{"id":95313,"date":"2021-08-10T11:00:24","date_gmt":"2021-08-10T18:00:24","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=95313"},"modified":"2023-05-15T23:03:18","modified_gmt":"2023-05-16T06:03:18","slug":"how-security-can-keep-media-and-sources-safe","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/08\/10\/how-security-can-keep-media-and-sources-safe\/","title":{"rendered":"How security can keep media and sources safe"},"content":{"rendered":"
The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager\u00a0Natalia Godyla<\/a> talks with Runa Sandvik<\/a>, an expert on journalistic security and the former Senior Director of Information Security at The New York Times. In this blog, Runa introduces the unique challenges and fundamentals of journalistic security.<\/em><\/p>\n Natalia:\u202fWhat is journalistic\u202fsecurity?\u202f<\/strong><\/p>\n Runa:\u202f<\/strong>Being a reporter is not a 9-to-5\u202fjob. You’re not just a reporter when you step\u202fthrough\u202fthe doors of The Washington Post or The Wall Street Journal or CNN. It becomes something that you do before work, at the office, at home, or after work at the bar. In some ways, you\u2019re always on the job, so securing a journalist\u202fis\u202fabout securing\u202ftheir life and\u202fidentity. You’re not just\u202fsecuring\u202fthe accounts and the systems that they’re using at work, which would fall under\u202fthe\u202fenterprise;\u202fyou\u2019re securing the accounts and the systems that they use on a personal basis.<\/p>\n In addition, reporters travel. They cover\u202fprotests\u202fand war zones.\u202fYou will have to account for their physical and emotional safety.\u202fJournalistic security for me is effectively the umbrella term for digital security, physical security, and emotional safety.<\/p>\n Natalia:\u202fWhat\u202fis unique about securing\u202fa media organization?\u202f\u202f<\/strong><\/p>\n Runa:<\/strong> A media organization, whether it’s a smaller nonprofit newsroom or a larger enterprise, needs the same type of security tools and processes as any other organization. However, with a media organization, you must consider the impact. We’re not just talking about data belonging to the enterprise being encrypted or stolen and dumped online; we\u2019re also talking about data from subscribers, readers, and sources. As a result, the potential ramifications of an attack against a media organization\u2014whether it\u2019s a targeted attack, like a nation-state actor looking for the sources of a story, or opportunistic ransomware<\/a>\u2014can be greater and involve far more people in a more sensitive context. Privacy-preserving monitoring is\u202falso\u202fimportant for newsrooms. I believe in helping the journalist understand what\u2019s happening on their devices. If we aren\u2019t teaching them to threat\u202fmodel\u202fand think about the digital security risks of their stories and communications with sources, we\u2019re going to have a gap.<\/p>\n The other major difference is the pace. Newsrooms are incredibly deadline-driven, and security’s job is to enable journalists to do their job safely, not block their work. If a journalist tells their security team that they’re going to North Korea and need to secure setup, the team needs to shift their to-do list around to accommodate that\u2014whether it means providing training or new hardware.<\/p>\n Natalia:\u202fWhat\u2019s\u202fthe biggest challenge to securing a media organization?\u202f<\/strong><\/p>\n Runa:\u202f<\/strong>The one thing that continues to be a challenge for media organizations is the lack of trust and collaboration between the internal IT and security teams and the newsroom. The newsroom doesn’t necessarily trust or go to those departments for help or tools to secure reporters, their material, and their work. If you’re building a defensive posture, you can’t secure what you don’t understand. If you don’t have a good relationship with the newsroom or know what kind of work they do, you’re going to have gaps. I’ve found it helpful to involve the newsroom when making decisions around tools and processes that impact their work. Involving the newsroom in discussions that affect it, even if they’re technical, will do a lot to build a trusting relationship.<\/p>\n Natalia:\u202fHow do you build a process to evaluate and mitigate risk?\u202f\u202f<\/strong><\/p>\n Runa:<\/strong>\u202fIf you\u2019re writing about the best chocolate chip cookies, you\u2019re probably fine.\u202fYou\u2019re probably not\u202fgoing to run into any issues with sources\u202for\u202fharassment. If you decide to report on\u202fpolitics\u202fthough, chances are you\u2019ll face the risk of online threats and harassment that could escalate to physical threats and harassment. The context for a specific project and story becomes a set of risks that need to be accounted for.<\/p>\n Typically, the physical risk assessment process has already been established. Newsrooms have been sending reporters\u202fon risky assignments, such as to\u202fwar zones,\u202ffor a long time.\u202fIn most newsrooms, a reporter will talk to the editor and\u202fassess the\u202frisk\u202fof any work-related travel. They get input from their physical security adviser,\u202flegal,\u202fand\u202fHR.