This document discusses cyber security best practices for media organizations. It notes that hacking and espionage are not new threats, and that organized cybercrime is now worth more than the global drugs trade. The document outlines advanced persistent threats faced by UK broadcasters and financial institutions. It recommends developing practical security policies, mandating scanning and patching, and installing security information and event management systems to monitor for threats. The document also discusses new regulations like the General Data Protection Regulation and the need for organizations to adapt security practices to address evolving threats like ransomware and phishing.

1. Cyber Security Best Practices
EBU/FNS – RTÉ
27/09/2016
John Moylan

2. “Breaking bad habits”

3. Hacking and espionage are not new
Al-Kindi, 9th, Century AD
Cryptoanalysis by frequency analysis

4. Organised Cybercrime
Worth
more than the global drugs trade
USD$3T
(2013 Europol report)

5. Advanced persistent threats
the ones we know about..
2016 – ”GCHQ sees off..cyber attack on UK
broadcasters”
2016 – Swift Hacks – Ecuador, Bangladesh,
Ukraine (USD$12M, USD$81M, USD$10M)
2015 – TV5 Monde attacked
2014 – Sony hacked.. allegedly state sponsored

6. FBI
in the not too-distant-future we anticipate
that the cyberthreat will pose the greatest
threat to our country," FBI Director Robert
Mueller (2012)

7. Catch up
The Risk Profile has changed
• GDPR
• NIST
• Ransomware
• CEO Fraud
• Phishing
• DDOS
• ...

8. Focus
"When a man knows he is to be hanged... it
concentrates the mind wonderfully" - Samuel
Johnson

9. Putting flesh on bones

10. Real Examples
• Internet transcoder
• Vulnerable services – no patches
• Default passwords – not possible to reset
• All network attached equipment needs
QA'd and monitored

11. Develop practical Policies
• Mandate scanning and patching
• Helps Avoid:
• Putting your systems at risk
• Putting your users at risk

12. MCS
Publications
• R141 – Mitigation of Distributed Denial of service
attacks
• R142 – Cybersecurity on Connected TV's
• R143 – Cybersecurity for media vendor systems,
software and services
• R144 – Cybersecurity Governance for Media
Companies
• R145 – Mitigating Ransomware and Malware
attacks

13. MCS
Cyber Security representatives from the majority
of EBU members.

14. OWASP
The Open Web Application Security Project
"not-for-profit charitable organization focused
on improving the security of software"

15. Install a SIEM
If something is happening you need to know
about it!
Sed and Grep do not a SIEM maketh!

16. Keep up with your options
• Increased Phishing Activity
• Solution: Education and 2FA

17. GDPR
• Does your company have a DPO?
• How do you manage email?
– Attachments?
– The Cloud?
– CCTV?
The test is 'Can the data harm the individual or the
company?'

18. New Regulations
General Data Protection Regulation(GDPR)
(Regulation (EU) 2016/679)
Protects Personally Identifiable Data
Max. fine of either 4% of global turnover or
€20,000,000 (whichever is highest)

19. What can I do?
• Make Security a board level issue
• Keep auditing for weaknesses
• Educate and Communicate
• Keep monitoring

20. In Summary
Security is evolving, change is the only
constant. Old habits need to be broken to
adapt to the new reality