V O L U M E 3 7 N U M b E r 3 7 w w w . m u l t i c h a n n e l . c o m O C T O b E r 1 7 , 2 0 1 6 $ 6 . 9 5

1 Color - 100 White

plus

What happened when cyber-attackers shut down Liberty Global’s broadband in the Netherlands

Just Don’t Call It OTT: InsideLayer3 TV’s ‘Super Headend’ NYC TV & VIDEO WEEKTop Operators Share Hispanic-TV Strategies Are Distributor StocksTurning for the Fall?

HACKEDHACKED

coverPG1_10_17_16.indd 1 10/14/16 5:21 PM

coverstory

m u l t i c h a n n e l . c o m | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l n e w s | 76 | m u l t i c h a n n e l n e w s | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l . c o m

A video posted by “AnonNazi” to YouTube helped lead authorities to the hackers who shut down the Dutch broadband operator Ziggo last year.

By MARK ROBICHAUX

“This … is … bad.”The chief information officer at Liberty Global,

Veenod Kurup, mouthed those words, mostly to himself, as he saw the Guy Fawkes mask of Anonymous appear in the YouTube video.

It was bad enough that there was an outage in the system, and a big one. Hundreds of thousands of homes and count-ing — eventually 2.2 million, or nearly two of every three of Liberty’s Netherlands broadband subscribers — were now es-sentially unplugged.

Worse, the cause wasn’t a late summer storm or a lightning strike, but some-thing far more devious: a breach in the company’s cyber defenses through an overwhelming distributed

denial-of-service (DDoS) attack on company servers. Transfixed by the video, Kurup and other executives real-

ized the unfolding tech nightmare was getting worse. It ap-peared to be the sinister work of Anonymous, the infamous global Internet vigilante group known for ferocious attacks.

The Liberty executives listened in disbelief in their offic-es near Amsterdam as the eerie synthesizer-distorted voice on the screen explained how the next attacks would be even harsher. The target: Liberty Global’s newly acquired Ziggo op-erations in the Netherlands.

The audio ended with a version of the group’s signature coda: “We are Anonymous. We are legion. We do not forget. We do not forgive. F---k your bad services. Expect us.”

When it ended, the room fell silent for a second.Over the ensuing 72 hours of August 2015, a bizarre chain

of events would leave Liberty executives flummoxed, and for-ever wary. The crisis would embroil an eclectic set of charac-ters, including frazzled cable engineers, detectives with the Dutch Police’s High-Tech Crime Unit, cyber gumshoes at the

National Cyber Security Centre, the digital vigilante group known as Anonymous, copycat hackers looking for Internet glory and the true perpetrators, who briefly evaded authori-ties despite their crude methods.

In bringing down Liberty Global’s Ziggo network, the criminals and the manhunt to capture them yielded some crucial lessons for the many media companies — indeed, any major industrial concern — that will inev-itably confront this insidious peril of the Internet Age: that they will be victimized by a hacker or attacker hell-bent on stealing data, demanding money or bringing the system down.

Hacking is big business, and it’s getting bigger. Cyber-crime inflicts annual costs to the global economy exceeding $400 billion, according to a study by the Center for Strategic and International Studies, sponsored by cybersecurity firm McAfee. Costs could reach up to $2.1 trillion globally by 2019, according to Juniper Research. Other estimates put the fig-ure at a mind-boggling $6 trillion within five years, includ -

A 2015 hack that took down Liberty Global’s

Ziggo Internet service in the Netherlands offers important

cybersecurity lessons for cable operators worldwide.

TAKEAWAY

BreachedWhat happened when hackers shut down Liberty Global’s broadband in the Netherlands

coverStory_10_17_16.indd 6 10/14/16 3:48 PM

coverstory coverstory

m u l t i c h a n n e l . c o m | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l n e w s | 76 | m u l t i c h a n n e l n e w s | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l . c o m

ing lost productivity, fraud and post-attack disruption.Cable operators and other ISPs rarely speak about cybercrime for

fear of inadvertently revealing network vulnerabilities, but given the widespread, mostly unauthorized revelations about the Netherlands cyberattack, Liberty executives agreed to share limited details to clar-ify the episode.

Sometimes a breach occurs for all the wrong reasons. A company can do all the right things, create the best safeguards and vigorously review security, but may overlook a tiny flaw in the system.

