Tags containing: "security"

Policing third-party code is essential to digital vendor risk management

August 17, 2018 Chris Olson, CEO & Co-Founder—The Media Trust

Some of the biggest companies including Saks Fifth Avenue, Lord and Taylor, Best Buy, MyFitness Pal, and Applebees have been the victims of breaches due to third party code. Third parties provide services around content recommendation engines, ads, customer identification platforms, data management platforms, social media widgets, and video players, to name a few.

Oftentimes, these third parties turn to their own third parties to help deliver their services. When unknown third (or nth) parties become part of a website’s support structure, they can introduce more risks than they were brought in to reduce, because they lie outside of a formal IT organization’s control. Gartner predicts these “shadow IT” will be the root cause of 33% of security problems by 2020.

Throwing light on digital shadow IT

Last year, one of the world’s largest magazine publishers was shocked to find their sites were supported by over 1,000 third parties. This year, they were able to winnow down that number to 100 of the most trusted. In July 2018, random sample of 350 of The Media Trust’s publisher clients showed that each of their domains was supported by an average of 140 third parties, which provided anywhere from 50-95% of each site’s code. For the magazine publisher and those in the random sample, most of these third parties (much less their activities) were unknown to them.

Recently, The Media Trust digital security and operations team found and foiled a malware campaign that affected close to 60 major publishers whose audiences span the globe. These publishers’ trusted digital advertising partners had unknowingly served an ad with malicious code that would replace the legitimate creatives of a globally recognized brand. The code would redirect visitors to a Facebook popup informing victims that they had won a prize and encourage them to enter personally identifying information.

What sets apart this campaign from other redirects is its scale and its targets: some of the world’s most popular online publications that deal only with reputable digital partners. While the campaign was effectively halted, it spotlights the growing challenges of managing the risks third parties and their own vendors can introduce to today’s ever-more dynamic, complex digital ecosystems.

Third-party code putting companies at risk

Third parties can pose risks in several ways. First, they tend to have weaker security measures. This makes them ideal attack vectors for bad actors. The headline-grabbing breaches of Target, Equifax, Ticketmaster, and, more recently, Adidas, prove how popular third parties are to exploit because of their vulnerabilities. In this scenario, when taking on a large organization, hackers will first target a third party and use it as a gateway to enter the larger network.

Second, third party code operate outside the website operator’s cybersecurity infrastructure. Their activities, authorized or otherwise, can neither be monitored nor remediated by the publisher’s marketing and IT departments. As a result, user experience can deteriorate and erode a publisher’s topline and reputation.

However, another, more serious consequence is the unsanctioned collection of user data, which in the EU will expose the publisher to the risk of infringing the GDPR and, soon, the ePR, whose scope is expected to be broader and penalties equally stiff. In fact, the ePR could potentially override the GDPR. Non-compliance is therefore a risk, and will figure prominently in other sought-after markets like Canada, which will enforce PIPEDA later this year, and California, which recently passed the California Consumer Privacy Act.

Reining in risk

Unless they have the tools to actively monitor third party-code, website owners will likely remain unaware of the broad range of code that execute on their sites and of how unexpectedly and frequently new, unknown code appear. The ability to identify, document and authorize these ever-changing vendors is critical to properly mitigate risk. Not only do most enterprises not know the full scale of vendors executing code, but they would be surprised at the amount of consumer data collection activity, i.e., cookie drops, pixel fires, device fingerprint, etc.

Continuous monitoring from your customers’ points of view helps IT teams pinpoint how these vendors and their actions—specifically the domains executed and cookies dropped—change according to user geography, browser, or device. Collecting this type of vendor intelligence provides clear insight into third party behavior to protect customers and brand reputation from cyber threats.

Working with third parties toward strong security posture

Third-party application security is essential for today’s IT security compliance, especially now that regulations are proliferating. Even if the security risk resulted from a third-party compromise, the legal responsibility falls on the primary organization. Therefore, it is crucial that organizations take sufficient steps to manage third-party risk and ensure a safer online environment for themselves and their users.

To do that businesses need to ensure that both their systems and those that look beyond their perimeter to third and nth party codes are secure. First, they should carefully vet all third parties by conducting a risk assessment before bringing any third parties on board. Second, they should maintain a continuously updated inventory of their direct and indirect third parties. Third, they should spell out security policies and standards and use contract clauses and SLAs to enforce them. Fourth, they should follow through by conducting periodic audits of third party security measures. Finally, they should conduct continuous, real-time scanning of their websites to identify any unauthorized code and activities and then compare their findings with what is executing on their visitors’ browsers outside their firewall.

