>> Announcer: Live from Las Vegas, it's theCUBE. Covering NAB 2017. Brought to you by HGST. >> Hi, welcome back to theCUBE. We are live in Las Vegas, at the NAB Show 2017. I'm Lisa Martin, and I'm very excited to be joined by our next guest, Ted Harrington. Ted you are the executive partner at Independent Security Evaluators. Welcome to theCUBE. >> Thank you for having me. >> Absolutely, we're excited to have you here. We're very excited also, because Ted has a very cool Twitter handle, @SecurityTed, super cool. So you are with Independent Security Evaluators. Tell us a little bit about what the ISE is. You were the first company to hack the iPhone and the Android, give our viewers a little bit of a backstory on ISE. >> Sure, so probably the simplest way to think about it is that we're the good guy hackers. Companies hire us to help them find security flaws and remediate those flaws in their technologies. And so we do that across a number of industries including heavy, prominent presence in the media and entertainment business. We also have a pretty strong focus on security research. Which is what you're referring to with the iPhone and the Android OS. We also, even the company came out of what is today known as car hacking. We found a way to build a weaponized software radio that we could start a Ford Explorer without the authentic key. >> Lisa: Wow. >> So we're tinkerers and problem solvers and we like to find issues before the bad guy does. >> And that's a great point about being the good kind of hackers, but also being able to highlight that these security challenges are real, across industries, and be able to I presume, influence or help companies, whether they're in media and entertainment or other industries. Understanding what is the type of cyber security protocol that we should be putting in place here to prevent the bad hackers from getting in. >> You hit the nail on the head. The core emphasis of what a security assessment with us entails, really is focusing on the technology problems, the deep technical issues. But at it's core, where all of these issues come from is the presence or lack thereof, of an effective mission. Many security, many companies when they think about security, are thinking of it as something that would be nice to have, not as a core business requirement. And changing that attitude is something that we spend a lot of our energy trying to influence. Because the companies that see security as the business enabler that it is, those companies are doing some tremendous things across industries today and they're really being the pioneers that are leading. >> One of the things that I was reading recently was what happened to La La Land, where screeners were leaked and fairly prolifically, and obviously that was a big massive box office hit, nearly a Best Picture winner, a few months ago. But I've also read reports where a leak like that can really negatively impact box office sales, like upwards to 20%. So if you look at a studio for example, and you were kind of saying, that maybe in general security is viewed as a nice to have. Is that a strong enough demonstration of the vulnerability of say a studio to make them go, "Okay, we need help here. "There are vulnerabilities we might not even be aware of." Are you seeing more uptake in the media and entertainment industry? Or is security still a, "It's a good idea "but we've got other things to focus on, "creating really, really cool content." >> The media and entertainment business, I think, does a fairly good job of prioritizing security. Now, of course, across the spectrum there are things that we would advocate doing better or in different ways, but the business driver that you mentioned, the idea of avoidance of box office decline. That's the core fundamental problem that we're trying to solve for the content owners and their vendors, because that window, the theatrical release, from a revenue perspective is the most important moment for, especially the blockbusters, La La Land, no one necessarily knew was going to be a blockbuster, before it came out, but when you look at things like, the next Star Wars, the next Avengers, the movies that are definitely going to make huge amounts of revenue, making sure that that movie makes it to the theater, without being released, that is the top priority for many organizations in this industry and we see a lot of organizations doing it well. >> That's good because the IP in that alone, for a company, the next Star Wars, the next whatever happens to be, the intellectual property that that studio owns, is probably nearly invaluable. So having the right strategy around that is key. Wanted to pick your brain, I know that you have started the IoT Village, and as we look at this proliferation of connected devices, the audience, we we're chatting earlier before we went live, the audience, you know, we're so empowered. We can make decisions, we can watch whatever we want whenever we want, from 35,000 feet in the air. We're binge watching, we're sharing on social. We've got multiple devices. Where that's concerned, and also you mentioned content, that's also not just a way that we're consuming content, that's a way that we're creating it. How, what is the IoT Village all about and is it down to the level of helping media and entertainment companies start providing security across the connected devices that are consuming and creating the content? >> We started IoT Village as a security research platform. Basically where, we invite other smart security researchers to help us focus on the problem of security issues in these connected devices that are being deployed. Everything from people's homes all the way to businesses and like you said even to the creation of content and consumption of content. The reason that we wanted to put some emphasis on this problem is that, that's an industry that I think, maybe by contrast, to some of the things we've talked about with media and entertainment, that still has a ways to go, in terms of how it's thinking about security. Security is not a priority in the development process for the majority of organizations in that industry. Now, there are definitely some that are doing it right, but they're more the minority. So what IoT Village does is helps us shine a spotlight on those issues. To connect the dot full circle, to what you were talking about, with media and entertainment, this is a conversation that I don't think, is happening loudly enough in this industry. Connected devices are being deployed for, a lot of the cases you said, consumption of content, for creation of content. Even for things that people don't necessarily equate with the process, like, the TVs that are