Category: Technology

Cybersecurity and the Arts

Working in the arts, DWG sometimes hears that they don’t need all of the security standards of large corporations. I am reminded of a non-profit executive telling me awhile back that they don’t need to be like the Pentagon when we recommended a two factor authentication system. This article was inspired by a genuine concern that many art organizations may not be fully aware of the consequences of the slippery security slope.  Our hearts sank as we heard of The Met’s ordeal and our minds were outraged.  DWG does not know the exact cause of The Met cyberattack so this is not meant to be in any way derogatory to the wonderful folks at The Met. References and articles are included below.

Beginning on December 6th, 2022, hackers started the process of breaching the Met Opera’s information infrastructure. By December 7th, a cyber attack against The Metropolitan Opera in New York was well underway. The attack affected the opera’s network systems, including its internal network, website, ticketing server, box office, and phone center. The Opera’s website was restored eight days later, on December 15.

During this period, the opera continued its performances, and the Lincoln Center for the Performing Arts supported ticket sales until the Met could recover from the attack (Kudos Lincoln Center!). While the exact magnitude of the damage has not been disclosed, the stoppage in ticket sales effected revenue. According to Peter Gelb, The Met’s general manager, the opera earns roughly $200,000 in ticket sales per day throughout this season. Because the malware impeded the opera’s ability to sell tickets, seats were temporarily sold for $50 on the Lincoln Center for the Performing Arts website.

The cyber attack on the Met is far from the first on a cultural institution. In 2019, ransomware attacked the Asian Art Museum in San Francisco. In 2020, hackers obtained access to personal information from hundreds of cultural institutions and NGOs.   I’m sure you all have heard plenty of stories of hacks and cyberattacks.

Hackers do not care whether a business is a Fortune 500 company, a small business, or not-for-profit cultural institution like The Met, all these institutions still make transactions and hold their customers information.

A month after the attack on Met Opera, the attackers have yet to be identified, but The New York Times underlined the opera’s vocal support for Ukraine amid the ongoing Russia-Ukraine conflict.

But whatever the motivation and tactics, the cyberattack on the Met should serve as a wake-up call to other cultural organizations. Anyone could be a target. “I usually warn clients that everyone, regardless of size or sector, is a target. It should not take an occurrence like this to wake up other cultural institutions to the fact that they are in grave danger,” says Richard Sheinis, partner and head of data privacy and cybersecurity at full-service legal firm Hall Booth Smith.

Cultural organizations, like performing arts centers, theaters, and museums, are typically attractive targets for cyberattacks since they may not always have the time, money, skill-set, or up-to-the-minute understanding to build a good cybersecurity strategy. Unlike many for-profit organizations, which are victims of zero-day* vulnerabilities, the bulk of security breaches in smaller enterprises and most non-profits are caused by preventable flaws in human/device interaction. The untold story of cybersecurity is how criminals leverage the imperfect nature of humans to further their own goals.

Finding funding for cybersecurity is often difficult at a non-profit but it is a worthy investment.  A good security posture today, can save hundreds of thousands later, but many people are hard pressed to believe that it could happen to them. Furthermore, many cultural institutions are still striving to recover from the COVID-19 pandemic and are not in a position to embrace the additional concerns brought about by cybersecurity.

So, bringing cybersecurity to the forefront in a cultural institutions is the first critical step. Subsequent evaluation of the infrastructure, and investment in prevention, detection, and response can help lower the likelihood of cyber attacks while also mitigating the damage of an attack if one occurs. It is always recommended that the evaluation phase be done by in-house IT team, then if company lacks the means to retain in-house cybersecurity personnel, it can turn to third-party cybersecurity firms.

Please remember until you get a cybersecurity firm to help:

  • Layered firewalls (one from your service provider, one for your institution, and if you are running your ticketing server in-house, one more for that)
  • Separation of subdomains for internal and external networks,
  • SSL
  • Two-factor authentication
  • And for goodness sake, we recommend your site should not be on the same operating system as your ticketing server (if one is on windows, the other should be on Linux) – make the hackers work more difficult (hardening). If they are the same, security should be monitored in real-time.

* The term “zero-day” refers to newly found security flaws that hackers can exploit to attack systems. The term “zero-day” alludes to the fact that the vendor or developer only recently discovered the fault, implying that they have “zero days” to repair it. A zero-day attack occurs when hackers exploit a weakness before engineers have time to fix it.

