Preventing Cyberattacks on Music Festival Operations.

Advances in the use of technology by music festival entities is increasing the risks from cyberattacks. To counter this increased threat, festival organisers should be building operational resilience to ensure they do not become a target. What can organisers do to build a cyberattack prevention environment within their business practices.

Music festivals are especially attractive to criminals because of the potential high value funds being exchanged in the ticketing process. This is no longer simply an IT concern but has become a critical operational risk. More processes have become targets as well as ticketing and include cashless payments, production systems, communications, accreditation, transport, CCTV, and even power monitoring. These all use digital data over wireless networks, and this makes them vulnerable. What are the key aspects to cyberattack prevention for music festival entities.

Common Cyberattack Threats.
Cyber-criminal networks focus on music festivals because of the high value ticketing transactions but also because many festivals also hold large databases with customer information. Festival entities employ large temporary workforces and third-party contractors which increases the risk exposure. Probably the greatest threat to a festival is a ransomware attack where numerous critical operational systems are hijacked at a key stage in the planning process forcing organisers to pay for the release of critical operational systems. Also common are attacks on customer databases which then become targets of phishing emails where criminals intercept payments, steal personal credentials or install malware, for example. Although many festival entities use third party suppliers for ticketing, some still use their own in-house systems, and these are vulnerable to attack. Criminals aim to steal customer accounts, generate fake tickets, conduct refund fraud, or purchase tickets using stolen payment cards. Common attacks on cashless payment gateways can cause disruption of wireless networks and vendor operations, resulting in lost revenue. Less common are insider threats from disgruntled staff and temporary workers who have access to critical systems where their motivation is not financial but to disrupt festival operations.

The Cyberattack Prevention Strategy for Festival Entities.
When festival organisers are conducting their detailed risk management assessments during the planning phase, it must include cybersecurity threats. This should clearly define executive ownership along with cyber policies, incident report planning, insurance, and regular audits. Most large-scale outdoor festivals rely on wireless networks that enable digital operations and provide Wi-Fi services to festival-goers. It is essential that there is clear separation between public, production, and payments networks with additional levels of security. Access to critical systems should only be given to vetted individuals who must use multi-factor authentication for cloud platforms like finance systems, ticketing platforms, and event management systems, for example. The key to everyday cyber-attack prevention is staff training and festival organisers should ensure that appropriate personnel are fully aware of potential risks. Training helps staff to recognise phishing attacks so they can report any suspicious activity. In addition, operational practices should cover use and management of secure passwords along with mobile device security. Organisers should make sure that all critical operational systems have robust backup processes that are stored offline with daily cloud backup updates in multiple locations with regular recovery testing.

Third Party Management.
Music festivals use numerous third-party contractors and suppliers, and each one needs to confirm their own cybersecurity processes and procedures which often form part of contract agreements. This is especially relevant for ticketing platform suppliers and cashless payment vendors but also applies to Wi-Fi providers, security contractors, production companies and accreditation or event management software providers. This can be evidenced with security certifications demonstrating encryption standards, backup procedures, and access management processes, for example. Data protection compliance and robust cybersecurity protocols are becoming a standard requirement for contractors and vendors who are bidding to work with a festival entity.

Future Threats.
Cyber-attacks on music festivals will continue with ever increasing sophistication, and organisers need to be constantly appraised of the latest developments. Advances in AI is spawning an increase in AI generated phishing emails and voice impersonation. Deepfake audio or video can be used to impersonate senior festival staff or even artists to gain authorisation for fraudulent payments, for example. Other new targets include CCTV, smart lighting systems, environmental sensors, and access control systems. Attacks will also likely increase on third party cloud APIs that integrate ticketing, payments and customer data. A mixture of robust technical controls, trained staff, secure supplier relationships and incident response plans can protect operations and ensure business continuity.

For festival organisers planning their next event using a software management platform like Festival Pro gives them all the functionality they need manage every aspect of their event logistics. The guys who are responsible for this software have been in the front line of event management for many years and the features are built from that experience and are performance artists themselves. The Festival Pro platform is easy to use and has comprehensive features with specific modules for managing artists, contractors, venues/stages, vendors, volunteers, sponsors, guestlists, ticketing, site planning, cashless payments and contactless ordering.

Image by geralt via Pixabay

<< Back to articles