Industry Insights: Managing security risks across connected broadcast systems

As broadcast infrastructure becomes more connected, securing individual devices and networks is only part of the challenge.

Each contribution feed, third-party integration and remote production system introduces additional points of access, raising questions about how organizations establish trust and maintain visibility across increasingly complex operations.

In part two of this three-part Industry Insights roundtable, broadcast technology vendors examine the vulnerabilities introduced by connected production equipment, the limitations of specialized hardware and the importance of monitoring media as it moves between systems.

The discussion also explores identity management, zero-trust principles and project-level access controls, alongside the security standards and technical assurances broadcasters should expect from suppliers. As production environments become more interconnected, evaluating security requires greater attention to both individual components and the relationships between them.

Key takeaways from this Industry Insights roundtable

• Hardware carries risks: Specialized broadcast equipment is not inherently secure, and limited vulnerability research can leave weaknesses undiscovered even in systems perceived as isolated or protected.
• Connections expand exposure: Each IP-connected device, contribution feed and third-party integration introduces potential vulnerabilities that require clear trust boundaries, secure transport and device-level auditing.
• Visibility enables accountability: Granular monitoring at system handoffs and across media supply chains helps organizations identify operational problems and security risks that aggregate dashboards may obscure.
• Access requires verification: Zero-trust principles, identity management and project-based permissions help ensure that users and devices receive only the access necessary for their roles and responsibilities.
• Vendor claims need evidence: Broadcasters should evaluate security certifications alongside penetration testing, patch management, encryption practices and vendors’ willingness to demonstrate security through real-world deployments.

How is the use of custom hardware acting or helping security threats?

Jan Helgesen, head of product and solutions, Nevion: Custom hardware is often viewed as a security advantage, but it can also hide significant unknowns, including undetected zero-day vulnerabilities. Limited security research and lower public exposure do not make these systems inherently safer; they may simply be less visible while remaining accessible to well-resourced threat actors. This creates a serious risk, particularly where nationwide broadcast transmissions raise national security concerns.

What vulnerabilities are introduced as more production devices, contribution feeds and operational systems become connected to IP networks?

Russell Trafford-Jones, industry engagement manager, Techex: Every connected feed is a bridge between networks, so broadcasters need a clear Trust Boundary. Without demarcation, network properties can leak between parties. A media firewall addresses this by receiving media from one party, cleaning it of unrequired information and transferring it to the next, establishing a Trust Boundary as advocated by SMPTE’s RP 2129 that permits only authorized media in and out while blocking everything else, with payload and AES-256 transport encryption protecting the content itself.

Sergio Ammirata, Ph.D., chief scientist, SipRadius: Every newly connected device potentially adds an operating system, credentials, configuration data and control interfaces that have to be secured. We have seen devices that store passwords or network information in clear text, provide maintenance access with elevated privileges, or expose control paths that could give an attacker access beyond the device itself; physical access to an inadequately protected remote device can be just as serious. The practical response is to audit every device as rigorously as the network carrying the content.

How can organizations improve visibility across increasingly complex media supply chains and third-party integrations?

Kristan Bullett, CEO, Humans Not Robots: Visibility breaks down at the intersection between systems, and media supply chains have a lot of those: contribution feeds, CDNs, third-party integrations and cloud services that were each procured and monitored separately. The answer is to measure at a very granular level (e.g. per-channel, per-subscriber, per-CDN data…) because aggregate, high-level dashboards hide exactly where problems, whether cost, carbon or operational, originate. In my experience, organizations improve visibility by gathering detailed, workload-level data that’s independently measured rather than self-reported by the provider being assessed.

Advertisement

Russell Trafford-Jones, industry engagement manager, Techex: You cannot secure what you cannot see, so monitor at every hand-off. Managing the flow of live media through teams and third parties is vital to ensure full accountability, visibility and swift rectification of any problems, which means probe-grade monitoring such as ETSI TR 101 290 at each demarcation point. That telemetry should be correlated across your own and third-party infrastructure and flow into the tools operations teams already use, so issues are resolved before they impact the broadcast.

What role should identity management, access controls and zero-trust principles play in modern production environments?

Andrew Wierzan, president of products, Pixitmedia: Modern production, particularly in the creator economy and fast turnaround work, is pragmatic by necessity and, by enterprise standards, a little scrappy. Zero trust is the most tried and tested model available, but it sits in tension with an industry that cannot accept a missed delivery, dead air, or a game that misses transmission, so often controls that blocks the show are bypassed. Vendors must own their share of this by agreeing on governance standards and making secure implementation genuinely easier, rather than leaving the complexity with the customer.

Jan Helgesen, head of product and solutions, Nevion: Identity management and access controls are critical for verifying users and defining what they are authorized to access or perform. In distributed production environments, access is no longer tied to a physical location, making it essential to confirm each user’s identity and permissions. Clear auditing and accountability also helps organizations understand what happened during an incident, how it occurred, and why, so similar issues can be prevented in the future.

Bea Alonso, marketing lead, Projective: Access control has to follow the project, not just the storage volume, because a media production environment adds and removes contributors constantly and a static permission model cannot keep pace. Role-based, templated access applied at project creation means freelancer onboarding and offboarding become deliberate, governed events rather than afterthoughts that quietly leave doors open. That is the practical face of zero-trust in production: every collaborator works inside a defined boundary from the first frame to final archive.

Sergio Ammirata, Ph.D., chief scientist, SipRadius: Being connected to the production network should never, by itself, establish trust. Every user and device should be authenticated before gaining access, and then given only the feeds, services and functions it is authorized to use; approaches such as certificate-based device onboarding and public-key authentication make that practical across distributed systems. This becomes increasingly important when the same production can span facilities, remote locations, cellular links and cloud infrastructure where a traditional network perimeter no longer provides a meaningful security boundary.

What should media organizations expect from vendors when evaluating the security of a product, platform or managed service?

Andrew Wierzan, president of products, Pixitmedia: Tender security questionnaires are easy to game, so treat certifications such as ISO 27001 as a baseline trust signal rather than an answer. What matters is proof in the field, which means a vendor willing to put you directly in touch with customers running the same workflow at the same scale, without a minder on the call. Ask them to bring their engineering team to the table during implementation to align on security practice, because a vendor that will not do that is selling you a document, not a posture.

Jan Helgesen, head of product and solutions, Nevion: Media organizations should expect vendors to support EBU R 143, which defines cybersecurity recommendations for media vendors’ systems, software, and services. The recommendation covers safeguards for software, on-premises hardware, and SaaS solutions, including access control, encryption, secure code updates, and logging. Organizations should also prioritize vendors that embed security into their development processes and conduct regular product penetration testing.

Russell Trafford-Jones, industry engagement manager, Techex: Security should be evidenced, not asserted. Recognized frameworks such as OWASP, defense-in-depth controls suitable for internet-facing applications, and enterprise authentication with 2FA should be baseline expectations. Beyond the certificates, ask whether security is a principle and cultural focus permeating architecture and code creation, and how much the product relies on generic open-source media libraries.

Sergio Ammirata, Ph.D., chief scientist, SipRadius: They should ask very specific questions: What operating system does it run, how are security patches distributed, how are passwords and configuration data stored, are there maintenance backdoors, and does the device need to connect to the vendor for licensing or validation? They should also establish exactly where a media stream is encrypted and decrypted, because an apparently secure transport can still contain an exposed point somewhere in the chain. If a vendor cannot provide clear answers to those questions, that uncertainty should itself be treated as a security risk.