These steps will help to mitigate risk and lock out bad actors from digital ecosystems. Taking a proactive approach to cleaning up and protecting websites will improve the company’s security posture, ensure customers’ safety and protect organizations from the high, upcoming fines of the GDPR and other regulations that follow it.

About the Author:

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams.

Research

Hiding in plain sight: The HTML5 security conundrum

June 4, 2018 Pat Ciavolella, Digital Security & Operations Director–The Media Trust

In recent years, as a growing number of security woes plagued Flash users, browser vendors and developers began to flee Flash for the more secure HTML5 and other open standards. Between 2014 and 2018, the percentage of people viewing a page in Chrome with Flash slid from 28% to 8%. Meanwhile, the percentage of websites that use HTML5 has grown to 70%.

In 2015, when the Interactive Advertising Bureau (IAB) updated its digital advertising guide with best practices for using HTML5, they cited security as the chief reason behind publishers’ adoption of HTML5. While the IAB was right that HTML5 offers far better security than Flash, it has a critical weakness. Hackers now use HTML5’s security functionality to hide malware. This should give pause to HTML5 devotees.

First identified in April, this malware appears to be part of a coordinated campaign that targets iOS devices. This is partly because they are popular, partly because they make detection even more challenging. It has produced at least 21 separate incidents affecting dozens of globally recognized online media publishers and at least 15 ad networks. Ironically, the malware by no means exploits an HTML5 vulnerability. Rather, it uses functionality that not only secures software from malicious attacks by making code difficult to understand, but also helps to deliver a rich experience.

Exploiting Weaknesses

In 2015, just as the exodus from Flash began in earnest, university researchers discovered several techniques to convert HTML5 into a safe haven for malware. The researchers found that if malware were written using the techniques to make code hard to read, it would avoid detection regardless of which browser web visitors used. When used to hide malware, these techniques were coupled with a drive-by download attack that followed these steps:

Redirection and Cloaking: The victim goes through a series of redirects that effectively hide attack’s source. The victim’s browser information is gathered and sent to a remote server. If the browser has any vulnerabilities commonly, a malware code is sent back to the client.
De-obfuscation: The malware code is obfuscated (broken into chunks) in order to prevent detection. Once vulnerabilities are found in the browser, the code is de-obfuscated (converted into clear-text and reassembled).
Environment Preparation: The malware puts together code that will exploit the vulnerabilities.
Exploitation: The malware injects the harmful code.

A Growing Problem

Over the course of the two years that immediately followed the publication of the research, malware developers appeared to make little use of HTML5. In 2016, they used a bug in HTML5 to freeze computers and obtain unsuspecting users’ phone numbers. Then, in 2017, The Media Trust malware team identified a small number of random HTML5 malware that made little to no impact on the broader digital ecosystem. It is possible that bad actors behind the malware were simply experimenting before staging a more coordinated attack in a larger scale.

What distinguishes this year’s HTML5 malware from earlier versions is the underlying campaign’s level of coordination and the style of attack. More specifically, the campaign reflects the malware developers’ understanding of the display advertising supply chain. In particular, they recognized the thousands of potential victims. They stage the attack without user interaction, relying instead on auto-redirection. The result is a quicker, much more widespread attack on numerous unsuspecting users.

The Malware Technique

Delivery: When a user visits a targeted online publication, an ad network delivers the malicious ad to the webpage.
Checking Criteria: As the user’s device meets each criterion—namely, whether it’s iOS and whether it’s connected to the user’s carrier—the code serving the HTML5 creative checks the criteria. Once the criteria are met, the malware is reassembled in a way that allows the malicious code to execute.
Auto-redirection: The redirect is executed. The user is taken to another page that requests their input of personal information.

Preventing the HTML5 Malware Spread Through Campaigns

Should advertisers and marketers stop using HTML5? The answer is no. HTML5 is still far more secure than Flash. However, the HTML5 malware, along with a burgeoning number of malware, are proving more difficult to detect and will require marketers to change how they secure their digital supply chain.

HTML5 malware fly under the radar of traditional security measures like antivirus. Thwarting it requires a more holistic approach where organizations collaborate with their digital partners and third parties on improving the security of their digital ecosystem. It also requires marketers to work with a cross section of teams outside of marketing — cybersecurity, compliance, etc. — in order to improve the security of their creatives and digital assets.

In the digital marketing and media world, hackers prefer easy targets like third parties because they often have weaker security postures than their clients. Once hackers break through a third party’s security measures, they can enter the client’s secure networks undetected through a trusted connection. Another easy target are online ads, which let hackers spread malware to thousands of users without having to compromise or infect a website.

