Co-Founder and CEO of Third Summit. Award-winning creative director and entrepreneur. Passionate about cutting-edge technology.
Over my two decades spent working and consulting in the advertising industry, I always fall back on one rule: disorganization leads to insecurity.
I’ve heard and witnessed countless horror stories that prove this point. Hard drives with sensitive data get lost. Project managers quit or go on vacation, disrupting entire workflows for weeks. Clients demand vendors install superfluous firewalls with six-figure price tags. Rarely do agencies employ cloud storage, data encryption or even two-factor authentication as a company-wide policy.
Most freelancers and small studios lack the enterprise-grade tools that would make their lives easier and livelihoods safer, while most corporate agencies refuse to upgrade with the times. A comprehensive company-wide cloud migration, which could save an agency significant time and money in the long run by keeping their digital media assets organized within and beyond their physical offices, could cost up to $1 million. That’s not an inconceivable sum for a multinational agency, but executives have been reticent to take the plunge.
A solution to these problems is a competent, secure organizational system. This can be a digital asset management software or simply a well-organized cloud storage platform. Regardless of which route you take, the standard protocols of security — and the common pitfalls — remain the same.
The Five Key Areas Of Digital Media Asset Security
Intelligently designed storage solutions will pay attention to five key areas: sign-up, access, storage, management and compliance. Those are the most common avenues for security breaches and regulatory pitfalls.
The sign-up stage must ensure new users are, in fact, who they say they are. Several platforms, where either accountability is regrettably unimportant (think of some social media platforms where anonymity runs rampant) or security didn’t figure into the product design, simply require a username and password. Professional platforms should require you to upload a photo ID or arrange a quick verification phone call or text message. Biometrics can also be used to verify user identity. As with other areas of development, encryption is paramount to ensure all personal registration information is protected from potential hackers.
The next category is access. This is a common avenue for breaches. Most of us understand these everyday security measures: Two-factor authentication, randomized access codes, encrypted data transfers and SSH protocols are standard in 2020. For digital media assets, enabling specific controls is useful so that users have granular control over who can access certain content.
The next two categories, storage and management, refer to your company’s data security technology and policies. The third category involves data storage centers that must be rock-solid: Biometric entry, building stability and physical distance from populated areas are critical. Digitally, expect multiple high-end firewalls and administrative tools that prevent unauthorized access and monitor activity to spot anything unusual. If you’re working with a major cloud storage provider, such as IBM Cloud Object Storage or Amazon Web Services, they will handle this for you, but it helps to do research to fully understand their security protocols.
That leads to the fourth category: data management. Who in your company will be able to access your content and technology? A breach at this level has the most dangerous consequences. Every employee and contractor must be thoroughly vetted. All important data, especially customer data and company IP, must be encrypted, and access must be allowed exclusively through authorized tools and a select few individuals who know how to decrypt it.
The fifth category, compliance, is more legal in nature, but leaders must be mindful of global trends. This demands knowledge of various geographically specific laws, such as Europe’s GDPR, to create a product that safely conforms to evolving government security regulations.
Common Failures And How To Avoid Them
Professional hackers tend to focus on corporations and governments but are less often successful. The majority of hackers are casual, petty thieves of the digital world. They’ll access low-hanging fruit through phishing scams, insecure public WiFi networks and reused passwords. Indeed, many of the massive data breaches that make national headlines — such as the 500,000 Zoom accounts that got hacked in April — are the result of hackers finding huge databases of years-old passwords on the dark web and building bots to essentially copy and paste those passwords into Zoom accounts until a match is found. Because many passwords get reused and Zoom lacked two-factor authentication login or other security measures, those hackers got in easily. This falls under the access category from above.
Enabling extra security can feel like a balancing act among security, cost and user convenience. For digital media assets, especially in the production industry, I would argue that security is paramount, regardless of the cost. But convenience is more delicate; constant two-factor authentication can be a burden to users. That’s one reason I wanted my company to avoid usernames and passwords altogether. We require users to scan a QR code from an authenticated phone to log into accounts.
Internally, employee access is a common breach point. All companies should require employees to install VPNs on their laptops and smartphones just in case they log in from a cafe while working remotely. Restricting and controlling access is priority number one. Enable company-wide password policies, including regular password resets, password management software and two-factor authentication.
There’s Always More To Be Done
Additionally, there are basic security protocols any company should enforce. Regular backups are mandatory; having at least two levels of redundancy is a good idea, especially with digital media assets. Frequent systems monitoring can help your company be proactive rather than reactive. If you work in an office, keep your router in a secure location with a network firewall and updated firmware.
Security has come a long way in the past decade. Cloud storage, widespread SSH protocols and two-factor authentication have changed the game. But hackers will inevitably find ways around these, and new security trends will emerge. All you can do is stay organized and secure, be mindful of the best management software available and keep one step ahead of the bad guys.