: ‘We understand that you’re doing things with this conference room where you would not want this information to end up where it wasn’t supposed to. What do we need to do for you, the customer, to deliver a solution that helps ensure it only goes where you intend it to go?’”

Another angle to take when collaborating with clients about encryption is to confirm that it’s truly called for at all. “The AV industry has not always accounted for the additional sensitivities of the media as it's moving into business applications, versus general communications applications,” stressed Zielie. “But with the convenience of putting it on the network, suddenly we're creating risk, even if it might not be essential for it to go there. The client hasn’t necessarily thought out the risk/reward for their audio to be on the network.”

“AV integrators can ask, ‘Is it necessary? Is it worth the potential risk?’ I have nothing against there being risk, as long as it's responsibly disclosed to and understood by the people whose content needs to be protected,” concluded Zielie. “They can make that decision if they're properly informed.”

Size is not a determining factor when it comes to mission-critical control centers. Video walls can comprise just a few displays receiving feeds from only a dozen cameras, to hundreds of inputs streaming on 64 displays.

As facilities scale in physical size or the scope and their monitoring needs increase, it’s essential that the control room system can scale as well.

Darin Crosby, Global VP Sales at Datapath’s Philadelphia, Pennsylvania headquarters suggests choosing a system that’s modular so that you can start small and build out based on budget and key requirements. “This allows facilities the ability to expand easily and gradually, and in a cost-effective way,” he says.

A modular system will help scale the primary security room, surrounding crisis rooms, or huddle spaces need to access and share all the same sources from a single control point without requiring extra routing switchers.

Sharing mission-critical content from a central control room to a crisis room or another secure location is a desired feature. Today content can be encoded and securely share any source to authorized users anywhere via IP. Until recently, this has required duplicate AV equipment for each room.

Faster Decision Making

The relationship between the centralized main video wall display and control room operators has been long established. Video wall content is monitored for events, and the operator analyzes the details on his/her station display to make an informed decision to escalate an event to the next level.

New collaboration software tools enable operators to isolate a particular source from the video wall, bring it to the desktop and resize windows to help them make a decision, then share the content over IP to any location on the secure network. This enables faster decision making, especially when key people are in the field. Ensuring the signal from any source can be securely encoded over IP and sent wherever is a game-changer.

This peer-to-peer networking model makes collaboration possible without the cloud. Control center communication stays behind the company firewall and allows teams to collaborate directly without any traffic through a central server.

User Rights Management

Like an enterprise network, not everyone should have full access to every area. A video wall control system should have the ability to set user rights. “For example, certain operators might be responsible for specific sources in certain zones in a casino,” says Mark Bohs, Director of Sales for the Americas at Datapath’s Philadelphia, Pennsylvania headquarters.

There are many subsets of user rights management, and the ability to set multiple levels is critical. Making sure restricted areas aren’t displayed will help ensure an operator can’t mistakenly try to view one. “Being able to separate out your sources with a security level, and then grant access to only the right people is a critical part of security,” adds Crosby.

Sharing Software

Developed to work seamlessly with Datapath wall controllers is Quant, an intuitive software that allows users to share application windows.

Operation of critical control rooms benefit from using Quant to allow the seamless sharing of information.

Physical sources connected to the controller can be streamed to any Quant user on the network, giving them up-to-the second information wherever they are. Video wall content can be accessed by users in different locations, allowing for better-informed decisions and faster response times.

Quant also enables you to share numerous application windows to both video walls, and to other peers who are able edit the application in real time.

Users have full control to decide what to share, with whom to share and what permissions are given. The interaction with shared application windows can still be made even without the file software on your own computer.

Application windows can be simply shared using a dedicated Quant icon or the drag and drop curtain. Real-time interactivity with the same application window means changes are seen as they happen.

Quant uses a peer-to-peer networking model that makes collaboration possible without the cloud. This means all communication stays behind the company firewall and allows the clients to collaborate directly, i.e. without any traffic going through a central server. The software uses TCP (Transmission Control Protocol) as the connection and data encryption protocol.

Read more on the cutting edge video wall control.