~Nami

Posted by The Met:

“After suffering a cyberattack that temporarily impacted our network systems, we’re pleased to announce that the Met is now able to process ticket orders through our website and in person at our box office. Based upon our ongoing investigations into the recent cyberattack, we would like to reassure our customers that ticketing customer data, including credit card information used when purchasing tickets, has not been stolen. We do not keep credit card information in the systems that were affected by the cyberattack. Thank you for your patience.”

Links:
https://www.nytimes.com/2022/12/07/arts/met-opera-cyberattack-website.html
https://www.reliasmedia.com/articles/commonspirit-ransomware-attack-holds-lessons-for-cybersecurity
https://amicusmsp.com/human-interaction-is-key-to-successful-cyberattacks/

 

Risk Management and the Arts

Risk Management and security are one of if not the biggest issue facing art organizations today. Unfortunately, it is not just because it may prove daunting but because it is rarely taken seriously within the organization until trouble arises.

Gone are the days when acquiring a HiTrust Certification, SOC2 type 2 auditor’s report, or an ISO 27001 accreditation was enough to defend your firm appropriately. Many seasoned practitioners knew that such a milestone was never a reliable indicator of an organization’s security posture or maturity. And it appears that the rest of the world has finally caught on.

The security threat environment is expanding in tandem with legislative and governance needs. Attacks have become more numerous and sophisticated, the number of attack channels has increased, the attack surface for businesses has increased substantially, and the complexity of our digital footprint has increased even further. In addition, the severe shortage of qualified and available workers to fill security tasks, including Governance, Risk, and Compliance (GRC), compounds the problem.
In short, GRC leaders face numerous hurdles in today’s firms. Yet, surprisingly, I hear little talk regarding the most efficient ways to run a modern GRC or risk management program. Because each firm is unique, there may be a variety of answers. There are, nevertheless, methods for modernizing your procedures.

  • Do you have a Risk Management Program in place?
  • How are you currently managing risk?
  • Why has technology changed so dramatically while GRC programs have remained the same?
  • Is there a more efficient way to manage today’s modern GRC program?

Before we begin discussing possible solutions, let’s review the basics:
Governance refers to an organization’s statutory or contractual obligations regarding security, risk, and privacy objectives. Noncompliance can result in severe fines and even criminal prosecution in some situations.
Risk refers to managing risk within an organization, focusing on security and privacy standards.

However, this merges with Enterprise Risk Management. Enterprise risk management (ERM) is detecting, analyzing, and treating a company’s risks based on an ongoing assessment by executive management. ERM includes examining the company’s exposures in financial, credit, fraud, strategic, and operational problems.

Compliance refers to an organization implementing security and privacy controls to meet governance standards and decrease risk. Internal and third-party external audits are a significant component of compliance.
My personal experience is firmly rooted in the NPO space, having spent the last 20 years helping many of our art clients with their IT audit and compliance. Based on that, I have some thoughts.

The sheer number of regulatory requirements a modern NPO must meet can be overwhelming. Similarly, managing organizational politics in an NPO is challenging, both for and against risk containment. Security, particularly GRC, has typically been viewed as a cost center rather than a value generator. And as I have stated in previous conversations, seen as a barrier to creativity.

Personnel shortages and burnout are at an all-time high, compounding the problem. According to industry analysis, this gap will continue to increase in the near term and will be a concern for quite some time.
Every day, we hear about one breach or another, and everyone is trying to move towards a more secure posture. However, these areas have financial consequences and criminal prosecutions due to a lack of monitoring and care.

In today’s environment, the message is clear: No matter what problems companies face, they must reasonably preserve the security and privacy of the data.

Running a Risk Management Program

A comprehensive alignment among the leadership is required to establish a more sustainable and scalable approach. Accepting “growing pains,” the additional initial costs, and facilitating cross-organizational working groups are all part of this. Everyone benefits from this arrangement, and key stakeholders must understand how they may help so that they can passionately buy in and be change champions.

To start the process, you must determine what regulatory obligations your firm should meet. The correct response would be, “Ask your auditors when they come in,” however, most auditors assign their most junior, fresh off-the-robe (just out of college) individuals to manage in-house audit interactions. So your best bet is for your Finance Officer to call one of your audit firm’s senior partners and obtain a summary of the regulations you must follow.

After defining the requirements, the hard work can begin, which begins with a thorough understanding of the organization’s environment. For example, what people, procedures, and technology does the organization have? What is the organization’s culture? What is the organization’s risk tolerance?