Organizations can avoid third-party and online ad risks by putting in place a robust digital vendor risk management program to police every actor and every code that executes in their digital ecosystem. Such a program enables organizations to develop and continuously update their inventory of direct and indirect vendors.

In today’s complex, dynamic digital ecosystem, an organization’s mix of vendors can change daily. Keeping track of these vendors will require continuous, real-time scanning of digital assets. Second, it helps assess and document the risks from each of these vendors. Third, it enables organizations to share policies and work with vendors and digital partners on resolving issues. Finally, it enables organizations to terminate vendors who continue to violate policy after they have been put on notice.

About the Author

Patrick Ciavolella is Digital Security & Operations Director at The Media Trust. He has been working at the company for over 11 years, protecting clients’ digital ecosystems from the ever-evolving threat landscape. His experience gives him a unique perspective on how companies can defend against rapid, sophisticated and targeted malware attacks.

Innovation

Why Comcast is investing in blockchain (and maybe you should too)

March 29, 2018 Damian Radcliffe, Carolyn S. Chambers Professor in Journalism – University of Oregon

According to Gartner, $3.7 trillion is expected to be spent on global IT activities this year (up 4.5% from 2016) driven by “projects in digital business, blockchain, Internet of Things (IoT),” as well as the “progression from big data to algorithms to machine learning to artificial intelligence (AI).”

All of these trends are likely to further disrupt media markets and digital content companies. Of them, blockchain is getting a lot of attention at the moment. And rightfully so.

A growing market

Identified last year by PwC as one of eight breakthrough technologies that “will be the most influential on businesses worldwide in the very near future,” it’s an innovation which has excited investors, business and governments around the world.

One proponent, Comcast Ventures, the VC affiliate of the Comcast Corporation, recently joined IBM, the technology community Galvanize, and the VC Boldstart Ventures, in supporting a growth lab for early stage blockchain startups. Led by MState, a press release for the initiative notes that “more than 100 Fortune 500s companies have active blockchain initiatives and the number is growing fast.”

What is blockchain?

Explainers abound, including these examples from Forbes and TechRepublic. PwC offers this pithy description:

“[Blockchain is a] distributed electronic ledger that uses software algorithms to record and confirm transactions with reliability and anonymity. The record of events is shared between many parties and information once entered cannot be altered, as the downstream chain reinforces upstream transactions.”

This 3 minute video from PBS also sums up the technology very effectively, with the visuals perhaps being an easier way – for some people – to make sense of this system:

The global blockchain market is predicted to grow from USD 411.5 million in 2017 to USD 7,683.7 million by 2022, at a Compound Annual Growth Rate (CAGR) of 79.6%. The technology has the potential to impact multiple areas of interest to media companies, including: payments and contracts, as well as content distribution and digital asset management.

Commenting on an earlier study by the same company (Research and Markets) Business Wire noted in April 2017: “The media and entertainment vertical is expected to witness the highest CAGR during the forecast period.”

Comcast’s approach

According to one advocate for blockchain, Gil Beyda, Managing Director of Comcast Ventures, there are good reasons to be excited by this nascent technology.

“The internet connected people and businesses with near zero cost of distribution. However, the network still required intermediaries (website, etailers, etc.) to aggregate people and content/goods and provide a trust layer for transactions,” he explained in an email to Digital Content Next.

“Blockchain fundamentally changes that model by creating trust between individuals and companies that are unknown to each other. This allows new decentralized business models that were not possible before.” Beyda acknowledges that “It is still in the early days. ” However, he points out that blockchain is a “horizontal technology that has the potential to touch nearly every business from, supply chain management to commerce, to content consumption.”

As a result, Comcast, like a number of other media companies – such as Spotify – are exploring the potential afforded by blockchain to create (and support) new, and existing, business models.

“Comcast has announced the Blockchain Insights Platform with NBCU+Disney+Altice+Cox and others to match audience datasets — without sharing data — to better plan, target, execute and measure advertising,” Beyda told us.

The initiative, launched at Cannes Lions last summer, sees Comcast partner with NBCUniversal, Disney, Altice USA, Channel 4 (UK), Cox Communications, Mediaset Italia and TF1 Group (France) in order to deliver “a new and improved advertising approach which would facilitate the secure exchange of non-personal, audience insights for addressable advertising.”

Marcien Jenckes, President, Advertising, Comcast Cable, argued at the time: “This new technological approach would make data-driven video advertising more efficient and consumer data more secure. We’ll work with the participants in this initiative to improve ad planning, addressable targeting, execution and measurement, to ultimately create even more value for the television advertising industry.”