<\/p>\n Building a similar process for the digital space becomes a challenge of education and awareness<\/a>. In some cases, newsrooms have established and documented well-functioning processes, and security teams can become part of that decision tree. In other cases, you must start by introducing yourself to the newsroom and making sure people know you’re there to help. I’ve talked with news organizations in the United States, United Kingdom, and Norway that have cross-functional teams with representatives from the newsroom, IT, security, HR, communications, and legal to ensure no stories fall through the cracks.<\/p>\n Natalia:\u202fWhat\u202fprocesses,\u202fprotocols, or technologies do you use to protect journalists and their\u202finvestigations?<\/strong><\/p>\n Runa:\u00a0<\/strong>In a newsroom, you typically have “desks.” You have the investigations desk. You have style. You have sports. Different desks will have different needs from a technology and education perspective. Whenever I’m talking to a newsroom, I try to first cover security basics. We’re talking passwords, multifactor authentication<\/a> updates, and phishing. I cover the baseline; then look at the kind of work each desk is doing to drill in more. For investigations, this could involve setting up a tool to receive tips from the public, or air-gapped (offline) machines to securely review information.<\/p>\n For international\u202ftravel, it could involve establishing an internal process with the IT team so\u202fa\u202fjournalist\u202fcan quickly request a new laptop\u202for\u202fa\u202fnew phone.\u202fIn many cases,\u202fthe\u202ftools\u202fthat\u202fend up being used\u202fare popular and well-known.\u202fThe journalist usually\u202fmust\u202fuse\u202fthe\u202fsame tools as\u202fthe\u202fsource.<\/p>\n Making the security team available<\/a>\u202fto the newsroom\u202falso\u202fgoes a long way. Reporters\u202fknow how to\u202fask questions\u2014whether they’re doing an interview or trying to understand\u202fhow a password manager works, or how to use\u202fa YubiKey. Give them an opportunity to ask questions through an internal chat channel or weekly meetings. It all goes back to relationship building and awareness.<\/p>\n Natalia:\u202fHow has working in journalistic\u202fsecurity shaped your perspective on security?\u202f<\/strong><\/p>\n Runa:<\/strong> When I first started working for The Tor Project<\/a>, which develops free and open-source software for online anonymity, I was curious about how it\u2019s possible to use lines of code to achieve that. I didn\u2019t think much about the people who use it or what they use it for. But through that work, I learned a lot about the global impact The Tor Project has: from activists and journalists to security researchers and law enforcement. In interacting with reporters, I had to accept that there’s a difference between the ideal setup from a security standpoint and what’s going to get the job done. It would be great to give everyone a laptop with Tails or Qubes OS configured, but are they going to be able to use it for their work? At what point do we say that we\u2019ve found a happy middle between securing the data or systems, enabling the reporter, and accepting risk?<\/p>\n Natalia:\u202fHow can we continue\u202fto enhance\u202fsecurity\u202fin the\u202fnewsroom?\u202f\u202f<\/strong><\/p>\n Runa:<\/strong>\u202fWe need\u202fmore\u202fof a\u202ffocus on\u202fsecurity attacks that\u202ftarget and impact media organizations\u202fand reporters. Typically, when you read information about security attacks,\u202fit\u202fusually\u202fhighlights\u202fthe industries affected. You’ll\u202fsee\u202freferences\u202fto\u202fgovernment, education,\u202fand healthcare,\u202fbut what about\u202fmedia?<\/p>\n If you’re working at a media organization trying to understand what kind of digital threats you’re facing, where do you go to find information? I would love to see an organization or individual build a resource with a timeline of the kind of digital attacks we’ve seen against media organizations in the United States from 2015 to 2021. This would be a way to get a pulse on what’s happening to educate journalists of the risks, identify impact and risk to operations, and inform leadership.<\/p>\n To learn more about Microsoft Security solutions,\u00a0visit our\u00a0website<\/a>.\u00a0Bookmark the\u00a0Security blog<\/a>\u00a0to keep up with our expert coverage on security matters. Also, follow us at\u00a0@MSFTSecurity<\/a>\u00a0for the latest news and updates on cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":" In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager\u00a0Natalia Godyla talks with Runa Sandvik, an expert on journalistic security and the former Senior Director of Information Security at The New York Times. In this blog, Runa introduces the unique challenges and fundamentals of journalistic security.<\/p>\n","protected":false},"author":106,"featured_media":95358,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3675],"products":[],"threat-intelligence":[],"tags":[3822],"coauthors":[2433,2562],"class_list":["post-95313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-information-protection-and-governance","tag-microsoft-security-insights"],"yoast_head":"\nLearn more<\/h2>\n