What is the organization’s risk tolerance? If you can’t answer these questions, you can’t assess compliance adequately. During this phase, we are attempting to piece together several essential views of the organization:

  • Purpose, vision, and operational needs
  • Lines of business
  • Organizational Structure
  • Key business processes
  • The digital and physical footprint
  • Assets
  • Data processing and storage

Traditionally, there are numerous emails, direct messages, and meetings. As a result, all parties involved experience duplicative manual processes, exhaustion, and dissatisfaction. It’s simple to “drop the ball” or “miss the mark” on even the tiniest of tasks in the traditional way.

You will need a SecOp person to gather the data and get the closest approximation of the organizational reality. This person must have sufficient power to assemble and distill the information for executive review.

SecOps is a relatively new concept that refers to security functions collaborating with DevOps teams (Development and IT) early and frequently and incorporating “paved roads” with “guardrails” into the process.

The teams that are continually maintaining the environment, deploying updates, and keeping the “lights on” are the stars of the show here (DevOps), and it is critical for modern GRC teams (SecOps) to collaborate and integrate with these teams. The most vital connection to cultivate for a modern GRC practitioner wanting to update their program is this one. Cross-training between GRC experts and technical teams is required. Both groups can be experts in the other’s field but must grasp how things function.

Gaining a rudimentary awareness of what tools and processes are in use with DevOps offers significant returns. When we understand how these tools interact, we benefit all parties involved. Therefore, in addition to our personal growth and development, we must teach these technical DevOps teams the fundamentals of GRC. The idea here is to keep it simple; just as a GRC practitioner can’t master complex deployment and troubleshooting, neither should our DevOps teams be expected to lead an audit.

At the very least, the audit should address any commerce, ticketing, change management, and collaboration systems utilized in the teams. A modern GRC practitioner benefits immensely from working with the tools that DevOps teams are already using. Working with DevOps provides those practitioners with the ideal perspective for evaluating organizational security and, as a result, compliance with your criteria.

At the same time, the DevOps teams need to gain an understanding of the following:

  • The forces influencing framework or standard requirements
  • The distinction between completing a requirement and meeting the requirement’s intent
  • How and why must we manage requirements from many frameworks and standards?

What happens during the audit process, why do we gather evidence, and what efficiencies can we put in place to make evidence collecting more consistent, trustworthy, and less impactful on engineering teams
Moving to the system(s) of the record is the final key in this method. Individual file sharing is a formula for disaster.

Can you envision a modern sales team organizing their activities through spreadsheets rather than a sophisticated Customer Relationship Management (CRM) system?

Certainly not! So, why do we handle our GRC initiatives in this manner regularly? First, however, it is critical to note that there will likely not be a single system of record. That is why your GRC software must integrate with other sources of a critical system of record.

Critical systems to integrate include change management systems, asset management systems, document management systems (for rules and procedures), and ticketing systems.

In short, make sure your IT and development crew know their systems, bring in an outside security person to lead the SecOps effort, and keep complete records of every process, discovery, and solution.

Sources:
GRC: The Definitive Guide (https://riskonnect.com/resources/grc-guide/)
THE ESSENTIAL GUIDE TO GRC (https://tallyfy.com/guides/governance-risk-management-compliance-grc/)
Risk and compliance management made easier (Hitrust- MyCSF)
(https://hitrustalliance.net/documents/mycsf/mycsf_information/MyCSFRiskAndComplianceManagement.pdf)

Behnam Ataee, DWG CTO, has completed the HITRUST CSF Assurance Program certification. Certified HITRUST CSF professionals can deliver simplified compliance assessments and report for HIPAA, HITECH, state, and business associate requirements.

Search Optimization Changes: Artificial Intelligence and Search Engines – Part 2

In my previous article, I promised more specifics regarding the steps you can take to improve your search optimization for the age of AI. The funniest part of the whole process has been the repetition.

For the past several years, I have been describing  Google’s shift towards better, more accurate search results. Currently Google Search algorithm seems to contain everything desirable for an AI-driven search optimization.

So, unlike my conclusions in 2021, and early 2022, they were most likely thinking about more than just accuracy. It appears that Google’s data engineers were also thinking about AI and the future of search.

The coming 18 months AI will permanently change how search engines employ and interact with us to rank content. Artificial intelligence has already altered the SEO environment, but we should expect more substantial developments in the coming months. There will be more frequent Google SERP updates as Google fends off other search engines trying to gain market share.

Here are some of the expected effects of these changes:

Voice search will become increasingly significant.

