Dos and Don’ts for Fighting Misinformation and Securing the Media Industry

• The speakers in the webinar discussed critical points about legacy systems, zero-trust, and threat actors. 
• Since employees work remotely, security tools must address threats arising from outside work and devices.
• AI and other advanced technologies used for sophisticated attacks need to be thwarted with better technology models.

Tata Consultancy Services (TCS) hosted a cybersecurity forum and witnessed speakers who offered insights about the safety of the media industry with a zero-trust approach. Several pressing issues were shed light on, like deepfake, legacy systems, AI, and more impacting the media industry. 

Over a thousand members attended the webinar titled “Safeguarding the media industry from evolving cyber threats with a zero-trust approach,” hosted by Chief Cybersecurity Advisor of TCS Daljit Singh Bilkhu.

Among the panelists were John McClure, CISO & SVP - Enterprise Infrastructure & Cloud, Sinclair Inc.; Mike Kelley, VP CISO & Infrastructure Operations, The E.W. Scripps Company; and Kavitha Mariappan, EVP, Customer Experience and Transformation, Zscaler.

Addressing cybersecurity challenges, Kelley expressed concern about misinformation. He touched upon technology used in Deepfake, and DeepSeek reiterating the need for a robust cybersecurity infrastructure. 

Mariappan drew attention to the pressing problems posed by nation-state actors with their proxies and organized cybercriminals who function on different motivations for attacking media organizations and are utilizing different tools and techniques.

Some of the key observations she shared were:

1. Cybercriminals launch attacks for financial incentives and are focused on ransomware, double extortion, or stealing information that can be monetized. 
2. Zscaler blocked nearly 28 billion instances of malware last year.
3. About 1 billion phishing attacks were found.
4. Ransomware attacks on media companies have risen 32% year on year since 2024.

She shared that media companies are aware of this and that reporters are targeted by threat actors. 

There is a lot of work to be done to secure Internet of Things (IoT) devices and counter deepfake content shrouding the media and AI threats that are getting more sophisticated. 

Several media companies relying on legacy systems are vulnerable to cyber attacks. 

McClure emphasized how businesses are opting for a transition from the traditional way of functioning, and a lot is changing rapidly. Speaking of the evolving technology, McClure said, “We are transforming on all fronts to be relevant, changing platforms, and putting our information on different types of mediums.”

He mentioned the importance of being torch bearers for people who look to the media for information, such as the recent firefighting effort in California and the airline crash in Washington DC. 

Pointing towards legacy systems, McClure shared, “As we move the technical models, we are evolving quickly and scraping together.” While the effort is on moving away from legacy systems, the business uses legacy systems. “You put up an antenna, the antenna stays up for a long time. You put a satellite, the satellite stays up for a long time,” he added. 

To maintain security, it is imperative that companies follow the tried and true way of blocking and identifying threats. The traditional means of security identities may be a better approach than leaning heavily on the new technology that may not be as secure as required. 

Among the key limitations affecting the media industry are the older security models. Addressing the changing work culture and security threat, Mariappan aptly shared, “We don’t all get in our car and drive to office, sit behind our desk and work anymore. We work everywhere.”

The security measures need an overhaul as they remain unfit for purpose, and the new ways the cybercrime landscape has changed. With work becoming more decentralized and media professionals using office and personal devices, traditional perimeters will need to change.

Mentioning the need to protect identity and zero-trust, Kelley shared how legacy VPNs suffered enormous attacks in the past few years, including exploiting vulnerabilities. Security needs to be maintained for human accounts and non-human accounts, machine accounts, and cloud.

There is a need for more sophisticated tools for protecting identities and detecting deepfakes and misinformation. Kelley asserted that it is essential to have a detection team and a response program for the risks posed by advanced threats.

In conclusion, it could be said that knowledge about technological advancements is essential to keep an eye on evolving threats. However, more human intervention with focus and optimized solutions is necessary to secure data and the digital infrastructure.