“Another internal project enables IoT devices in the home to use blockchain to secure and control access. Others at Comcast at looking at consumer loyalty programs and energy management,” Beyda says.

Comcast’s entry into this space goes beyond their traditional content role, to include expanded home automation services (offered, their website states, to more than 15 million customers at no additional cost) supported by a blockchain based tool. This will enable consumers “to easily grant, revoke and tailor access to any IoT device in a way that is safe, private and highly resistant to tampering.”

As Noopur Davis, Chief Information Security Officer, Comcast Cable, observed in a recent blog post: “Blockchains may be most commonly associated with cryptocurrencies [like bitcoin, Ed], but the underlying technology provides a powerful, flexible and secure platform that can support many types of sensitive transactions where privacy and reliability are critical.”

With Intel predicting that the average household will have 50 connected in-home devices by 2020 (up from ten in 2016), Comcast join Google, Amazon and others at the intersection of media and tech, who are operating in the increasing busy connected-home market.

Other potential benefits

Outside of these areas, Beyda also highlights how “early application of blockchain in media companies might include identity, royalty tracking, digital rights management and content distribution.”

Arguably it’s the payment and distribution opportunities afforded by this technology which will pique the interest of many content creators and rights holders.

As Deloitte commented in a recent paper (Blockchain @ Media | A new Game Changer for the Media Industry?): “Blockchain technology permits bypassing content aggregators, platform providers, and royalty collection associations to a large extent. Thus market power shifts to the copyright owners.”

Further possible blockchain uses identified by Deloitte include “new pricing options for paid content,” improved “distribution of royalty payments,” as well as “secure and transparent C2C sales” and “consumption of paid content without boundaries.”

Blockchain-based Opportunities. Source: Deloitte

Although adoption and the evolution of this technology still has some way to go, and several of these ideas – such as a micro-payment future have been hotly anticipated before – Deloitte nonetheless suggest:

“Possible applications and technical innovations will have a far reaching impact: content creators may be able to keep a close track of their playtimes, royalties and advertising revenues could be shared in an exact and timely manner based on consumption, and low cost content could be purchased efficiently, even if priced at mere fractions of cents.”

Meanwhile, companies like MetaX are exploring how blockchain can address issues of viewability and ad fraud by recording and storing detailed real-time ad impressions, and others have argued that blockchain technology (which allows users to trace, chronologically, any changes) can also be used to address issues of fake news and content manipulation.

Moving forward

“The media industry is stuck with licensing, distribution and collection structures that are pre-Internet,” Bruce Pon – founder of BigchainDB, a Berlin based blockchain database – wrote recently on Medium.“The blockchain enables new ways to think about the value exchange between creators, middlemen and consumers.”

Dan Williamson, CEO and co-founder of The-BLOCK.io, agrees: “We believe blockchain technology will have a huge impact on the media industry,” he told Digital Content Next.

“It will help revenue-strained media companies raise finances through ICOs and allow their readers and advertisers to participate in micropayment-friendly ecosystems. The immutable and tamper-proof nature of the blockchain will help advertisers and media owners guard against the widespread fraud and mistrust that plagues the industry. [And] it will also allow companies and individuals to distribute content in ways such that it is impossible to take it down: a double-edged sword.”

Although Pon believes that “media companies are sleepwalking into this next technology maelstrom, without knowing what’s going to hit them,” the experience of Gil Beyda and his team at Comcast Ventures indicates that there are some blockchain cassandra’s out there in medialand.

“I believe we’ll see applications of blockchain technology in production in the next 1-2 years,” Beyda predicts, suggesting that the evolution of this technology – and the myriad of benefits it could potentially unlock – might become more mainstream sooner than you might realize.

It’s potential could be quite radical. Dan Williamson, highlights how ”projects like Basic Attention Token, which was launched by Javascript creator and Mozilla and Firefox co-founder Brendan Eich, are seeking to flip the business model of the internet.” As he explains, the initiative is designed to give users control over their data and with whom they share it.

“If successful, it will disrupt Google, Facebook and the entire digital advertising industry,” he says. “What happens then? It could herald new economic era for the internet, whereby content creators are rewarded for their work and users are rewarded for their data.”

As a result, as Dr. Nelson Granados – an Associate Professor of information systems, and Director of the Institute for Media, Entertainment, and Culture at Pepperdine’s Graziadio School of Business – has argued:

“If you are in media and entertainment, 2018 will be a year to closely monitor and possibly experiment or invest in blockchain innovation, if you haven’t done so yet. Otherwise, you could be left behind.”

And no discerning media company wants that.