Liberty’s network, like that of many ISPs, is attacked constantly in a variety of ways (see chart), but the attempts are kept at bay with in-creasingly sophisticated safeguards. Though outages at big ISPs from hackers are rare, the odds continue to grow in the hackers’ favor as digital commerce and cloud computing thrive. Wireless operations are, in many ways, even more vulnerable.

Evolving prevention and detection strategies are as elaborate as they are endless: “honey pots,” for example, are computer systems set up to act as a decoy to lure cyber-attackers and study their methods. Liberty had long ago implemented a holistic approach to security beyond just firewalls, with a 24-hour monitoring team in a global security opera-tions center. Highly trained executives followed a thoughtful crisis-management process. Recent upgrades had already reduced malware infection rates by 25% since January 2015. With a comprehensive plan backed by best practices, the network security team was comfortable the company could withstand most cyber attacks.

THE ATTACK BEGINSBut last summer, a rupture suddenly and qui-etly appeared in the front lines. And like all successful attacks, the intruders caught the fortress completely by surprise. It was as if the cable giant had built reinforced steel walls with spotlights and guard dogs in front of the house and then left a window open in the new annex out back.

Around 9:30 pm on Tuesday, Aug. 18, Liberty technicians got word that Ziggo, an incumbent cable operator acquired by Liberty months ear-lier, was reporting outages.

Ziggo had only just begun the process of inte-grating its system into Liberty’s, but no matter: Liberty owned them now and complaints were lighting up call centers by the thousands. In just hours, hundreds of thousands of customers would be without broadband services.

Ziggo and Liberty engineers quickly huddled on a conference call to determine the cause of the outage. More often than not, the prob-lem can be traced to an equipment failure. Not this time. Within an hour, the engineers, because of the mushrooming volume of outag-es, quickly realized Ziggo was under a distributed denial of service (DDOS) attack. This was a Priority 1 incident.

Liberty Global’s chief technology officer, Balan Nair, knew reaction time was critical. “The key to solving all this is a func-tion of how quickly you react initially and how good your team is,” he said. “Up and down the ladder, everyone was taking this very seriously. They were burning the midnight oil on this.”

A distributed denial-of-service attack typically floods a company’s network by inundating it with connection requests, leaving the tar-geted server overwhelmed, a lot like Lucy at the chocolate factory, frozen by its inability to keep pace with commands. Often the cul-prit is using an army of hijacked Web browsers or malware-infected computers, or botnets. According to a report by TrendMicro Re-search, $150 can buy a week-long DDoS attack on the black market.

Indeed, DDOS attacks are common — Liberty, like many cable

operators, fends off up to 10 Gigabits of DDOS attacks — per day. This particular attack targeted DNS servers, which redi-rect domain names to correct IP addresses. Social media chat-ter about the outage began building — for those that could still get online.

Seems like 95% of Holland is looking for WIFI. #ziggo #trending pic.twitter.com/5iXsRGSSDH— Pieter (@Pieter_180) August 18, 2015

Social media, in fact, supplied the first clues to identifying the perpetrator. Several groups began to claim credit via Twitter. Then came the YouTube video. As it played against a still photo of a Guy Fawkes mask, the synthesized voice began its threat:

“We, Anonymous, have a message to company Ziggo … now we’re going to hold Ziggo offline for a few days because Ziggo of-fers bad service. This is the last warning. We are Anonymous. We not forgive. We do not forget. F---k your bad services. We are Le-gion. Expect us.”

Recalls Kurup: “That shook us to the bone.” The nature of a DDOS attack is that it ebbs and flows, and

by 5 a.m. on Aug. 19, several hours after the first thrust, the at-tack seemed to ebb with the countermeasures of Ziggo and Liberty engineers. Liberty executives breathed a moment of relief: Customers could be back online when they awoke.

The DDOS attack had not been so unique or complex, so why had the network become so sud-denly vulnerable?

While the tech teams were puzzled at first, they soon realized the cause. Despite defenses that Lib-erty Global had in place, the firewalls in front of newly acquired Ziggo’s DNS servers had not been set up according to Liberty Global standards, and had collapsed. Firewalls prevent routine unau-thorized access, but not the kind of voluminous attacks of the sort that targeted Ziggo.

Moreover, the attackers had caught Liberty at its weakest moment — in the middle of migrating an entire network. As the DDoS attack ebbed, Lib-erty and Ziggo engineers were left chewing on a

tough question: how to instantly migrate Ziggo’s network into Lib-erty’s — usually a months-long task with tests, changes and docu-mentation required — in one day.

