Secure AV systems start with smart design. Here are some standards that’ve been around forever but easily apply to modern audiovisual projects.

This article was originally written by Paul Konikowski, and published on Commercial Integrator on March 1, 2019

In my last CI article, we reviewed cyber threats and vulnerabilities in AV systems. Many of the known vulnerabilities, or “vulns” can be fixed with a firmware upgrade, securing your network, and/or enabling passwords; but what else can AV manufacturers, consultants, and integrators do to achieve secure AV systems?

One thing that can be done is to adopt a secure mindset from the get-go when designing secure AV systems, keeping the following design principles in mind.

These principles were outlined by Jerome H. Saltzer and Michael D. Schroeder in an IEEE paper way back in 1975. We will apply those secure design principals to AV systems here.

Economy of mechanism

Keep designs simple, which also means keeping your programming code as small as possible, making it easier to test and analyze. Simpler design means that less can go wrong.

Fail-safe defaults

The default access to a resource should be no access. A good example of something that violates this principle is a wireless router that does not require a password and/or encrypt the traffic by default.

Complete mediation

This means every access to a resource is checked against the access control mechanism, every time, and all attempts to bypass security are prevented.

Open design

“Security by obscurity” does not work. Adapt an open-source attitude so your security does not depend on secrecy. Code and designs should be open for scrutiny by your community. It’s much better to have a friend or colleague find an error, then it is to wait for a bad actor to discover it.

Separation of privilege

Access to rooms, systems, or files should depend on more than one condition. If someone gains access to the AV rack, can they simply access the components using a console cable? Or did you go a step further, and enable passwords, as well as encryption of those passwords?

Least privilege

Users (and programs) should only be given the minimum access rights to complete their tasks. The default access should be none, and then access should be granted as needed, on an individual basis, or based on well-defined roles within the organization. Temporary access can also be granted.

Least common mechanism

This means that one should minimize the amount of mechanisms and/or equipment that is used by more than one user. A good example of this would be a “room PC” in a training room used by multiple instructors. Does each instructor log in with their own credentials?

Psychological acceptability, a.k.a. ease of use

Users will avoid security measures that get in the way of convenience. A physical analogy would be a dead bolt that requires a key on both the outside and the inside. Some people won’t bother locking it from the inside, especially if their key gets stuck in the lock.

Other best practices like layering, isolation, encapsulation, modularity, and auditability should also be kept in mind.

If you enjoyed this article, you might like these related posts on PKaudiovisual:

Identifying Cyber Attacks, Risks, Vulnerabilities in AV Installations

5 Steps to Better Cyber Risk Management

The Best Data Breach Incident Response Plans Require These Steps

Leaving Las Vegas: Why InfoComm Should Also Visit Seattle or San Francisco, Where AV Innovation Is More Than Just Stagecraft

By Paul Konikowski, CTS-D

I was honored to be a special guest this past Friday on AVweek, a weekly podcast produced by AVnation.tv that discusses current events of the audiovisual industry. After the podcast, the other contributors and I started talking about how the annual CEDIA expo may smell a little different this year, as this September, CEDIA expo-goers would now have the liberty of trying some of Denver’s new, umm, legislation…

I started to think about all of the cities where I have attended conferences geared towards audio and video. I have traveled to Philadelphia, PA for EduCause; Amsterdam,NL for ISE; Anaheim,CA for InfoComm and NAMM; Indianapolis,IN and Denver,CO for CEDIA; New York,NY and San Francisco,CA for AES; and Orlando,FL for Infocomm. And, of course, Las Vegas,NV for both CES in January (when the weather is kind of nice), and the Infocomm in June (when I sometimes wonder if I died in my sleep, and then woke up within the inner circles of Dante’s Inferno.)

Whenever I get back from these conferences, and I am inevitably reminded of the advances in technology taking place where I live on the Bay Area. One might even argue that the bulk of American technological innovation comes from Silicon Valley, San Francisco, and Seattle, and that the rest of the country is simply trying to keep up with the West Coast (with extra emphasis on the word argue, as I sure many hipsters in Brooklyn or Austin would be terribly offended by my statement. If you are one of the offended, then I suggest you go buy yourself a RumChata, and you will feel better.)

