Preparing for digital signage 6: Security

This article is the sixth in a series concerning the choice of the network architecture of its digital signage system, if you do not fully understand the concept of digital signage, or are not familiar with the various existing architectures, start with this article: Digital signage: be well prepared. If you missed the previous article, check out: Get ready #5: Connectivity and bandwidth

At a time of watches, connected cars and the rise of cloud solutions, the question of the security of such systems is a recurring problem. Such considerations do not spare digital signage, and are often at the heart of decisions concerning the choice of the model of digital signage, especially when the use is devoted to internal communication. Security in a digital signage system, like everywhere, is above all a matter of compromise. Is the customer ready to sacrifice functionalities, speed of execution and ease of use in favor of greater security?

Security in a digital signage system, just like in any other information system, is a complex concept, based on a relationship of trust with the provider. It is a subjective concept determined by the strategy of the client company and what it deems to be The worst consequence of an action attributable to a lack of “safety”. In the specific case of digital signage, the main concerns of corporate customers are, in general, the following:

• The image of the company, authenticity and consistency of the content displayed.
• Data confidentiality and corporate content.
• Integrity and inviolability of the company's information system.

Although the SaaS model is often criticized for its problems of “safety” and the popular hosted (on-premise) one, it is difficult to draw conclusions based solely on this alone, as there are so many different implementations, each with its own specificities. By focusing on these main concerns, it is nevertheless possible to Lay some foundations, but also to raise certain questions.

‍

Overview of digital signage

As a reminder, a dynamic signage system, reduced to its simplest use, can be summed up by the following case: A communicant wants to broadcast a message on a screen. This message is in the form of a file (image, document, video). From his workstation, he sends this file to the servers of the digital signage system. At the time of the broadcast, the server sends this file to the player responsible for the broadcast. The player reads the file and broadcasts the message. This case, although simplistic, involves several devices (and people), Each Likely to Present Security risks In View of the Concerns of the Company.

The Image of the Company

Digital signage is a communication tool. As such, like all communication tools, It conveys messages that engage society and contribute to building its reputation.. These messages broadcast Represent the Company in relation to the target audience. So these messages should be those (and only those) That the company decides to send, Without Any Alterations, accidental or intentional. However, numerous alterations can occur between the sending of content by the communicator from his workstation and the broadcasting on the display players. If the implementation of a model hosted (on-premise) Suggests the elimination of this problem, In fact, it only reduces its scope To a physical presence near the company. In order to ensure that the contents are authentic and unaltered, the customer will take care to check with his service provider. (or to ask for the establishment) The following points:

• Is the task of creating and distributing content assigned to the same person?
• Is the person in charge of distributing the content reliable?
• Does she have a good knowledge of the software?
• Is she the only one who can broadcast content?
• Does she share her login details?
• Is a robust password policy in place on the management software (use of special characters, numbers, minimum length, frequent change...)?
• Are passwords stored on a post-it note?
• Does the software implement a policy of File signature ?
• Are the files to be broadcast Signed ?
• Are the software and systems used by the player reliable and up to date? Do they have vulnerabilities?
• Are the screens physically accessible?
• Is remote control activated? In an extreme case, where the content would be altered, is a backup solution in place to stop the distribution of this content? Is a record of the author of the broadcast available?

Thus, in the case of using file signatures, the threats are located at the level of the broadcast player, the management software (and the person or persons responsible for the distribution). The choice of the model of the display system is then of little importance.

Data confidentiality

Depending on the target of the messages broadcast, Content may require a high degree of confidentiality. Indeed, releases may reflect strategic documents or results whose public dissemination could cause harm to the company. Ensuring that this content is confined within the company is then a priority..

However, for the digital signage system to work perfectly, It is necessary to store the content to be broadcast on the server Of the system (or at least to transport). At first glance, the implementation of a model hosted (on-premise) Suggests a confinement of data on the internal network and therefore a high degree of content protection while a solution SaaS Suggests the opposite. In both models, particular attention should be paid to the reliability of the management software, the person who uses it, as well as to the policy (and memory technique) Passwords.

It is also important to ensure that communications between the management software and the server are properly encrypted, especially in the case of a model. SaaS Who borrows the internet. It is also necessary to pay attention to data storage, and therefore to the system server.

• Is it located in the client company (hosted model (on-premise)) ?
• In this case, is the server accessible to anyone? Is it guarded at night? Is it located in a data center (in most SaaS models) ?
• In this case, is the data center located in a country governed by laws that allow data collection?...

Finally, it will be a good omen to ensure that communications between the server and players are properly encoded and that broadcast players are not subject to exploitable vulnerabilities.
Some solutions implement a service for encrypting files to be distributed.. These are encrypted beforehand, on the communicator's computer, and stored Encrypted on the system servers and then sent to the broadcast players, only to be able to decrypt files before reading them. In this case, The physical protection of players must also be ensured.

The integrity of the information system

A company's information system is now the backbone of many companies. It is based on numerous services that allow the company to live and evolve.. A digital signage system requires the installation of equipment that requires the ability to communicate with each other, often via the company's internal network. Moreover, these players are rarely accessible by the customer and constitute for him a black box difficult to control. These black boxes may have reliability flaws or vulnerabilities that could be exploited to penetrate the corporate network, both in the case of an architecture SaaS, whathosted (on-premise). (In the latter case, physical proximity to the company is nevertheless necessary to exploit these vulnerabilities).
Particular attention should therefore be paid to the vulnerability of broadcast players.

• What system do they run on and what services do they run?
• Are they up to date? Do they have exploitable flaws?
• Are they physically accessible? Is it possible to take control of it by plugging in an external device?

In the case of models SaaS, it is often necessary toOpen ports on the company's firewalls to allow players to join the provider's servers. In which case the vulnerabilities could be exploited from outside the company. In this case, The question of the reliability of the server is again in order. If it is possible to take control of the server, then secure communications between server and players as well as the means of securing the player would be ineffective. However, a precise configuration, (but complex) of company network equipment can contribute to significantly reducing the risks ofintrusions and compromising the integrity of the local network.
However, the customer can set up a local network distinct from the one used for its services, either physically (different cables, different routers...), or virtually, using, for example, VLANs. The service provider can also set up the alternative of using third-party network equipment, such as 3G/4G routers that connect players to the Internet without going through the company's internal network.

Conclusion

So, if the misconception that only a hosted model (on-premise) offers “of security” is difficult to verify, it is true that it is this model that makes it possible to implement satisfactory security mechanisms in the simplest way, and at the lowest cost. Whether it is possible to achieve equivalent levels of security via an architecture SaaS, the solutions to be implemented are often more complex. Whatever the architecture chosen, it is necessary to pay particular attention to the global security policy andidentify sensitive points in advance, in order to prepare security solutions, in collaboration with the service provider, before installing the first equipment. Other issues such as Data loss, Continuity of broadcasts, the availability of the management interface may also be part of the concerns, in which case it will also be imperative to identify them as soon as possible in order to put in place the right solutions.

Continue reading the file:

• Getting ready #1: Hardware
• Preparing #2: Time and effort to set up
• Getting ready #3: Technical Support and Maintenance
• Preparing #4: Training and getting started
• Get ready #5: Connectivity and bandwidth
• Preparing #6: Safety
• #7: Usability and scalability
• #8: Prices and pricing
• Summary: Preparing for digital signage
  

‍

 Cenareo offers an intuitive, scalable Saas solution and perfectly adapted to the needs of communication professionals in all sectors of activity: Points of Sale, Internal Communication, Hotels and restaurants But also DOOH.