Does your digital signage solution pass our Security Checklist?

Digital Signage Blog

15 years ago

Based on our previous posts relating to Security (Digital Signage: How secure is your digital signage solution? and Secure Your digital signage solution -here’s why!), we decided to put together a Security Checklist (something businesses implementing digital signage should consider). Here’s the list:

Avoid using the default ports for common application protocols such as FTP (port 21) or web (80). Change these to something unusual for example port 2122 or 8089. Basically make it harder for hackers to guess what ports you are using for certain applications.
Avoid using common passwords such as “password” and “test”. Increase your “password strength” by using at least 7 characters with at least 1 uppercase letter and 1 number. Case sensitive passwords are harder for Brute Force password software tools to break and hack.
Rename or disable common login accounts. For example, in the Windows environment rename the “administrator” and “guest” accounts. For Unix, rename the “root” account.
Enable or Install Firewall Software. Having some sort of protection (the built in Microsoft Windows Firewall suffice) is better than not having anything at all. When creating firewall rules, make sure you only allow IP addresses that require access to the device. Don’t get into a habit of just allowing everything through – only use this for testing or special circumstances. If you have a digital signage appliance and cannot install any firewall software, invest in purchasing a hardware Firewall.
Enable or Install Antivirus Software. This will prevent viruses and Trojans from getting into your digital signage network.
Ensure your Operating System, whether it’s Unix or Microsoft Windows has the latest software updates. There is a considerable amount of security vulnerabilities out there – just make sure that you backup your operating system before installing any new patches.
Physically locate your devices in a secure environment e.g. in a rack or a communications cabinet or use a kensigton lock if it’s in a public location.
For wireless connectivity to your network, disable the wireless SSID and use the latest encryption methods such as WPA.
Don’t just use HTTP to manage or transmit files – this is an unsecured protocol and the login and password is transmitted using clear text. Use HTTPS, with at least 128 bit encryption.
If you have to manage multiple sites, don’t purely connect the digital signage players to the Internet, but instead setup VPNs (Virtual Private Network). With the right equipment you can easily setup a VPN tunnel in no time.
If using the unit in standalone mode i.e not connected to the network, then disable the interface cards (wireless or physical)
If using a web based player or SaaS, ensure that the web browser is using 128 bit encryption and SSL (basically you will see HTTPS at the front of the URL). We cannot stress enough that using HTTP is not secure as the login and password is sent in clear text, meaning that someone can easily capture your login and password credentials.
Install the latest Operating System Service Packs ie. if using Windows XP, then install SP3.
Disable any SNMP services (Simple Network Management Protocols). By doing so you will avoid hackers using SNMP tools to remotely manage your devices. Also avoid using the standard community strings “public” and “private”. If you do intend to use SNMP then use at least SNMP v3 as it is more secure.
Disable any remote management tools (remote desktop, VNC, Dameware, PCAnywhere, telnet, SSH) unless it’s required for managing the network.
Disconnect keyboard or mouses from the digital signage device unless required.
Screen lock – make sure your software actually locks the player window so that the public is not able to access or change settings on the player without a password.

So there you go, thats our Security checklist. Have a look at your current digital signage solution and check to see whether it meets all or any of the above items. Now having worked for large corporate organisations, most of the above security requirements are mandatory in any IT department. So if you’re serious about winning those large tenders or contracts then make sure you consider validating your digital signage equipment against this Security Checklist before you submit your next proposal.

Protect your investment and review your digital signage solution to see whether it passes items listed in the above Security Checklist.

Are there any other Security aspects that we’ve missed? Please let us know.

Feel free to submit your answer as a comment.

LIKE WHAT YOU'VE READ?

When you subscribe you will also join other Digital Signage readers who receive our content right in their mailbox. Good luck!

Our Sponsors

Become a Sponsor for $30.

Limit to 5 sponsors.

Company Name :

Email :

Website :

Description :

Upload Logo :