So why is the Infocomm Show held in Las Vegas, anyway? I think the main reason is logistics. Las Vegas is more centrally located than most of the other cities I mentioned. The Las Vegas Convention Center is certainly large enough for the Infocomm Show, and there are plenty of hotels and restaurants for meetings. AV manufacturers and integrators based in Southern California can simply drive their gear to Las Vegas. Others from around the country can easily find flights to Vegas.

There is also the wow-factor and live performance aspect of Las Vegas that can not be matched in other cities. Between the Cirque du Soleil shows and purpose-built concert halls, there are plenty of places for manufacturers to host after-hours events; not to mention all of the bright lights and video screens: all help to remind AV folks exactly how big of a deal AV can actually be, when there is adequate budget.

Still, I can’t help but wonder, why not host an Infocomm Show in San Francisco, Silicon Valley, or Seattle? Isn’t the Infocomm Show supposed to be a gathering of the vibes for the AV industry? If we are embracing the so-called AV/IT convergence (where audiovisual meets information technology, hangs out, and has a few beers), why isn’t this annual AV trade show hosted someplace where Information Technology people hang out?

Again, I know in the end it’s probably about logistics, and if that is the basis for choosing the location for InfoComm, well then I will never win this argument. Hotels and flights to the San Francisco Bay or Seattle would certainly be much tougher for AV folks, especially those on the East Coast. But flights to Orlando are not easy for anyone on the West Coast, either. Food and drinks are much more pricey in the Bay Area, and the convention centers are just not as big as Vegas. But that is exactly why we need to put logistics second, for at least one year, and put technology first.

If Infocomm was only about logistics, and keeping costs down, we might as well host the entire trade show online. Each booth could have a five or ten minute video showing their new products, with live Q&A available for engineers like me who ask way too many questions. Virtual meetings could take place using Google Hangouts, and participants could simply scan a QRcode or “click here” for more information from a given manufacturer. The classes and seminars that are normally offerred at Infocomm could be accomplished using on-demand webinars and online testing. But we all know the Big Show is much more than just business meetings, educational seminars, and seeing new products.

Infocomm is about synergy. It’s about the random person you meet on the monorail who happens to know so-and-so and suddenly the two of you are discussing a current design challenge or potential project. The energy and excitement of meeting new people and gaining new skills, while seeing old friends and past co-workers is what makes the Infocomm Show so awesome, and that is precisely why it needs to happen as a live event each year. Infocomm gets us out of our shells and the shear fact that you are not back in your office or on a job site doing an installation, means you can focus more on learning (I know, I know, easier said, than done).

It’s that same synergy that has convinced me that there needs to be an Infocomm Northwest. Every time I go to a trade show, I notice that many of the attendees are locals who, if the show was located in another state or country, simply could not attend. The same is true for employees of the information technology and internet-based companies in Silicon Valley: many of them do not have the time to travel to Las Vegas (despite their unlimited vacation), BUT if that same Infocomm show was located in the Bay Area, they might be able to attend for a day or two, without impacting their work load, or their Burning Man camp planning. As Kevin Costner learned in Field of Dreams, “if you build it, they will come”.

Let’s take a company like DropBox, for instance. Many AV installation firms use Dropbox as a way to share files, yet DropBox probably has no idea that Infocomm even exists! This example can be expanded to almost all IT, software, and internet based technology that is born in the Bay Area or Seattle. They don’t know there are audiovisual consultants, because we are nothing in comparison to the larger information technology business model they are used to dealing with. We need to change that, and get on their radar, before the entire AV industry goe the way of the wireless microphones based in the VHF and UHF channels, now banned from use due to changes in the IT sectors.

So I say, “Hey Infocomm, let’s leave Las Vegas, maybe not for good, but for at least one year.” Let’s host an Infocomm Northwest here in the Bay Area or in Seattle, where technology is being born, not chased. Wouldn’t you rather travel to Northern California or Seattle in June? Let me know your thoughts in the comment section below, via Twitter @pkaudiovisual or send me an email to pkav.info at gmail.com.

Yes, I use gmail; don’t you?

Tag: Information Technology

Design Principles for Secure AV Systems