SolarWinds Hack: Reflections from working in the cable industry
By: Nathan Chung
Tags: Cable, Cybersecurity, Information Security, Hacking, Solarwinds

Based on news that the global SolarWinds hack had also compromised Cox Communications, I felt the need to reflect on my time working in cybersecurity for a cable company. Cybersecurity with the cable industry needs to improve to prevent breaches in the future.

First, cable companies have traditionally and will always have a large attack surface with multiple attack vectors. These range from customer cable modems, telecommunications equipment, servers, to email systems. This is further exacerbated for cable companies that are composed of multiple units from mergers and acquisitions. Even without mergers and acquisitions, cable companies have multiple networks that are not always centrally managed. SOC analysts struggle to monitor and defend such a large attack surface. A job made even harder with recruitment issues.

Second, it is very difficult for cable companies to hire and retain top cybersecurity talent. The cable industry continues to lose subscribers and revenue from cord cutting, leading to cable companies having less funds available for cybersecurity staff. With the cybersecurity skills gap and millions of unfilled jobs, this is made more difficult due to salaries at cable companies that are often below market. It is almost impossible for cable companies to attract the top elite in cybersecurity who can command top dollar salaries. Why would a cybersecurity professional work at a cable company making $80,000 a year when they can work anywhere else and make significantly more? This also leads to high turnover as cybersecurity workers leave cable companies to hiring paying positions elsewhere. To make matters worst, cable companies prefer to hire from the cable industry, further limiting the talent pool. As a result of these factors, top cybersecurity workers will often avoid working for cable companies and those cable companies cannot afford them.

Third, within the cybersecurity CIA triad, cable companies focus primarily on availability to maintain service levels for customers. This is reflected in where cybersecurity funding, programs, and initiatives go. Unfortunately this leaves very little for basic cybersecurity best practices to protect and defend. For example, replacing legacy systems and patching vulnerable systems take a very long time. I would not be surprised if all cable companies are vulnerable to the SolarWinds hack.

Fourth, similar to other large organizations I have worked in, cable company executives often do not have visibility or awareness of security risks. This is because traditional IT thinking prevails including: “we’ve always done things this way” and “cybersecurity does not contribute to revenue”. As a result, security risks will often not be reported up the chain to executives due to the fear of being blamed for causing problems that negatively affect the availability of cable services. It is similar to the thinking: If a security risk is not reported, is it a problem? Also if an executive does not know about any problems, are they responsible for subsequent breaches?

Fifth, with the COVID-19 pandemic there has been a mass migration to the cloud, however cable companies by their very nature are forced to maintain on-premise systems and data centers in order to provide service to customers. Cable modems, satellite dishes, and networking gear all need to be physical devices. This makes it even harder to replace legacy systems, patch vulnerabilities, and respond to incidents.

In summary, the cable industry has a hard time with cybersecurity basics, recruitment, and protection. The SolarWinds hack verifies just how vulnerable cable companies are. Just like the Titanic, it is very hard for large cable companies to change course in order to prevent disaster. It seems like the only thing people pay attention to are big data breaches.

The views and opinions expressed in this article are those of the author and do not necessarily reflect the official policy or position of any other agency, organization, employer or company.