Voice search is getting more popular as smart speakers, and other voice-activated devices become more widespread. As AI advances, we should expect search engines to understand the natural language better. Such improvements mean that content authors must optimize their content for voice search by utilizing conversational language and focusing on answering particular inquiries that consumers may have. To gain more insight, refer to our article on Voice optimization.

Natural language processing (NLP) will become pervasive.

The use of NLP helps search engines grasp the intent underlying the search request far more clearly than today. Search engines should interpret natural language far better as AI advances. Extensive use of NLP means that content providers must concentrate on producing high-quality, natural-sounding information that answers particular issues that users may have.

The importance of user experience will be greater than ever.

As search engines improve their knowledge of user intent, they will likewise enhance their ability to measure user experience. As a result, page load speed, mobile friendliness, and ease of navigation will become even more vital for SEO. Therefore, content providers must produce material that answers user inquiries and creates a positive user experience.

Technical SEO will be even more critical.

Technical SEO (efforts that focus on enhancing the technical features of websites) will become increasingly important. Search engines will incentivize site owners to produce better user experiences: more robust UX will result in higher rankings on search engine results pages (SERPs). As technical SEO continues to influence the user experience—and searchers’ expectations rise—technical SEO will continue to be one of the most critical factors for organizations to consider when developing their overall SEO strategy and investments.

Personalization will become more critical.

Artificial intelligence (AI) already helps tailor search results based on user behavior and interests. However, personalization will play an even more significant role in SEO. Content makers will need to focus on developing material that is targeted to specific audiences and takes characteristics like location, device, and search history into account. Increased personalization also means a greater need for second and first-party user data gathering.

Visual search will become increasingly prevalent.

Visual search is currently a popular feature on several search engines, and we anticipate it to become considerably more ubiquitous in the next 18 months. In addition, as AI advances, search engines will better detect images and videos. Therefore, visual content optimization (for search) by employing descriptive filenames, alt tags, and captions will be vital.

SEO will see an increase in the use of video marketing.

The coming year will undoubtedly be the year of video. Companies will put out more video content as they seek to garner audiences on more visual and video-based platforms, such as TikTok and Instagram; at the same time, more video and content teams will use search data to guide their tactics. This transition will also benefit people in Google’s ecosystem, as searchers pay more attention to video results.

As audience tastes alter, brands prioritize content quality over production quality (such as effects, lighting, etc.). Straightforward, mobile-recorded videos will likely be a focus because good content does not require large production.

In the next 18 months, AI will substantially impact SEO. As a result, content providers must focus on developing tailored, high-quality, natural-sounding material that answers particular user inquiries while offering a fantastic user experience across all platforms.

Companies must also optimize their content for voice, visual, and video search and consider issues like technical SEO, personalization, and natural language processing. Content providers may remain ahead of the curve by following these trends and ensuring their content is discoverable and exciting for their target audience.

Dream Warrior Group, a Los Angeles Based web design and digital marketing Company, providing solutions for your online marketing needs. Our expertise includes Search Engine Optimization (SEO), Social Media Posts & Marketing & Google PPC campaigns.  Call us now at 818.610.3316 or click here.

Change in Search: Artificial Intelligence and Search Engines – Part 1

AI (Artificial Intelligence) is concerned with developing intelligent software capable of doing activities that generally require human Intelligence, such as natural language processing. For example, AI will create more intelligent search engines, search results, and search optimization.

Generative AI is a subset of artificial Intelligence that employs machine learning algorithms to create new and unique data or material, such as photos, music, video, or writing. Deep learning models, which can extract patterns and attributes from big datasets and utilize them to generate new samples, are at the foundation of Generative AI. Creative design, content generation, and virtual assistants are just a few of the uses for generative AI.

SEO (Search Engine Optimization) is the improvement of the visibility and ranking of a website or online content in search engine results pages (SERPs). It entails various strategies to improve the quality and relevance of a website’s content, structure, and functionality to enhance organic traffic and attract new customers.

Artificial Intelligence & SEO

Generative AI will rapidly improve crawling and indexing, personalization, and content quality, whether voice, image, or video.

Artificial Intelligence will also change the look of search engines in the future by providing richer and more dynamic search results, personalized search results, voice search, natural language processing, and improved image and video search capabilities.

AI Improves Crawling and Indexing

Generative AI may improve crawling and indexing by providing higher quality and unique content that search engines can index, enhancing the website’s ranking in search results.