Matthew Schroder, a Doctoral Student at the University of Oregon’s School of Journalism and Communication contributed to the research for this article.

Industry-Research

Privacy and transparency practices are on the rise for many sites

July 12, 2017 Rande Price, Research VP – DCN

This year, for the first time, more than half (52%) of the 1,000 sites monitored by the Online Trust Alliance (OTA) qualified for the Honor Roll. The OTA Honor Roll is awarded to those sites reaching a score of 80% or higher overall with no failures in any one of the three core categories (consumer protection, security and privacy protection practice). One of the primary roles of the OTA is to raise the level of digital data security and privacy and to enhance online trust.

The 1,000 sites included in the 2017 OTA Honor Roll audit:

Internet Retailer Top 500
Top 100 Banks
Top 100 U.S. Federal Government sites
Top 100 Consumer Service sites
Top 100 News and Media sites
Top 100 ISPs, Carriers & Hosters (new this year)
OTA Member Organizations

Top performers in the 2017 OTA Honor Roll:

76% of the Top 100 consumer service sites make the Honor Roll. This segment accounted for 26 of the top 50 consumer-facing sites (52%).
51% of the top 500 Internet retailers made the Honor Roll, a 44% increase from last year. This segment accounted for 10 of the top 50 consumer-facing sites (20%).
48% of news and media sites made the Honor Roll this year, registering a significant improvement compared to last year across all industries. In 2016, only 26% of media and news sites made honor roll making it the worst performing segment. This segment accounts for three of the top consumer-facing 50 sites (6%).
46% of ISPs, carriers, hosters & email providers made the Honor Roll. This segment accounts for seven of the top 50 consumer-facing sites (14%).
39% of audited U.S. federal government sites made the Honor Roll, declining from last year when 46% sites made the honor roll. Important to note, 60% of Government sites received a failing grade.
27% of FDIC 100 banks made the Honor Roll, a significant decline from last year at 55%. The decline is mainly due to increases in breaches, low privacy scores and low levels of email authentication. A full 65% of FDIC 100 Banks received a failing grade.

Overall, failures varied widely by sector. In total, 46.5% of all sites failed in one or more area. Top failures included inadequate email authentication (55%) of the Fed 100 and inadequate privacy policies (34%) of the banking sector. Interestingly, consumer sites demonstrated a much higher level of transparency in their privacy disclosures with only 4% failing here.

With the General Data Protection Regulation GDPR implementation deadline approaching in Europe (May 25, 2018), it’s important for all participants to have a readiness plan. This requires revisiting security risks, disclosures and related privacy practices.

The OTA recommended best practices include:

Implement both Sender Policy Framework (SPF) and Domain Keys Identified Mail (DKIM) for top-level domains, “parked” domains (not used for email) and any major subdomains seen on websites or used for email.
Optimize SPF records with no more than 10 DNS lookups.
Implement Domain-based Message Authentication (DMARC), initially in “monitor” mode to get receiver feedback and verify accuracy of email.
Mandate the use of DMARC reporting capabilities with RUA (addresses to which aggregate feedback is to be sent) and RUF (addresses to which message-specific forensic information is to be reported) reporting.
Implement inbound email authentication checks and DMARC on all networks to help protect against malicious email and spear phishing purporting to come from legitimate senders.
Ensure that domains are locked to prevent domain takeovers.
Implement opportunistic TLS to protect email in transit between mail servers.
Implement Domain Name System Security Extensions (DNSSEC) to help protect a site’s DNS (Domain Name Servers) infrastructure.
Deploy Internet Protocol version 6 (IPv6).
Implement Distributed Denial of Service (DDoS) mitigation technologies and processes.
Implement multi-factor authentication.

It’s important for organizations of all types to adopt responsible practices in privacy and data stewardship to ensure a positive user experience.

Innovation | Perspectives

Culture wars: Preserving digital content on the blockchain

July 25, 2016 DCN

Free press, free speech, and personal privacy are essential to an open, free, and prosperous society. On one hand, journalists and authors must be able to communicate privately and anonymously. On the other hand, they must be able to speak freely and securely without fear of repercussion. In both cases, they must be able to support what they do. Online censorship, the hacking of large institutions and civil society, systematic piracy and data fracking, and Edward Snowden’s revelations of mass and targeted surveillance have driven people of well-established democracies to seek anonymous, encrypted, and monetizable communications through blockchain technologies. These tools enable them to disguise their identities and scramble their messages in transit and in storage so that only authorized persons may access them in exchange for cryptocurrency such as Bitcoin.