Audiovisual systems are becoming increasingly central to global operations as they offer expanded remote management capabilities. This upward trend of AV systems operating over enterprise networks can pose a serious risk for security breaches, therefore it's critical for AV professionals to understand and mitigate these risks. AVIXA's new Recommended Practices for Security in Networked AV Systems provides guidance and current best practices for securing networked AV systems of all sizes.

"We have a responsibility to the enterprise whose networks we're on to make sure our AV systems are not enabling intrusions; that we've done everything we can to understand what's at stake and take steps to mitigate the risk for the entire enterprise," said Ann Brigida, CTS, CStd, AVIXA's senior director of standards. "There are many standards and practices that have been put in place through the years to lock down the opportunities for hackers and prevent breaches, and many cyber-security firms provide 24/7 intrusion detection. But most of the standards and guidance deal with the network itself and not the systems being put on the network. That's why AVIXA worked with subject matter experts to develop a set of best practices to keep the network safe while placing AV systems on it."

With guidance from AVIXA's Standards Steering Committee, the recommended practices were developed by a task group of security experts and technology managers from AECOM, BAE Systems, Cornell University Ithaca, Crestron Electronics, European Centre for Medium-Range Weather Forecasts, Harman, International Criminal Court, Meyer Sound, Sound Control Technologies, and PITM Consulting.

AVIXA's Recommended Practices for Security in Networked AV Systems provides essential steps to form an effective AV security program. These best practices include:

• Identifying vulnerabilities and potential threats created by the network integration of AV systems
• Assessing risk (identify, analyze, and evaluate)
• Developing a plan to mitigate and respond to identified (and unidentified) risks
• Deploying controls to continuously address and manage security risks in AV systems

To learn more and purchase Recommended Practices for Security in Networked AV Systems, visit www.avixa.org/AVsecurity. This publication is free to AVIXA Premium and Elite members.

Lumens is known for its fully featured, versatile, and user-friendly video systems. The company is leveraging those best practices to offer its community additional value. In this video, Lumens’s Chris Skaggs demonstrates their new product, TapShare, a wireless solution for instant and reliable BYOD collaboration.

VITEC, which produces advanced video encoding and streaming solutions, and ATX Networks, which specializes in optical and media access platforms, announced a strategic partnership to provide a fully secure architecture for distribution of IPTV content throughout the enterprise network via VITEC's EZ TV IPTV and Digital Signage Platform and ATX's carrier-grade UCrypt IP gateways.

"As content security becomes an increasing priority and a key requirement for any size IPTV project, this new AES content protection capability and the integration with VITEC's EZ TV Platform is an exciting expansion of benefits for customers," said Ian Lerner, chief product officer, Media Distribution Solutions, at ATX. "The addition of AES output encryption support allows partners like VITEC to have a more practical and cost-effective way to ensure encrypted streams from the UCrypt IP video gateway can only be viewed by authorized users. Together with VITEC's EZ TV Platform for managing DRM workflows, we are able to offer a secure, enterprise-grade, multiscreen experience with AES decryption for desktop users via a browser player, for TV and signage displays utilizing EZ TV end-points, and for Android and iOS users using EZ TV's mobile app."

"IP-based video distribution of live cable and satellite TV content brings a broad range of advantages for any organization seeking to cost-effectively and securely deliver high-quality content to any screen and any user in the organization," said Eli Garten, vice president of enterprise video solutions at VITEC. "VITEC's EZ TV Platform has been the architecture of choice for managing and distributing content originating from ATX's UCrypt gateways for hundreds of corporate, government, education, and sports venue customers. This latest integration enables our customers to achieve maximum protection with a simple, reliable setup that is approved by leading service providers."

VITEC's EZ TV IPTV and Digital Signage Platform automates video streaming workflows and signage campaigns over existing IP networks, allowing any organization to centrally manage IPTV and signage content from a single interface. With easy-to-use tools for signage authoring, administration, and analytics, the future-proof platform supports both H.264 and H.265 (HEVC) formats in resolutions up to 4K. The solution's hardware-based IPTV and signage endpoints feature low-latency playback, real-time updating of the electronic program guide, video-on-demand content with updating of new assets in real time, time-shifted TV, live video access via PC and mobile, and user-controlled mosaic viewing of multiple channels.