The engineers hatched an audacious scheme. Senior manag-ers, confident the team could execute, approved the plan instantly.

“They said, ‘You know what you need to do — do it,’ ” said Kick Fronenbroek, a senior security specialist for Liberty Global.

At some point on the second day, another threatening YouTube video surfaced. This one was more specific, and raised questions about the attacker’s true identity. Posted by someone ominously dubbed “AnonNazi,” it featured a crudely drawn, green, animat-ed, hooded character with a synthesized voice, emblazoned with a banner with swastika icons.

The voice claimed full credit for the earlier attack, dismissing Anonymous. “Some other people are claiming it was Anonymous, but it was not. We attacked the DNS service because of the bad ser-vice that Ziggo provides …” AnonNazi boasted.

His next utterances were pointed. “Because of bad service we want you to pay all of the customers

all of their money back for about one week. If you don’t accept this, we will continue with more powerful attacks,” the voice threat-ened. “You have been warned.”

The question burning on everyone’s mind: if this wasn’t the real

state of cYBeRsecuRitY

500MNumber of accounts that Yahoo said hackers had accessed containing passwords and personal details in 2016.sOuRce: Yahoo

129% Increase in DDoS attacks in Q2 2016 vs. Q2 2015sOuRce: Akamai State of the Internet Security Report, Q2 2016.

45% Increase in 2015 of detected se-curity incidents over the year before for telecommunications companies.sOuRce: PWC, The Global State of Information Security Survey 2016. Based on responses of more than 10,000 CEOs, CFOs, CIOs, CISOs, CSOs, VPs, and directors of IT and security practices from 127 countries.

100MNumber of fake tech-support scams blocked by Symantec in 2015, whereby pop-up error alerts steer victims to an 800 number where “tech- support reps” sell services. sOuRce: Symantec

39%Percentage of companies that cited “budget” as the biggest barrier to adopting advanced security processes and technology.sOuRce: Cisco 2015 Security Capabilities Benchmark Study

54%Percentage of companies that cited malicious software downloads as the leading cause of internal breaches. sOuRce: Cisco Systems, Security Risk and Trustworthiness Study

93% Percentage of cases in which it took at-tackers “minutes or less” to compromise systems. Organizations, meanwhile, took weeks or more to discover that a breach had even occurred — and it was typi-cally customers or law enforcement that sounded the alarm, not their own security measures. sOuRce: Verizon 2016 Data Breach Investigations Report

65%Percentage of respondents who col-laborate to improve cybersecurity and reduce cyber-risks, up from 50% in 2013.sOuRce: PWC The Global State of Information Security Survey 2016, based on responses of more than 10,000 CEOs, CFOs, CIOs, CISOs, CSOs, VPs and directors of IT and security practices from 127 countries

“They said, ‘You know what you need

to do — do it.’ ”KICK FRONENBROEK,

LIBERTY gLOBAL

coverStory_10_17_16.indd 7 10/14/16 3:48 PM

coverstory

m u l t i c h a n n e l . c o m | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l n e w s | 98 | m u l t i c h a n n e l n e w s | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l . c o m

Anonymous, who in the hell had just brought down service to nearly 2 million homes? Executives at Ziggo and Liberty were baffled.

Around 4 p.m. on that second day, Aug. 19 — after the first attack, and before the migration of the network — there was another, more ferocious assault using a differ-ent entry method.

Again, consumers and businesses across the country were digitally stranded with no broadband service. In just 24 hours, the national network had absorbed two unprecedented cy-berattacks. “We had outages before, but this is the first big one we had,” Kurup said. “Nothing like it before.”

That roughly 2 million customers were without broad-band (TV service worked fine) was enough. But the self-pro-claimed attackers, AnonNazi, took to social media to pour salt in the wound:

“We are very sorry for the attack! Reason why? Because we like to ; ) It’s funny;-D Ddawsed;0 Dns Servers Went down ;) again.”

Liberty stood helpless — for the moment — as a second wave of digital torpedoes directed by the same hackers pen-etrated the bulkheads. “We now understand the weakness, but we also

see that the system is allowing it to happen,” Kurup said. “We knew we could fix this problem.”

The crisis was escalating. On YouTube, Zig-go was threatened with new attacks. At the same time, the attackers announced a new target, KPN, a Dutch telecommunications company.

The Dutch Ministry of Security and Justice called the attack “serious,” and Liberty executives called in the High-Tech Crime Unit of the Dutch Police Services Agency.