Governments that wish to repress the truth will find the blockchain significantly more challenging to stifle than the Internet for several reasons. First, journalists and photographers could use public key infrastructure (PKI) to encrypt information and conceal their identity from would-be censors and attackers. Second, governments could not destroy or alter information recorded on the blockchain; therefore, citizens could use it to hold their leaders accountable for their actions. Third, where governments starve honest journalism of funding, journalists—particularly stringers in the most dangerous parts of the world—could raise funds on the blockchain, casting a wider net for news directors and investors who preferred to remain anonymous.

For example, veteran Chinese journalists could try one of the distributed peer-to-peer crowdfunding platforms such as Koinify, Lighthouse, or Swarm that use PKI to protect the identities of sender and recipient better than Internet-only systems. Another great blockchain tool is the free mobile app GetGems, which both guards and monetizes instant messaging through bitcoin. Users can send all sorts of files securely, with GetGems functioning like private email, not just SMS.^{^[i]} These apps are just the beginning of what is possible to thwart censors and pirates.

Another solution is a distributed platform for filing stories in an immutable ledger that makes the ledger unique, such as what Factom aims to accomplish in the developing world. Reporters could purchase entry credits—rights to create entries on Factom’s ledger. As with the bitcoin ledger, everyone would get the same copy, and anyone could add to it but no one could alter entries once they were filed. Factom has a “commit/reveal commitment” scheme that serves as an anticensorship mechanism: servers in China, for example, couldn’t prevent the filing of an otherwise valid entry because of its content. If the reporter had attached an entry credit to the filing, then it would get recorded. A government could identify certain entries as offensive but couldn’t delete or block them as the Chinese government has done on Wikipedia. If an official court were to order a change in the ledger, an officer of the court could make a new entry to reflect the ruling, but the history would remain for all to see.^{^[ii]}

A third solution is distributed peer-to-peer microblogging that doesn’t go through centralized servers. Stephen Pair, CEO of BitPay, described how to reinvent Twitter or Facebook so that users controlled their own data. “Instead of having just one company like Facebook, you might have many companies tying into this common database [the blockchain] and participating in building their own unique user experiences. Some of those companies might ask you for or might require certain information to be shared with them so that they could monetize that. But as a user, you would have full control over what information you’re sharing with that company.”^{^[iii]} There is Twister, a Twitter clone in terms of feel and functionality that leverages the free software implementations of Bitcoin and BitTorrent protocols and deploys cryptography end to end so that no government can spy on users’ communications.^{^[iv]}

Through the lens of blockchain technologies, journalists and authors see the contours of a world that protects, cherishes, and rewards their efforts fairly. All of us should care. We are a species that survives by its ideas, not by its instincts. We all benefit when cultural industries thrive and when the content creators themselves can make a living. Moreover, these are the bellwethers of our economy—they reveal faster than nearly any other industry how both producers and consumers will adopt and then adapt a technology to their lives. Every business executive and government official has much to learn from them about the new era of the digital age.

Don and Alex Tapscott are co-authors of the book Blockchain Revolution: How the technology behind Bitcoin is changing money, business and the world (Penguin, May 2016). Don Tapscott, CEO of The Tapscott Group, is one of the world’s leading authorities on the impact of technology on business and society. He has authored over 15 books including Wikinomics: How Mass Collaboration Changes Everything which has been translated into over 25 languages. His son, Alex Tapscott, is the CEO and Founder of Northwest Passage Ventures, a VC firm that invests in companies in the blockchain market. For seven years in the Canadian and U.S. Capital markets, Alex has worked tirelessly to help entrepreneurs realize their goals, raising hundreds of millions of dollars in critical growth capital and providing sound advice and counsel.

[i]       GetGems.org, September 2, 2015; http://getgems.org/.
[ii]      “Factom: Business Processes Secured by Immutable Audit Trails on the Blockchain,” www.factom.org/faq.
[iii]     Interview with Stephen Pair, June 11, 2015.
[iv]     Miguel Freitas. About Twister. http://twister.net.co/?page_id=16.

Perspectives

Is your data leaking?

January 6, 2016 DCN

We hear a lot about ad blocking and ad fraud, but surprisingly little about data leakage, the underlying problem that feeds both. What is data leakage, anyway?

Sophia Cope at NAA: Data leakage is the collection and monetization of an online publisher’s audience data by a third party without the publisher’s knowledge and consent.

John McDermott at Digiday: Data leakage typically occurs when a brand, agency or ad tech company collects data about a website’s audience and subsequently uses that data without the initial publisher’s permission.

Note that these definitions include nothing about user permission. That’s a separate issue. Data leakage is a publisher/third-party problem, not a publisher/user problem. Both definitions are based on publisher permission.