Because search engines favor new and unique content, Generative AI can generate a large amount of original content optimized for specific keywords, topics, or user intents. This route to search optimization can help search engines discover the website and draw more organic traffic.

Generative AI will create metadata such as title tags, descriptions, and headers, improving on-page SEO and making the website more search engine friendly. With more optimized and relevant metadata, Search engines can better interpret and show website content in search results.

Artificial Intelligence Increases Personalization of Search Results

AI increases personalization by creating tightly tailored information and experiences based on the preferences and behaviors of the individual user.

AI is trained on enormous datasets of user interactions and behaviors, such as browser history, purchase history, and social media activity, to find patterns and preferences of individual users. Based on this information, Artificial Intelligence can give tailored content such as product recommendations, personalized news feeds, or tailored marketing messages that are more likely to engage and resonate with the user.

By generating natural language responses, generative AI is used to build personalized chatbots and virtual assistants that answer and recommend based on the user’s needs and preferences, leading to increased engagement.

AI will lead to improved content Quality for better SEO

As we are already observing, when groomed properly, generative AI is a powerful tool for improving content quality by generating relevant, high-quality, and original material that can be optimized for specific topics and user intents while ensuring that the content is free of errors and easy to read. Improved content will improve user satisfaction and loyalty, ultimately driving business success.

Artificial Intelligence will create new and innovative search experiences.

The looks of search engines will change because of AI as search engines will continue to integrate AI-powered features and functionalities to improve the user experience and better understand user intent.

AI-powered search engines can create new and innovative experiences beyond traditional keyword-based searches. With natural language processing, chatbots, and virtual assistants, each person can create engaging and interactive search experiences.

Some ways that the looks of search engines may change because of AI include Richer, more interactive, more personalized results with voice results and videos.

The looks of search engines may change because of AI. AI-powered features and functionalities will improve the search experience and help us understand user intent. As a result, many of the reference sites, such as “10 best of this” or “20 top of that,” will disappear from the results. At the same time, many reference sites, such as IMDB, may lose much of their traffic.

But, it is a given that specific products or services such as a Concert or a Play will still have to be searched for and SEO will be there to make sure your show or product shows up first.

Conclusion

The implications of AI for the future of search engines are vast, exciting, and far-reaching. The inner workings and the UI of search engines will be very different.  How they process and understand user queries and how they deliver search results and content to users will change.  Still, there will be areas where search display will go on very similarly to what you see now.

In the following article, I will review the areas of SEO that AI will bring to prominence and attempt to explain what we need to do in each area.

Dream Warrior Group, a Los Angeles Based web design and digital marketing Company, providing solutions for your online marketing needs. Our expertise includes Search Engine Optimization (SEO), Social Media Posts & Marketing & Google PPC campaigns.  Call us now at 818.610.3316 or click here.

When AI goes Marching on

People have gone insane over Generative AI (the Algorithms used to generate new data that resembles human-generated content, such as music, code, images, text, simulations, and videos ). Unfortunately, Microsoft’s hype machine is working overtime (Bing with AI hit the mat and crashed after 3 hours of testing), while Google is in hot water.

Speaking of #ai rants and raves, folks went crazy about Google’s AI Chat Bot – Bard – yesterday. Everyone agreed that Bard made a mistake, and Google’s market cap fell by $100 billion (yep, billion). Looking closer at what was asked, something to the effect of “what recent results from Webb space telescope can I tell my 9-year child about?” Bard answered with many discoveries, mentioning that (the) “telescope was utilized to take the very first snapshot of AN exoplanet.”

The first time humanity took a photo of an exoplanet was around two decades ago. Many in the media (both social and traditional) began foaming at the mouth, and Google stock dropped. But, in the end, Bard was right: the Webb Telescope had discovered an exoplanet, albeit not the first.

AI is only code

Generative AI is merely lines of code, as clue-free as many children. Its responses are open to interpretation by the listeners. So, please stop telling me how “excellent” (Keanu Reeves style) AI can be because it is only as good as the nerds that use it (including myself) and the entities that code it.

I am working on a more informative article on AI, search engines, and digital marketing. Still, it may be a while because keeping up with AI development and my distaste for those who declare themselves gurus after two weeks of reading on a subject forces me to dig deeper and let the gurus rant and rave.

Dream Warrior Group, a Los Angeles Based web design and digital marketing Company, providing solutions for your online marketing needs. Our experts will help you modify your site and get you ready for the upcoming challenges on the web.  Call us now at 818.610.3316 or click here.