Terms & Conditions : ACCEPTANCE OF TERMS This Agreement contains the complete terms and conditions that apply to your participation in our site. If you wish to use the site including its tools and services please read these terms of use carefully. By accessing this site or using any part of the site or any content or services hereof, you agree to become bound by these terms and conditions. If you do not agree to all the terms and conditions, then you may not access the site or use the content or any services in the site. MODIFICATIONS OF TERMS OF USE Amendments to this agreement can be made and effected by us from time to time without specific notice to your end. Agreement posted on the Site reflects the latest agreement and you should carefully review the same before you use our site. USE OF THE SITE You are prohibited to do the following acts, to wit: (a) use our sites, including its services and or tools if you are not able to form legally binding contracts, are under the age of 18, or are temporarily or indefinitely suspended from using our sites, services, or tools (b) posting of an items in inappropriate category or areas on our sites and services; (c) collecting information about users’ personal information; (d) maneuvering the price of any item or interfere with other users' listings; (f) post false, inaccurate, misleading, defamatory, or libelous content; (g) take any action that may damage the rating system. Registration Information For you to complete the sign-up process in our site, you must provide your full legal name, current address, a valid email address, member name and any other information needed in order to complete the signup process. You must qualify that you are 18 years or older and must be responsible for keeping your password secure and be responsible for all activities and contents that are uploaded under your account. You must not transmit any worms or viruses or any code of a destructive nature. Any information provided by you or gathered by the site or third parties during any visit to the site shall be subject to the terms of digitalsignageblog.com’s Privacy Policy. Term This Agreement will remain in full force and effect while you use the Website. You may terminate your membership at any time for any reason by following the instructions on the “TERMINATION OF ACCOUNT” in the setting page. We may terminate your membership for any reason at any time. If you are using a paid version of the Service and we terminate your membership in the Service because you have breached this Agreement, you will not be entitled to any refund of unused subscription fees. Even after your membership is terminated, certain sections of this Agreement will remain in effect. NON-COMMERCIAL USE BY MEMBERS. Members on this website are prohibited to use the services of the website in connection with any commercial endeavors or ventures. This includes providing links to other websites, whether deemed competitive to this website or not. Juridical persons or entities including but not limited to organizations, companies, and/or businesses may not become Members of digitalsignageblog.com and should not use the site for any purpose. LINKs & FRAMINGS Illegal and/or unauthorized uses of the Services, including unauthorized framing of or linking to the Sites will be investigated, and appropriate legal action may be taken. Some links, however, are welcome to the site and you are allowed to establish hyperlink to appropriate part within the site provided that: (i) you post your link only within the forum, chat or message board section; (ii) you do not remove or obscure any advertisements, copyright notices or other notices on the placed at the site; and (iii) you immediately stop providing any links to the site on written notice from us. However, you must check the copyright notice on the homepage to which you wish to link to make sure that one of our content providers does not have its own policies regarding direct links to their content on our sites. WARRANTY DISCLAIMER AND EXCLUSIONS / LIMITATIONS OF LIABILITY We make no express or implied warranties or representations with respect to the Program or any products sold through the Program (including, without limitation, warranties of fitness, merchantability, non-infringement, or any implied warranties arising out of a course of performance, dealing, or trade usage). In addition, we make no representation that the operation of our site will be uninterrupted or error-free, and we will not be liable for the consequences of any interruptions or errors. We may change, restrict access to, suspend or discontinued the site or any part of it at anytime. The information, content and services on the site are provided on an “as is” basis. When you use the site and or participate therein, you understand and agree that you participate at your own risk. INTELLECTUAL PROPERTY rights You hereby acknowledge that all rights, titles and interests, including but not limited to rights covered by the Intellectual Property Rights, in and to the site, and that You will not acquire any right, title, or interest in or to the site except as expressly set forth in this Agreement. You will not modify, adapt, translate, prepare derivative works from, decompile, reverse engineer, disassemble or otherwise attempt to derive source code from any of our services, software, or documentation, or create or attempt to create a substitute or similar service or product through use of or access to the Program or proprietary information related thereto. Confidentiality You agree not to disclose information you obtain from us and or from our clients, advertisers, suppliers and forum members. All information submitted to by an end-user customer pursuant to a Program is proprietary information of digitalsignageblog.com. Such customer information is confidential and may not be disclosed. Publisher agrees not to reproduce, disseminate, sell, distribute or commercially exploit any such proprietary information in any manner. NON-ASSIGNMENT OF RIGHTS Your rights of whatever nature cannot be assigned nor transferred to anybody, and any such attempt may result in termination of this Agreement, without liability to us. However, we may assign this Agreement to any person at any time without notice. Waiver Failure of the digitalsignageblog.com to insist upon strict performance of any of the terms, conditions and covenants hereof shall not be deemed a relinquishment or waiver of any rights or remedy that the we may have, nor shall it be construed as a waiver of any subsequent breach of the terms, conditions or covenants hereof, which terms, conditions and covenants shall continue to be in full force and effect. Severability of Terms. In the event that any provision of these Terms and Conditions is found invalid or unenforceable pursuant to any judicial decree or decision, such provision shall be deemed to apply only to the maximum extent permitted by law, and the remainder of these Terms and Conditions shall remain valid and enforceable according to its terms. Entire Agreement This Agreement shall be governed by and construed in accordance with the substantive laws of Australia , without any reference to conflict-of-laws principles. The Agreement describes and encompasses the entire agreement between us and you, and supersedes all prior or contemporaneous agreements, representations, warranties and understandings with respect to the Site, the contents and materials provided by or through the Site, and the subject matter of this Agreement. Choice of Law; Jurisdiction; Forum Any dispute, controversy or difference which may arise between the parties out of, in relation to or in connection with this Agreement is hereby irrevocably submitted to the exclusive jurisdiction of the courts of Australia , to the exclusion of any other courts without giving effect to its conflict of laws provisions or your actual state or Australia of residence.

Enter Captcha :

Accept our terms