ATX's UCrypt family of cable gateways enables MSOs and service providers to secure and convert content for a variety of applications, including the secure delivery of content to commercial and hospitality locations. UCrypt's any-to-any capabilities extend across all formats, including analog, IP, and QAM.

AV managers: How secure is your security? No, this isn’t a word game or an AV brainteaser. A candid discussion of networked AV security in 2018 must start with the acknowledgement that security is itself a moving target. As AV/IT convergence continues and more facilities specify AV-over-IP designs, and as the industry moves further away from point-to-point systems, security planning for AV content and devices will continue to evolve. The goal, many AV stakeholders argue, should be a strategic approach to networked audiovisual security that pivots around the use case while staying vigilant against rogue access.

SECURE ENOUGH?

As Paul Zielie, industry expert and manager of enterprise solutions at Harman Professional sees it, the AV use case is a critical factor when thinking about security and planning more secure designs. An AV manufacturer can and should share their product’s security attributes, but to suggest that any one device is totally and completely secure for all manner of applications is misleading. “‘Secure’ is a business value judgment,” Zielie said.

“The determination of ‘secure’ is always going to be ‘secure enough,’” he added, “and ‘secure enough’ is the judgment of the risk owned by the person who would suffer the loss.” Even with traffic separated by VLANs, there will still be sensitivities, and networks must be tightly managed and controlled.

Therefore, the notion that the same AV equipment—what would be potentially secure for a sports bar versus a banking facility—is “irresponsible,” he argued. Instead, what he suggested is an honest discussion of the system’s available features and the “potential known ways that things can go wrong.” If a known risk is realized, identify and itemize all impacts. Known risks and impacts must be clearly defined.

Nic Milani, director of commercial product marketing, Crestron, concurred, suggesting that it has never been more important to have robust conversations about AV security with stakeholders in IT, AV, and pertinent departments such as facilities management. A “common friction point,” Milani said, is that not enough AV professionals are talking with the IT departments about AV security, and he is working to bring more transparency to the issue.

ONE SIZE FITS NONE

For Zielie, understanding the use case, risk profile, and how they relate to potential liability are essential elements of security planning; they cannot be underestimated or overlooked. What is required for the security of content at home versus a worship venue, versus a government or hospital are vastly different.

Indeed, there is “no one answer” for security, according to Steve Metzger, CTO and co-founder of ZeeVee, a manufacturer of AV-over-IP and RF-based distribution products. “It all depends on how you approach the situation,” he said.

Metzger shared the example of a hospital operating theater with sensitive information and delicate, ultra high definition resolution content. That tech team might invest in a purpose-built data network—an IP network just for that information. There would be basic security through “isolation and deployment of a separate infrastructure for the extremely sensitive data, and then you can control the access points,” he said.

Science meets art, however, when the AV team needs to make the data accessible somewhere else in the network; a gateway function between the networks would then need to be tightly access controlled. “You can design the network so that it is inherently secure,” Metzger said, “in which case the data itself doesn’t have to be as secure, but you have to build it in such a way that you cannot have a rogue listener appear on that network.”

On the opposite extreme, Metzger noted, a college campus might distribute streaming content from traditional sources—the network and the cable providers—in addition to local college content. In that case, you might use the data network, not a purpose-built network. Again, access would have to be exceedingly controlled. “You’re going to have to layer on a security system on top of the access method that ties into an LDAP (lightweight directory access protocol) database to make sure that only those approved listeners with their approved clients can access that data. That is an IT department-heavy responsibility for security.”

Those two examples—a purpose-built network and a college campus scenario using traditional and defined IT methods—would each require close scrutiny and protections applied in nuanced ways. Much of it comes down to, once again, the specific use case: what are you trying to do with this AV system?

Even with an active directory in place, is it secure enough? Nic Milani said that Crestron has worked diligently to focus on AV security the past few years and hone the company’s message about this important topic. In 2018 and beyond, as AV devices “become true IP endpoints,” he said, vulnerabilities will increase and application specifics must shape security protocols. Authentication will become even more important.

One methodology for authentication is 802.1X. According to the IEEE, 802.1X is a standard for port-based network access control (PNAC). It is part of the IEEE 802.1 group of networking protocols, and it provides an authentication mechanism to devices wishing to connect to a LAN or WLAN.

