Over the last few years, the audiovisual integration industry has become increasingly more aware of networked AV security concerns, largely due to some vulnerabilities discovered in control system touchscreens and wireless presentation systems. Manufacturers have answered with firmware updates that patch the vulns, and AVIXA released Recommended Practices for Security in Networked AV Systems in July 2018
Despite these efforts, many #AVTweeps are still calling for networked AV security standards and industry leadership. We can’t just sit back and wait for cybersecurity researchers to tell us about the next zero-day vulnerability. We need to take a proactive approach and work together to leverage our knowledge. [related]
So how do we get started?
One idea would be to launch an open group that anyone can join, like the Ad Hoc Committee on Responsible Computing Group, who publishes a regularly updated document called “Moral Responsibility for Computing Artifacts”, more commonly referred to as “The Rules.”
Or we could take a more formal approach and follow the lead of the Payment Card Industry Security Standards Council (PCI-SSC) which is an independent body that was created by major payment card brands.
The PCI-SSC sets the Payment Card Industry Data Security Standard (PCI-DSS).
That approach might work for AV manufacturers, but it might also inadvertently leave out integrators, consultants, distributors, IT professionals, and AV support personnel that work inside of organizations. All of these groups make up the AV industry, and each has their own priorities.
To involve all of these parties while still maintaining some order, I suggest a three-tiered approach:
Cybersecurity Leadership at the Industry Level
At the top tier would be a Cybersecurity Council led by audiovisual industry associations like Avixa and/or NSCA, who would work to develop standards and promote best practices in networked AV security.
The Cybersecurity Council might host annual or bi-annual 1-day or 2-day virtual conferences, where speakers and panel discussions could address market-wide security concerns.
The Council would promote cybersecurity awareness, as well as the adoption of industry-specific cybersecurity frameworks.
Cybersecurity Alliances at the Company Level
At the next tier would be Cybersecurity Alliances, which would be groups of companies that have similar interests and business models.
There could be a Manufacturers’ Alliance, an Integrators’ Alliance, and an End-Users’ Alliance (we will have to think of a better name).
AV consultants and distributors could have their own alliances, or they may fall into one of the other Alliances to keep things simple. The main goal here would be for similar companies to share threat information and strategies, much like the National Cyber Security Alliance (NCSA), who aims to make the internet safer and more secure for everyone.
The Alliances could host quarterly online meetings, but could also alert each other when they are attacked, or when a vulnerability has been discovered, as many AV companies utilize the same OEM technology.
Cybersecurity Teams of Individuals
The third tier would consist of teams of individuals, from any of the above Cybersecurity Alliances, who would focus on specific aspects of cybersecurity.
There could technical teams made up of CIOs, CTOs, programmers, and technicians who focus on recent exploits, risks and vulnerabilities, cloud security, network design, data protection, application development, access controls, forensic analysis, cryptography, incident response, intrusion detection, cyber-physical systems, databases, or web security.
There could also be non-technical teams who would be focused more on laws and regulations, procedures, and policies. They could work together to train employees, update documents, conduct risk and liability assessments, develop industry bug bounty programs, or share ransomware response plans.
Listen: The Big Picture of Access Control & Where It’s Going: Episode 37 of AV+
The goal of this column is not to dictate what I think should be done, but rather to present a potential framework to use as a basis of discussion. My hope is that individuals within the AV industry will talk to Avixa and/or NSCA at Infocomm or other events, and maybe these ideas will get some traction by 2020.
