Big Business

Protecting the networks will save the assets

Behind all the glamour and glitz, casinos are a lot like other businesses, yet they face a number of unique challenges. Casinos are required to adhere to numerous regulations and must secure their assets without causing inconvenience to customers.

Casinos must protect against physical heists, but just as important, if not more so, casinos must protect their networks. Although it may not play as well on the big screen, a network breach could cost millions of dollars.

Evolving Threats
Just as the styles have changed from the 1980s and 90s, so have casino networks.

All casinos face changing threats; however, some have adapted better than others. Where there was once loud carpet and coax cable, there is now chrome and Cat-5. Although these modern IP networks may be easier to implement and manage, they also are easier for attackers to penetrate. With the old security and gaming networks, serial cables connected devices to a central monitoring and control center. The networks were point-to-point, so gaining access required a direct connection that was fairly easy to prevent with the inplace physical security.

With today’s IP-enabled networks, it can be diffi cult to tell a hacker from a tourist checking their e-mail on their laptop. Perhaps even more alarming, if the gaming and security systems are on the corporate network and that network is not properly hardened, they can be attacked from anywhere on earth.

No matter how good the physical security might be, armed guards can’t stop an attacker in another state or country.

All casinos have IP-enabled corporate networks. In casinos with IP-enabled passwords are easily available on the Internet, often on manufacturer Web sites. One of the easiest and most important security controls for any organization, including casinos, is to change passwords from the manufacturer’s defaults. Passwords also need to be strong, consisting of a miniumum of eight characters if supported by the device, and a combination of letters, numbers and symbols.

The strongest password is useless if it is not stored properly. Passwords must be stored inside a password vault, and must never be stored unencrypted on a network share or hard drive.

Network segmentation. Sometimes, the easiest way to understand network segmentation is to consider the physical equivalents. The same way cash is kept in a safe, and the operations areas of the casino are physically protected and separated from the public areas, so too should the security and gaming networks be segmented. Of course, cash is kept in the counting room under armed protection, in an area of the casino away from the public.

There are cases where the critical systems may not be able to be patched or the devices may not support strong passwords. In these situations, it becomes far more important to segment the network. Threats from the inside can cause the most damage. Casinos conduct stringent background checks, but employees who handle cash are vetted more carefully. The threat is that lower-level employees are generally given access to the corporate network as it is necessary to perform their job. If the networks are not segmented, anyone with access to the corporate network can likely find a way on to the gaming and security networks.

There are two options for network segmentation: Virtual LANS and air gaps. With a VLAN, the networks run on the same physical infrastructure but are confi gured to be logically separate. It becomes extremely important that VLANs are properly confi gured, otherwise an attacker can VLAN hop and move from one network to another. Critical VLANs, including those used for the gaming and security networks, must be designed, implemented and validated by IT networking and security experts.

Air gaps refer to networks that are physically separated and run on their own equipment and infrastructure. This means that an attacker needs access to the network infrastructure they want to compromise. They are not able to gain access to a softer network, such as the corporate network, and fi nd a way to break into the gaming network.

The weakest point on these networks is often a machine or device that is connected to multiple networks. The best solution is to remove these machines or devices. If these devices are required for business, then they need to be carefully hardened, or an attacker can use them to access a critical network if a less-critical network is compromised. These systems, along with contractor laptops, are the most common points of infection for these critical networks.

Additional controls. The aforementioned controls are only the beginning.

Keep in mind these controls must be implemented before the following controls are deployed.

Network access control can be helpful but should not be solely relied upon. Most modern NAC implementations can be bypassed by a knowledgeable and motivated attacker. In fact, given the amount of money involved in casinos, they tend to attract the most knowledgeable and motivated attackers. The more valuable the target, the more secure the protections. It also is important to keep in mind that few physical security devices and gaming systems support 802.1x, which is required by most NAC solutions.

On these systems that don’t support 802.1x, NAC will need to be disabled on that network jack or port, which defeats the purpose of NAC and makes NAC a wasted expense.

Testing. It is best to test controls before an attacker has the chance. This is where a third party can be helpful. An integrator or physical security department that implements controls should not test the controls.

The integrator or department will protect against every attack vector they know of, but a third party can test elements that the integrator of the security department did not think of or may be unaware of.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.