used to screen the, whatever version is being reviewed right now, in the conference room. Those are often smart TVs with an internet connection and there's not necessarily an adequate control in place around how to think about the security implication of that. Fundamentally, connected devices expand the attack surface, and that's the way the organizations need to think about it. Not to say that they should not deploy those devices, but that they need to adequately consider that in the security model. >> Absolutely, and how does an organization get control over that, over those devices? >> Well, like any technology that's developed by a third party, one who procures that technology, can only do so much. You can't actually get into the source code, or whatever, unless that organization wants you to, but there definitely are things that organizations can do in a deployment model, to mitigate risk. So, those would be things like ensuring you have proper segmentation, where the highest risk types of devices are quarantined away from areas where the biggest, most impactful compromise could potentially exist. To absolutely implement a threat model, which is an exercise through which an organization identifies what you're trying to protect, who you're trying to protect against and how those adversaries will deploy their campaigns. >> Question for you about the devices now that are popping up in our homes, right, the Google Home, the Amazon Echo, as an owner of those, there's very little control, right? That an owner or a user has over those devices, any recommendations or insight into what can be done on the vendor side to, those devices listening all the time, right, that's their job, any insight there into recommendations that can be taken to help make those a bit more secure? >> So for the person who purchases and deploys that device, there are a handful of things you can do. First and foremost, change the default password. Seems like I should not have to say that, yeah. >> Yeah >> Change it from admin password. >> Yeah. >> But you'd be surprised how few people actually change the default password, and the default password is effectively publicly available information. There was a very significant distributed denial of service attack that happened in October, that basically took the internet offline for a few hours. >> Yes. >> And that was completely mobilizing connected devices that had not changed the default password. Attackers took them all over and then used those in the attack. So, change the default password. Check for updates to what extent that you can, and really think about whether or not you might need the connectivity of a certain device. So, for example, we talked about a moment ago, the smart TV. There are a lot of people out there, who buy a TV, not because they need the internet connectivity to it, but because they want to consume content. If they're not going to use that connectivity, turn it off. Effectively, all that it's doing if you're not using it, is introducing new ways to be attacked. >> So there's some simple remedies that, either people or industries can take for their internet of things or connected devices to be a little bit more secure? >> Yes, however, the real crux of the solution, definitely relies on those who manufacture the devices. So, manufacturers of connected devices need to do things like adopt an adversarial mindset. Think about how someone will attack this system. They need to think about things like, how are you going to update this system over time, especially given the fact that the average consumer of this device, probably is not technical, and probably will not proactively go on to be dealing with updates. They want to set it and forget it. So thinking about those things from that perspective, adhering to principals of secure design, going through security assessment, really looking at your system in terms of how it can be broken, that's how you build it to be resilient against attack. >> Wanted to ask you one final question about laws and regulations, what are you thoughts on that? Is that something that can either help a film studio protect their IP, all the way down to helping those of us that have at home connected devices? Laws, regulations, good, bad, indifferent, what are your thoughts? >> I'm very strongly not a proponent of regulation as a security measure. Laws and regulations, what winds up happening, they take too long to enact. The adversary has already evolved away from whatever the control is. They're usually very riddled with compromise, based on all the stakeholders who helped develop this law. They're usually developed by people who are not technically savvy. You know, lawmakers are not security analysts, though they rely on security analysts, it's still in the delivery of the execution, it doesn't really manifest itself effectively. That said, I recognize that in a lot of ways, that's just the way the world will move. Many organizations should anticipate that some sort of regulatory body at some point, is going to require compliance with some sort of law and while I don't think that it's a great solution to solve the problem, it's at least a start, because it does get those who will not invest in security, to at least start investing in security. So it lowers the minimum bar, it does not raise the highest bar. >> Very interesting insight, and one more question if I can squeak it in, and that is, you mention that media and entertainment is pretty good with respect to security, for those industries where it's still a nice to have, do you think it's going to take something like another DDoS attack, or something else to, something big that is quite, negatively impactful, to get some of those industries to go, "You know what, "this is no longer a nice to have. "This is a fundamental element that "we need to culturally adopt." Do you think it's going to be something almost catastrophic, that's going to drive that change? >> Most likely, but it won't be just the big issue. It will be whatever the big issue is combined with an individual, or collection of individuals with the political capital to drive for that pioneering change. Industries don't typically change on their own. They change because people make them change. >> Good point, well, Ted Harrington, thank you so much for spending time with us today. If you're not following Ted on Twitter, @SecurityTed, follow him, from Independent Security Evaluators. Thank you so much for sharing your insights. Have a great rest of the NAB Show. >> Thank you for having me. >> And with that said, you've been watching theCUBE live from NAB in Las Vegas. I'm Lisa Martin, stick around, we'll be right back. (light techno music)