(MIS)UNDERSTANDING ENCRYPTION

Like authentication, encryption technologies exist for several aspects of AV-over-IP systems, and they address multiple areas of AV system design. According to the Matrox whitepaper, AV over IP Fundamentals, some products provide encryption on the command-and-control signaling to encoder and decoder devices. “This offers security against hacking the actions of the boxes—including turning streaming on or off, or switching what source is being displayed. Another security aspect is the ability to encrypt the video streams themselves,” according to the Matrox report.

ZeeVee underscored the importance of securing the video data stream, which it does in its ZyPer4K product using AES-128 encryption. “Because we are securing the data stream, this adds another level of security on top of any security measures employed in the data network design, making it ultra secure,” said Garth Leach, the company’s director of marketing.

Crestron’s Nic Milani urges AV managers to focus on the protection of information being transmitted between the endpoints, while keeping in mind that encryption evolves, too. SSL encryption, AES encryption…what’s next? The HDCP paradigm might protect content and safeguard against snooping on the network, but it doesn’t protect from diverse insider threats. Vendors must be able to keep up with fast-moving trends. It is also important to understand what devices should and shouldn’t be on the network, and identify who should be allowed to access the devices, and when. Milani added that Crestron prioritizes the AV/IT ecosystem in context, not just specs alone, when creating solutions.

A HOLISTIC VIEW

With the countless ways networked AV can be approached, how can tech managers be proactive, rather than reactive, about security?

“A strategic plan,” Paul Zielie said, “would be to understand and disclose the applicable risks to the asset owner—the asset under risk being information, in this case—and have them understand if what they have in place… adequately protects their asset. Again, it is essential to understand what the application is and the nature of the enclave needing protection. Is it a room? A campus? Are there other layers of protection required around AES encryption, which would traditionally meet the requirements of network security teams? Data in transit and data at rest on a hard drive require different strategies. The real-time world has introduced new vulnerabilities that tech managers cannot dismiss.

Furthermore, if an AV manager wanted to tie in Skype for Business into an existing system, should that meeting be “owned” by the room or a specific user? The industry has been exploring network and platform security, but “identity” is ever important as more learning, workplace, and collaborative environments migrate to the cloud.

Bottom line: “Security is holistic,” Zielie emphasized. In 2018, AV security fundamentals haven’t changed, but moving beyond the awareness of passwords and directories, AV managers need to explore smarter ways to build and protect rooms so that myriad functions—the full features and conveniences of the AV systems—are available to the right people with the right requirements for those privileges.

Where ZeeVee offers an advantage with security, Steve Metzger said, is by providing an infrastructure to tile everything together so that the individual AV integrator does not have to become “an expert” in all aspects of data and the network. “That’s part of our job: to educate and then come up with reliable, flexible solutions that interoperate. Then you can secure it without necessarily having to become a security expert. That’s how we add value as a company.”

Hackers get smarter and vulnerabilities increase every day, but Zielie is encouraged by the level of awareness and the number of manufacturers starting to implement security as required by customer communities within their products. He again urges the AV industry to think about the entire end-to-end application, not just the administration of the product and what would be considered “the network” or underlying platform security. “It’s ongoing,” Zielie said. “It’s not one and done.”

Margot Douaihy is a writer, video host, and AV storyteller. She serves as the editor-at-large of AV Technology and she teaches at Franklin Pierce University.

Do Your Security Homework

The AV Technology Manager’s Workbook to AV Security, sponsored by Harman, covers:

* Learning Objectives & Thought Leadership
* Defining the Objectives of AV Security
* Creating a Security Requirements Analysis
* How to Determine Organizational Requirements
* Analyzing the Security Risk

* Establishing a Risk Response, and much more.

