Game of Pwns: Security lessons from the latest HBO hack

Trial by Combat

With streaming services like Netflix and Hulu leading the way, the global entertainment industry is now worth around US$2 trillion, equivalent to the combined value of the world’s top 10 banks. HBO by itself generates around US$6.4 billion in revenue, with Game of Thrones being its most popular series. Therefore, it is no surprise that professional hacker groups are increasingly targeting major movie and television studios.

In 2014, a group of hackers known as the Guardians of Peace, infiltrated Sony Pictures and spent at least 2 months inside their network—copying critical files and stealing up to 100 terabytes of data. The group demanded that Sony halt the release of the major motion picture— The Interview— threatening terrorist attacks and eventually causing Sony to cancel the film’s premiere and mainstream release. Just a few months ago, Netflix was hit by a ransomware attack from the Dark Overlord hacker group, which ultimately leaked an upcoming season of the hit show , Orange Is The New Black. Even HBO is no stranger to these types of attacks, with the first four episodes of Season 5 of Game of Thrones leaking out to BitTorrent before the season premiere.

Where Are My Dragons?

The entertainment industry (along with most other enterprises) needs to update its security model to reflect the reality of the modern IT ecosystem. Many organisations still focus on perimeter defenses – firewalls, intrusion detection systems, and Network Access Control. But perimeter defenses are only effective in protecting data inside the network. What happens if, as was the case with Sony, your network is compromised? And more importantly, how do you continue to protect the data once it leaves your network?

The good news is that all of the technologies needed to protect against these types of attacks are already available from companies like BlackBerry. Enterprise File Synchronization and Sharing solutions are used by several entertainment companies to securely share encrypted files and control digital rights even after the files leave their network. Using secure communication solutions means that it is safe to communicate with external parties over secure channels, be they email, text, phone or instant messaging. Unified Endpoint Management (UEM) solutions are also key in centrally securing and controlling all of IT endpoints, including desktops, laptops, mobile or even IoT devices. And finally, cyber security consulting services can be used by organizations to assess their defenses, bringing “ethical hackers” into their environments to simulate a real-world attack.

If Game of Thrones has taught us anything, it’s that enemies will always try to find and exploit our biggest weaknesses, be they physical, mental or in this case digital. And just as in the hit HBO show, our goal isn’t to make our defenses impenetrable, it’s to make them strong enough that hackers simply move on to easier targets. In the end, enterprises and individuals who adopt this rational and economic approach to risk management will have the best chance to survive the digital winter.