That’s a good start. But “permission” is hard. The reality is that publishers often don’t understand all of the third-party resources on their own sites. And to make things worse, third parties bring along other third parties … with the result being that pages can end up with 50-70 third-party pixels, scripts, and iframes. (There’s even a zone on the Lumascape devoted to services that a publisher can use to figure out what other services they’re using.)

Every one of those third parties comes with some kind of contractual “permission.” All of those permissions, though, are expressed in complex contracts. Even if a publisher can afford to comprehend the terms of one contract, the set of resources on a page can introduce unwanted data transfers working in combination. And the combinations of technology and contracts change faster than anyone can evaluate them.

Learning from security software
It’s inadvisable for security companies to call malware “malware” when the malware developer has a lawyer. The solution has been to come up with a new category name, Potentially Unwanted Programs (PUPs). The definition is based on whether the software works against the user’s interests, not on whether the user has clicked on “I agree” after not reading a complex, deceptive contract.

Labeling programs as PUPs is a small win. It is possible to define a problem in terms of interests and norms, not in terms of what someone has “agreed” to. We will be able to have a more productive discussion of the data leakage problem if we can shift the definition from one based on “permission” to one based on publisher interests and business norms. Remember: Data leakage is not a problem about user permission (which is another story). Instead, user norms and expectations can be a helpful way to establish the definition of data leakage.

So here’s a new definition:
Data leakage is collection or transfer of publisher audience data in a manner that violates the norms and expectations of the members of the audience.

Why is it important to clearly define data leakage? Because we still have trouble collecting data on it, and to do so, we need to know what to measure. We don’t know how much of the ongoing problem that newspapers have with building online ad revenue is attributable to data leakage.

In order to measure data leakage, we have to define it based on a reasonable standard, not on a mess of contracts that results in publishers unknowingly “agreeing” to practices that work against their interests.

Finding data leakage
We can look for leaks at the top of the pipe and at the bottom:

Bad bots visiting good sites: Fraudulent ad inventory gains value from associated user data, which is why even the best-run sites still get some fraudbot traffic. Bots are collecting cookies on legit sites, then showing up as valuable “users” on fraud sites. If your site has a small bot problem, then any advertiser paying to reach your users on other sites will have a big bot problem.

Good audiences available in bad places: We don’t have access to the “user data chop shops” that sit between legit publishers and sales of targeted impressions based on publisher data. But we can look at demand-side platforms to find out where valuable impressions are showing up, and measure the impact of anti-data-leakage tests.

Data leakage is an important issue that must be better understood and addressed.We can’t deal with ad blocking, ad fraud, and low ad revenue without understanding the data leakage problem. The good news is that data leakage is measurable, if we work it from the legit publisher end and the questionable inventory end.

Don Marti (@dmarti) is a contributor of code and documentation to the aloodo.org project, a low-friction way for sites and brands to reclaim the value of online advertising from fraud and ad blocking. He serves as a strategic advisor for Mozilla, and is the former editor of Linux Journal. Don is the subject of an out-of-date Wikipedia article which he will not edit himself, but wishes that someone would.

Industry-Research

Security concerns in the media and entertainment industry

January 5, 2016 Research Team—DCN

Media and entertainment business and technology executives are worried about the security of the cloud. And while massive distributed denial of service (DDOS) are happening with regularity, most media execs are not familiar with the details of DDOS, nor are they confident that their site could withstand such an attack, according to a recent survey of 261 media and entertainment executives by Broadcasting & Cable and VideoEdge Magazines. According to their report, Secure My Site –Media Security Concerns, Beliefs and Attitudes, perceived and real threats make security a major issue for media companies in the U.S. today. In fact, over half of the media and entertainment executives surveyed said that they have lost sleep over the potential threats to security posed by cyber-attacks, with 13% saying they often endure sleepless nights.

Among the report findings:

Nearly 80% of media executives said that Web security is “very important” or “extremely important” to their organizations, and virtually all of them plan to spend the same amount or more on security solutions in the coming year.
Traditional TV companies (broadcasters, pay TV companies, and programming service providers) are even more focused on security, with 89% of executives from these companies saying security is at least “very important” to their business.
Though media executives are reluctant to admit security problems, 28% of survey participants said their organizations have experienced a cyber-attack or data breach. Almost all of those reported that one or more corporate Web sites were forced offline because of the incident.
The most common problem appears to be Web site defacement, as 75% of cyber-attack victims said that hackers changed the appearance of their site, which can be detrimental to the brand.
A quarter of the media executives surveyed said that their corporate data were breached as a result of the cyber-attack they suffered, though 38% say they suffered a loss of corporate intellectual property.