A free download is available via https://www.amx.com/en-US/premium-content_workbook-to-security-and-networked-av

Security Terms

* SSL is deprecated, and the more accurate term is TLS, as it replaced SSL. TLS is an authentication and secure session protocol that can use a number of different encryption algorithms including AES.
* AES is an encryption algorithm.
* The HDCP paradigm is that any valid receiver can decode any valid source. This means that content is only protected from invalid receivers (presumably snooping on the network) but not from accidental or malicious use of a valid receiver (unused conference room).
—Source: Paul Zielie, Manager, Enterprise Solutions, Harman

Info

HARMAN
pro.harman.com/applications/enterprise

CRESTRON
crestron.com

MATROX
matrox.com/graphics/en/press/guides/avover-ip-fundamentals

ZEEVEE
zeevee.com

Nortek Security & Control (NSC) has acquired San Jose, CA-based IntelliVision Technologies Corp., a developer of artificial intelligence, smart cameras, and deep learning-based video analytics software. IntelliVision will operate as a wholly owned subsidiary of NSC. IntelliVision will continue to support its customers and products.

“This acquisition is a great fit for us,” NSC president Mike O’Neal said. “The IntelliVision team brings incredible strengths from which we will together build rich, future-ready solutions, with intelligence that will transform the NSC product line. This will extend our leadership position in security, automation and entertainment technology, with significant benefits for our partners and customers.”

IntelliVision AI and video analytics solutions provide actionable insights for security and monitoring in smart home, smart enterprise, and smart city applications; business intelligence for smart enterprise and smart retail; and advanced driver assistance systems (ADAS) for automobiles. The company’s software includes licenses for dozens of patents and has been deployed globally in over 4 million cameras from more than 50 top-tier brand customers and consumer electronics manufacturers. Customers include Comcast, ADT, Netgear, Ring, and Disney.

“We are thrilled to become part of Nortek Security & Control,” said IntelliVision CEO Vaidhi Nathan, who will stay on to lead video analytics and artificial intelligence development under the NSC umbrella. “We now have the support and resources of a major market leader. Plus, integrating IntelliVision’s AI and video analytics technologies into NSC’s security, control, and entertainment platforms will create clear leadership advantages in the markets we collectively serve.”

NSC executive vice president of marketing and innovation Joe Roberts said that IntelliVision technology will be embedded in key NSC products and systems. “The video analytics and AI technology will empower us to offer incredibly personalized control and automation solutions, and will add significantly to our security platforms. This will create important new benefits for our dealers and exceptional experiences for the end users of our products.”

Roberts cited IntelliVision’s strengths in face detection, recognition and search, intelligent motion, object detection and tracking, intrusion/perimeter watch, object classification (people, vehicle, pet), license plate detection and recognition (LPR/ANPR), and audio recognition. “For example, imagine a security or access control system that can recognize an approaching person,” Roberts said. “The system itself can provide a hands-free, multi-factor authentication that nearly eliminates false positives all while improving the user experience. And for automation, knowing who is in the room enables setting the lighting and climate scenes according to that person’s preference.”

According to Roberts, the acquisition also strengthens the company’s ongoing investments in voice and natural language technologies and significantly adds to the company’s growing patent portfolio.

Panasonic Corporation will release face recognition server software using deep learning technology beginning in July 2018.

According to the company, its high-precision face recognition software can identify faces that are difficult to recognize with conventional technologies, including faces at an angle of up to 45 degrees to the left or right or 30 degrees up or down, and those partially hidden by sunglasses.

In addition, the new software features the "iA (intelligent Auto) mode" that automatically adjusts settings for the camera to shoot optimal images best suited for face recognition. When it is used with Panasonic's i-PRO EXTREME series network cameras installed with the "Best Shot License Key" that comes bundled with the software, only the "Best Shots" will be sent to the server for face recognition. The combination of Panasonic core devices and the face recognition software maximizes the performance of the software's core engine to achieve high-precision recognition. The company plans to add a function to recognize partially covered faces with a surgical mask, which is difficult with conventional systems, by the end of this year.

Using this software with cameras equipped with the iA function enables image analysis to be performed on the camera instead of the server to send only the best images to the server. This will result in reducing server and network loads, which leads to overall system cost reductions. In the case of 10 or more network cameras connected to a system, the costs can be reduced by about 40 to 50 percent compared to conventional systems that do not use the Best Shot function.