A growing team of technicians were tackling the DDOS at-tack, and by the evening on the second day, had counteract-ed the menace of the incoming traffic. The traffic issue was becoming more manageable.

By about 3 a.m. on Aug. 20 — about 50 hours into the at-tacks — engineers had redirected the flow of traffic, essen-

tially by offloading it to island data centers. Working around the clock, the teams had

finally migrated the network and successfully updated defenses. All mitigation steps in Lib-erty’s elaborate security protocol were in place. Engineers at Ziggo and Liberty were content for the moment. The back window was shut.

Although the attackers had managed to in-flict inconvenience, the company had reason to be proud of how it battled back. Its fast re-action preserved customers’ data and priva-cy, and minimized downtime for countless business and residential subscribers. An end-to-end security plan made the attack man-ageable. And the incident left Liberty’s security team with invaluable battlefield experience.

As Liberty stated in its annual report, “the overload im-pacted 2.2 million customers, yet within 24 hours, our teams were moving 130,000 customers per hour to more resilient in-frastructure. Two days later, full service was restored.”

Liberty now was intent on winning the war. Fearing fur-ther attacks as a result of the threats hurled over YouTube, Liberty didn’t just drop the matter, as many corporate hack-ing victims do. The company pressed a criminal investigation,

beginning a cat and mouse game to track down the culprits, while bracing for more attacks.

But a strange thing happened — nothing. Much to the bewilderment (and relief) of executives, no

large-scale DDoS hacking attempts were detected in the sys-tem. The threatened deadline came and went. Ironically, the hacker’s inaction provided a major clue.

Serious hackers, not to mention ransomware, vow a cer-tain time for an attack — and stick to it. That this code was not honored virtually confirmed suspicions that Anonymous wasn’t behind the attack.

A subsequent Twitter post by AnonOps, which claims to have ties to the actual group, echoed many social-media com-menters: “DDoS on #Ziggo is not an #Anonymous operation.”

HACKER VS. HACKERThen the manhunt took a bizarre turn for investigators: the groups claiming credit for the attack began to insult and threaten one another on social media.

Some dismissed the poster AnonNazi as a pretender. An-other self-proclaimed hacker, AnonymousScruggs, claimed credit for the attacks on Ziggo.

“They were having turf wars,” said John Fokker, who, with Ton Maas led the digital team for the High Tech Crime Unit of the Dutch National Police. “Most [professional hackers] are discreet about how they approach the company. They don’t have a beef on Twitter.”

Days later, on Aug. 26, a video narrated by the synthesized voice of a faint image, hooded and tinted purple, and posted by “Code Red,” drew Liberty’s attention:

“What a pity that someone thought it was fun to attack Zig-go while causing damage to many people depending on their Internet. The attacker cowardly did this attack in the name of Anonymous. Research shows that this person has no ties whatsoever with the goals or objectives of Anon-ymous.”

The hackers began to “dox” one another, an attack wherein all of a target’s personal documents (email addresses, phone numbers and bank accounts) are released on the Internet. On the Twitter account of AnonNazi, a post read simply, “This ac-count has been compromised by @BOEFII.”

Said another post by @BOEFII under a story about the at-tack on a media website in the Netherlands:

“I would like to thank everyone who participated in help-ing me to dox every single person from Anon_Nazi. They are destroyed and they will never cause any harm to Ziggo again.”

Had a bunch of glory-hungry hackers claiming credit for the same crime just turned on one another — outing each other in the process?

Top engineers at Liberty were left scratching their heads. In addition to the police, Liberty called in digital detectives

from the National Cyber Security Centre, which collects data and advises organizations on security, and a rapid response team from Deloitte, which focused more on forensics.

HACKING 101: HOW TO GET IN cybercrime is any criminal act involving a computer and/or a network. hacking is the unauthorized access into a computer system. Crimes can take any form, from outright theft of data or funds, damage to a network or harm to a reputation. Increasingly, one of the weakest links in security is the employee. Most attacks on compa-nies involve some sort of malware, a broad term for malicious code, including Trojans, worms and viruses that steal or destroy data, often introduced through emails, downloads or other network weak spots. Some com-mon terms below:

• “Phishing” attempts involve official-looking emails tempting employees to click on a link that can trigger countless malware possibilities. (Spear phish-ers focus narrowly on a single company or individual.)