Industry-Research

Building consumer trust in digital brands

September 22, 2015 DCN

It is essential for digital publishers to understand what key factors connect user satisfaction and brand trust and monitor to ensure growth of user engagement. In a Neustar sponsored study, conducted by The Ponemon Institute, a leader in cyber security research, three key components were identified to be influencers of online trust.

The first factor connected to digital brand trust is accuracy. According to more than 9 in ten respondents (91%) inaccurate content causes users to lose trust in a website. Further, inaccurate content goes beyond just getting the information wrong, it also includes misspellings, broken links to content or outdated offerings. In addition, advertising that interferes with content (55%) and ads that redirects users to sites they don’t want to see (52%) also has negative effects on a website’s brand.

A second component involved in a site’s brand trust is stability. Eighty-eight percent of the respondents identified a site’s downtime as a trust eroding practice. Also a site’s general usability and its capacity to work with different browsers, plug-ins and flash are important to the perception of a site’s stability.

Lastly, website security is an important feature connected to a site’s brand trust. Both the speed of overall site performance and page downloads are related to security concerns. More than three-quarters of respondents (78%) reported that security concerns them when a site performs slowly. Further, 67% of users lose trust in a website when its pages take a long time to download. In addition, close to two-thirds of respondents (63%) report distrusting brands whose data was breached.

As consumers spend more time online, monitoring accuracy, stability and security is key to delivering an exceptional brand experience.

Innovation

Three Tech Day Takeaways

April 6, 2015 DCN

At our Digital Content Next members-only Tech Day, held April 2 at the Time and Life building in NYC, topics included dealing with cyber security threats, how to make decisions about moving into the Hybrid Cloud and how to respond to the challenges brought on by viewability and ad blocking.

This event brought together senior-level technology executives from our member companies to learn, network and share common experiences from their respective – and sometimes very different – businesses among them Slate, CBS Interactive, AP, Forbes, About.com, Everyday Health, and Hearst. We also hosted a special interview with Co-founder and President of Power to Fly Katharine Zaleski. Three takeaways from the event:

Flexibility is key

“Different groups needed to interact with content in very different ways.” By decoupling the schema from its CMS About.com “Created a content schema that could grow and change as business needs do.”

— Nabil Ahmad, CTO, About.com

“Moving to the cloud has allowed us to cut the order processing time but even more importantly, it allows us to move from concept to deployment much more quickly.”

— Lorraine Cichowski, SVP, CIO, Associated Press

“Flexibility is a bad word to a lot of people… but allowing people to work remotely and be focused on outcomes actually allows them to work longer and harder.”

— Katharine Zaleski, Co-Founder & President, Power to Fly

Building its CMS using Google Polymer Web Components allows Atavist’s CMS to quickly and flexibly produce interoperable custom elements. The result “encourages unique and creative stories” that include “easily assembled blocks of images, sound, video and interactive charts.”

— Jefferson Rabb, CTO and
Thomas Rhiel, Director of Reader Experience, Atavist

Integrated Tech Is Integral to the Business

“It is essential to be a technology-enabled company…technology can enable better monetization. You need your tech team to be tied into revenue goals. If they are in the loop, they can make ad delivery better or faster and make you, as a publisher, able to perform better than anybody else.”

— Dan Check, Vice Chairman & VP, Engineering/Product, Slate

“You must have a security strategy from the top down. The reality is that employees are often the weakest link it any company’s security…it is essential to not only inform employees, but also to enable security to be everyone’s business, not just the tech department.

— David Hahn, CISO, Hearst

“Today’s audience wants to easily transition across devices: 40% of users run the same app in multiple devices, many switch between devices to complete a task. We need content and UX to work together to maintain a seamless experience.”

—Deepak Chokkadi, VP, Software Development and
Premal Parikh, CTO, Everyday Health

Invest in Tech Talent

“For me the whole thing is culture. You want people who will fit in and inspire others around them…you can do a lot to train them and get them fully up to speed.

—Nabil Ahmad, CTO, About.com

“The numbers speak for themselves, we don’t have enough people in tech so we can’t afford not to have women in these careers…I think we have to give up this idea of being valued by the amount of time you sit at a desk and evaluate our tech performance based on outcomes.”

—Katharine Zaleski, Co-Founder & President, Power to Fly

“As we work on our strategic cloud planning, we find that tech staff needs new skill sets so we are doing cloud training for some of the staff.”

—Lorraine Cichowski, SVP, CIO, AP

Click here to see the full agenda with speakers and sessions.