• Last week's Integrated Systems Europe (ISE) at the Amsterdam RAI drew record numbers of exhibitors and attendees from around the world for four days of business, education, and networking. It was the largest show in ISE's 15-year history. Below are event details and official figures released today by the Integrated Systems Europe team.
• "Throughout 15 halls, visitors experienced a vibrant showcase of the latest AV and systems integration technologies, products and solutions as ISE confirmed its position as the international destination of choice for AV professionals.
• The number of exhibitors totaled 1,296, of which 294 were exhibiting at ISE for the first time. Combined, they filled 53,000-sqm of exhibition floor space. Floor space already confirmed for ISE 2019 currently stands at 103% of the total booked for ISE 2018.
• The number of registered visitors by the end of the show had reached 80,923, an increase of 10.3 percent on the 2017 edition. Importantly, almost 20,000 visitors attended the last day of the show. On a distinctly positive note, over 30 percent of the total attendees were visiting ISE for the first time, a key benchmark for exhibitors in their quest to develop new sales leads.
• Mike Blackman, Integrated Systems Events Managing Director, commented: “It’s been a great show that has delivered on all fronts. I’m delighted to report that visitor numbers and exhibitor satisfaction have both been very high. On behalf of ISE, I’d like to thank all our attendees, exhibitors, partners and our co-owners AVIXA and CEDIA. This combination has made ISE what it is today and ensures that we are able to build on our successes year on year.”
• Highlights of the show included: an Opening Address from architect and inventor Carlo Ratti that explored the evolution of smart building and ‘Senseable Cities’, nine dedicated B2B conferences covering a wide range of AV topics from innovation and design to theme park ‘night-time spectaculars’, a Stand Awards competition, ‘Tech Tours’ to three leading AV installations including the Amsterdam ArenA and five days of professional development programming curated and delivered by AVIXA and CEDIA.
• ISE 2018 also saw the debut of the World Masters of Projection Mapping competition, a joint venture between the Amsterdam Light Festival, RAI Amsterdam and ISE. The competition saw leading video artists’ project video artworks onto the EYE Filmmuseum in the centre of the city. The competition culminated in Florian and Michael Quistrebert receiving the winner’s award for their artwork Stripes 5 on the last day of the show.
• Many exhibitors once again used the show as a launchpad for hundreds of new products, technologies and solutions. Technology and business trends included: a growth in IP and the crossover between broadcast and AV; commercially viable virtual, augmented and mixed reality technologies and solutions; the increase of devices for the smart home; the divergence of digital signage with both smart systems and ‘plug and play’ gaining traction; the increase in small pitch LED displays; 4K everywhere; IoT everywhere; the growth of projection mapping; networked audio and the continued progression of the collaboration market.
• For both AVIXA and CEDIA, the show provided a unique platform for the associations to reinforce recent initiatives and to cement their key role as providers of exemplary professional development programmes.
• ISE 2019 will be held at the RAI Amsterdam from 5-8 February 2019."

Pictured: The Security Control Centre at the French terminal in Coquelles includes a 20sqm Leyard TWA Series LED, ultra-fine pixel pitch of 1.8mm video wall. Ask Jeff Von Horn, sales and engineering manager, and Joe Jackson, market manager of AVI-SPL’s Control Room Group what's the biggest AV game-changer for command and control rooms in 2018, and they both agree. “The biggest change I see is that direct view LED (DV LED) offerings from several big-name brands are becoming more prevalent and cost effective,” said Jackson. “This technology eliminates the bezel in traditional tiles or TVs in a video wall layout.”

Von Horn concurred and added more detail. “The current state of the art is 0.9 millimeter pixel pitch,” he said, “and then I have seen some below that.” A finer pixel pitch translates to better resolution but with an increase in cost. “Customers must consider the application for their design in order to determine which technology best suits their particular need,” added Jackson.

Compliance Matters

While there are various manufacturers producing DV LEDs, Van Horn explained, “we don't do much business with them if they're not TAA compliant,” something all government and some business clients require. The Trade Agreements Act (TAA) requires that the U.S. Government may acquire only U.S. made or designated country end products.

The Far Side

A finer pixel pitch means higher resolution and a higher cost. So why would a fine pixel pitch DV LED be useful for a video wall in a command and control center if operators are sitting several feet away? They wouldn’t necessarily need an ultra-fine pitch, so there would be a cost-savings if a video wall was spec’ed with 2.5 mm pitch (and everything in between).