• Distributed Denial of service (DDos) attackers use multiple hijacked computers to push through a huge volume of traffic through the network until it becomes overwhelmed and no longer functions.

• Botnets, also known as “zombie armies,” are groups of infected computers controlled by third parties for DDoS attacks or for distributing other malware.

• trojan attacks allow attackers to remotely steal data and manipulate the computer.

• Ransomware demands a ransom after blocking ac-cess to the computer by encrypting files on the hard drive.

• spyware allows attackers to go undetected on infected computers to track users movements on the

Internet, even keystrokes for theft of accounts, etc. • adware redirects users to unwanted advertising. • sQl injection inserts a nefarious code in a website/’s entry field that allow attackers to ma-

nipulate or steal or destroy data. — Mark Robichaux

A group called “Code Red” posted this message saying that the Ziggo hackers weren’t affiliated with Anonymous.

“We now understand the weakness, but we also see

that the system is allowing it to happen. We knew we could

fix this problem.”vEEnOD kuRup, LIBERTy gLOBaL

coverStory_10_17_16.indd 8 10/14/16 3:48 PM

coverstory

m u l t i c h a n n e l . c o m | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l n e w s | 1 11 0 | m u l t i c h a n n e l n e w s | O C T O B E R 1 7 , 2 0 1 6 | m u l t i c h a n n e l . c o m

Over the next several days, Liberty engineers be-gan turning over discs of data to investigators. Digital detectives scoured social media for clues, conducted inter-views and studied logs of interactions between the Liberty/ Ziggo servers and outside computers. Investigators searched for patterns and addresses that matched the in-formation they were gathering about the attackers.

As the digital dust settled, Liberty executives reviewed detection and prevention measures all across the Liber-ty Global footprint. “We had already sanitized the entire system,” said Kurup.

Chasing the digital breadcrumbs, the public claims of credit, and the battle between the hackers, Fokker and Maas moved quickly and made two arrests early on.

Six weeks after the initial attack, on Oct. 7, 2015, Dutch police arrested four mi-nors between 14 and 17 years old and one 21-year-old. The boys come from Berkel-land, Lochem, Den Helder, Schoorl and Vinkeveen.

Police seized computers, mobile phones, external hard drives and USB sticks. The young suspects “wanted to show they were capable of having a major effect such as taking down an Internet provider,” the National Prosecu-tor’s Office said in a statement to Dutch media.

Under Dutch penal code, the suspected hackers face up to two years for the DDoS attack. Because of the ex-tortion threats, they face a maximum of an additional 12 years behind bars. A trial date has not been set, but be-

cause of the suspects’ age, leniency will be sought.

Today, the Liberty and Ziggo engi-neers are sensitive about the incident.

“If the same cast of characters had done this anywhere else in our global footprint — Germany, France, Belgium — it wouldn’t have even caused an outage,” said Kurup. “We would have intercepted it. It would have been logged as a routine attack.”

Kurup hopes the apprehension of the hackers, which made big headlines in the Netherlands, deters others. But no matter — the incident has made the entire company more vigilant, and that’s a good thing.

“It’s a constant battle,” Kurup said. )

BY MARK ROBICHAUX

“F--k Black Lives Matter!”That jarring and vulgar racist message — and much worse — appeared on the TV

home screens of Charter Spectrum subscribers in Dallas two months ago.Using symbols for white supremacy and Nazism, hackers had momentarily broken

into Charter’s network and released the outrageous messages to subscribers. “Brought to you by Phreak of Nature Baby J and King Benji!”

Some North Texas customers, dismayed at the hate speech, called in to complain, and within hours, much to the chagrin of Charter, the story went viral in the local me-dia, including an interview on the local ABC affilliate, WFAA channel 8, with a tearful African-American woman who read the quotes aloud on her screen.

Charter, of course, deleted the messages immediately, and apologized profusely to cus-tomers, but the incident still concerns executives at a cable giant known for its diversi-ty efforts, particularly chairman and CEO Tom Rutledge, who chaired this year’s Walter Kaitz Foundation Fundraising Dinner supporting diversity in the cable-TV industry.

The question for U.S. media companies is not “if” they will be breached, but more like “when.” IBM chairman and CEO Ginni Rometty called cybercrime the “greatest threat to every profession, every industry, every company in the world” at the IBM Se-curity Summit in New York City last year.