But depending on an organization’s budget, future-proofing for higher resolution content is a reasonable consideration. “We're seeing a lot of partner activity with our wall processors supporting large LED wall applications,” said Bob Ehlers, VP of Business Development for RGB Spectrum. “Who would have ever thought that they would get so large, that 4K would blow up that large?”

One of the most obvious benefits a DV LED video wall is that it appears virtually seamless because the panels or tiles do not have bezels. Depending on the vendor, tiles can accommodate any size or shape wall, and they are not constrained to the shape a tiling of 16:9 panels would create. DV LEDs also have a high refresh rate, a wide color gamut, and they achieve “true black.”

Ehlers added, “When you have the luminosity, and a gigantic room with somebody sitting 100 feet away in the back of the room, and the screen size is so large, that 4K does still matter.”

The Near Side

Concurrent with the trend in fine pixel pitch is a dramatic decrease in the cost of 4K resolution monitors, which is helping operators in smaller command and control centers go UDH. “We're actually seeing designs now where people are coming to us and saying, ‘Well, I don't have a video wall, but I've got four workstations where I want wall functionality on those workstations,’” Ehlers relayed. A multi-windowed display on a larger format 4K display can supplant four 1080p monitors. "With OLED and MicroLED, and some of these new technologies coming along that have really true color depth and luminescence, to where you can go in and look at an image and see a black object in a black background, and discern it — it is pretty incredible.”

In applications such as video surveillance, Ehlers explained, “They use dynamic range (WDR) and are able to discern different light levels. So if I have a camera that's looking at a dark area, and I have dark objects moving through, now I can actually see it.” This type of clarity couldn’t be discerned with lower resolution displays. “The display technology keeping up with the image technology on the transmit end is enabling the use of high dynamic range (HDR),” he said. Optimizing luminescence and brighter colors is increasingly meaningful for commercial applications.

Where does 4K have the most impact right now? “On the desk, right in front of you, 4K matters probably the most,” Ehlers concluded. “But then when I get gigantic displays, 4K seems to be taking off.”

Cindy Davis is a contributing editor of AV Technology. Photography courtesy of Leyard and Planar.

The What: Peavey Electronics has launched the Dante-enabled Versarray Pro, a fully articulating line array system with ribbon drivers.

The What Else: The Versarray Pro system allows the user to select analog, Dante, or Dante with analog backup, ensuring reliable, uninterrupted performance. As a fully articulating line array, it is capable of providing maximum coverage and audio quality in a wide variety of applications. It also features Peavey’s FlyQWIK hardware, enabling quicker deployment.

The powered cabinets include network control for the advanced user as well as quick push-button control for setups where time is of the essence. Network controls include FIR filters, 10-band parametric EQ, noise gate, limiter, auto off, and all back-panel functions. The Versarray Pro also incorporates Peavey’s Mark III ribbon drivers and proprietary CLEAR FORM Waveguide to deliver optimum high-end clarity.

The Bottom Line: Versarray Pro is engineered for pro audio applications where high output, optimized coverage, and high-fidelity audio are required—especially live entertainment, houses of worship, and other expansive venues.

The What: multiCAM Systems, an integrated video production specialist serving the broadcast and professional AV markets, will unveil its first self-branded PTZ camera for live production at the upcoming ISE 2018 Show (February 6-9, Amsterdam RAI, Stand 13-F140). The hybrid IP and SDI camera line, branded as mCam, will be available for use with each of the company’s integrated production systems. This gives commercial AV and broadcast customers the option to purchase turnkey systems direct from multiCAM Systems or its global channel partners.

The What Else: multiCAM Systems’ integrated video production systems such as CONF and TRACKING are used in corporate, education, and other AV environments to capture, record, and/or stream live presentations, lectures, and events. The open design of each system, as well as MULTICAM RADIO for Visual Radio broadcasting applications, enables interoperability with most leading PTZ cameras today, including models from Canon, Lumens, Marshall, Panasonic, PTZOptics, and Sony.

While customers will still enjoy that freedom of camera choice, multiCAM Systems is bringing the 1080p camera to market with several goals in mind to reduce costs and complexity for integrators and end users. This includes planning a transition to IP that first allows customers to take advantage of existing SDI infrastructure, as well as accelerating integration times to get users up and running with their systems quicker.

“While IP is the end game for virtually all of our customers, many facilities that have consistently invested in and updated their SDI infrastructure are not necessarily in a rush to convert to pure IP,” said Stan Walbert, CEO, multiCAM Systems. “Furthermore, the lives of systems integrators are simplified when they aren’t forced into an either-or situation. mCam cameras will allow our customers to leverage their existing SDI cabling as long as they please, and even operate in a hybrid SDI and IP mode by using our IP interface to manage camera feeds and PTZ control over the network as desired.”

mCam cameras are built to make that switch between the two environments as painless as possible, supporting high color reproduction and 1080p image quality in both SDI and IP. The design features rear 3G HD-SDI connections, as well an RJ45 Ethernet jack for video signal control over the network. Power over Ethernet (PoE) capability is enabled when integrated with a standard switch.

“A facility with Cat-6 jacks on the wall can very easily run power from the central equipment room or an IT closet using the existing Cat-6 infrastructure, for example, mount and plug in the cameras, and everything they need for live production is supplied over the network,” said Paul Stewart, director of business development, North America, multiCAM Systems. “This is very useful in a situation where the end user desires a more flexible configuration requiring cameras that can be moved from room to room. It’s a very simple IP setup that eliminates the need to deal with switching SDI feeds and challenges of operating over a network.”

To expedite delivery and integration times, mCam cameras are automatically flashed with the appropriate firmware before shipping. This removes several configuration steps, which means customers can technically be operational within an hour of unboxing if the supporting SDI or IP infrastructure is in place.

The Bottom Line: mCam cameras can operate in manual, automated, or hybrid mode, and provides users with an intuitive way to easily program presets for specific shots. The design includes a hardware joystick and is interoperable with virtual joysticks built into the multiCAM Systems’ integrated production systems, both of which allows users to manipulate pan, tile, zoom, focus, white balance, exposure, and similar movements and settings.

In the professional AV industry, from ISE to InfoComm, systems integrators get a lot of fanfare. Rightfully so. One peek at SCN’s Top 50 Integrators List reveals a staggering array of talents and tenacity, not to mention the billions of dollars of value in complex AV projects. But the readers of AV Technology understand that there is much more to the AV installation story than the integrator. Day to day, hour to hour, the tech manager is the gatekeeper of AV system performance and content. The in-house tech director is in charge of the upkeep and uptime of the wireless AV and collaborative tech that helps users work, learn, collaborate, and thrive.

Margot Douaihy

We’re proud to be one of your tech manager forums. AV Technology’s mission is to bridge the knowledge gap between the AV and IT disciplines and equip you with the information you need to make the best technology decisions for your organizations. Our mission is exemplified by our January 2018 cover story, the stellar Julie Johnston, director of learning spaces Indiana University’s IT division, University Information Technology Services (UITS). In her portfolio, Julie leads the Learning Space team that consists of Student Technology Center, Technology Center Consulting, Learning Space Design, Collaboration Technologies, and Classroom Technology Services and Support. Julie has become a formidable force in the edtech world, and her Mosaic Initiative is now synonymous with exemplary active learning. Her creativity, technical rigor, and passion will inspire you. We are thrilled to share her story.

And don’t miss our January guide devoted to real-world scenarios for remote monitoring. As our contributing editor, Cindy Davis, argues: “It is no longer ‘good enough’ to have all of your audio and video equipment and systems on the network.” AV connected to the network should provide actionable information in real time for immediate troubleshooting, diagnoses, or analysis. If not, then it’s time to take a fresh look at your monitoring. Dive into this special guide on page A1.

We explore the opportunities and challenges faced by AV pros as they phase into IP broadcast. We always keep a practical side to our coverage, evinced by Nestor Amaya of Coveloz. “We’re definitely not taking the position that it’s go IP or go home. Different distribution platforms require different post-production workflows, and these are more easily implemented using software-based post production applications running on IP.”

IP was central to the AV conversation in 2017, in 2018 the AV/IT convergence story promises to be even more important. I hope you see your own questions, challenges, and passions for technology reflected in our coverage. What do you want to see more (or less of) in 2018? Tweet me @AVTechnologyMag. Best wishes for a rewarding 2018.