The motivations for hacks into big companies are as varied as the methods of at-tack. Some hacks, often big email breaches and releases (Sony), are meant to embarrass. Some are state-sponsored (Olympic athletes, the Democratic National Committee). Other hackers seek to steal customer data (Yahoo) to sell on the black market. Some are meant simply to cause damage, cost money or make a point, however vile (Char-ter). Others hijack or hold up data for a ransom (Liberty Global) or try to steal money.

“The motives can run the gamut, which is why we’ve committed extensive resources for many years with a focus on risk management,” said Myrna Soto, global chief infor-mation security officer for Comcast, which invests heavily in security analytics. Soto declined to go into detail about Comcast’s cyber defense tactics.

Though extended network outages due to hackers are rare for cable operators and big U.S. ISPs, the networks they manage continue to be the target of attacks because of the nature of their digital business.

THREATS WILL GROWThe intensity and frequency of these attacks is increasing, security experts said, be-cause so much of the product and the architecture around it is no longer in a closed, wired system. Increasingly, it’s all in the cloud, a far more porous and vulnerable en-vironment. Indeed, as more homes, appliances and automobiles become wired for the Internet of Things, the risks are expected to grow. And as cable’s wireless footprint ex-pands, so do innumerable new threats on that platform.

The attacks come in all forms, from distributed denial of service (DDoS) attacks to phishing to the theft of company customer lists. (See chart.) Some big cable operators

receive as many as 1 million attempts to breach the system — each day.Just last year, the California Public Utilities Commission approved a $33 million settlement

with Comcast and the California Attorney General’s office related to a incident at Comcast that resulted in the release of personal information of nearly 75,000 Comcast Xfinity Voice customers. The purloined data was being offered for sale on the black market, possibly the victims of malware from phishing attacks or exposure from unrelated data breaches.

Other big cable operators have also weathered attacks on customer data. In January, Time Warner Cable notified up to 320,000 customers of a data breach in which their email and password details may have been stolen, likely through malware, or via unre-lated data breaches of other companies storing customer information.

Notably, the FBI notified TWC — not the other way around — that some customers’ email addresses and account passwords “may have been compromised.”

“Hackers are often able to break in and are able to operate in stealth,” said Sam Ras-togi, senior manager of products and solutions at Cisco’s Service Provider Security di-vision. “The time it takes a service provider to identify a breach is anywhere from 100 to 200 days and that is huge problem.”

COUNTER MEASURES TAKENCable operators and other network companies are doing three things to meet the shift-ing demands of new cyberattacks.

For starters, they are spending aggressively, contracting with consultants and in-vesting in network security firms outright. Data security concerns are now an issue for company boards, which are sanctioning bigger budgets to update critical protec-tions, executives said.

Secondly, attentive companies are building more holistic or end-to-end defenses, be-yond just firewalls, software updates and patches — and they are sharing solutions with fellow providers. Many ISPs collaborate on defenses in real-time, informing one another of details of new strains of viruses — or solutions. Comcast, through its Center of Excel-lence for Security Innovation, has partnered with academics at the University of Con-necticut to “collect, reflect and connect” for best ideas in securing critical infrastructure.

Most providers work in an array of groups, alongside NCTA – The Internet & Tele-vision Association, on government and private sector initiatives. “One of the keys to a successful cybersecurity program is collaboration across the ecosystem,” NCTA chief technology officer Bill Check said.

Finally, most ISPs, particularly cable operators, are aggressively educating custom-ers to be more vigilant, and are offering a limited arsenal of defensive tools. Many cus-tomers don’t change passwords for different accounts, making it easy for hackers, while others naively open links to malware or emails from phishers.

On its Constant Guard Xfinity website, Comcast offers customers a wealth of cyber-crime prevention services, including alerts, hotlines, software and real-time updates on various malware threats, color-coded by level of threat.

In addition to secure firewalls, Charter, too, offers a “Security Suite” for its cloud-based Spectrum service with “advanced real-time protection against viruses, spyware and other malicious attacks.”

“There is no silver bullet when it comes to security,” Cisco’s Rastogi said. “What we see is the most effective way is to deploy multiple layers of security and to insure you can effectively protect the content, protect the service and protect the infrastructure.” )

In the CrosshairsISPs, cable ops brace for more attacks

John Fokker (l.) and Ton Maas, de-tectives with the High Tech Crime Unit of the Dutch National Police, eventually collared five people for extortion and the DDoS at-tack on Liberty’s Ziggo network.

coverStory_10_17_16.indd 10 10/13/16 6:24 PM