Threat modelling a broadcast headend
A headend is an OT environment with a corporate network bolted on. Treating it like a normal office LAN is how content pirates and ransomware both find a way in.
Broadcast headends combine operational technology — multiplexers, modulators, IRDs, playout automation — with ordinary IT: domain controllers, file shares, vendor laptops. The security model has to respect both.
Three questions to start
What can reach the playout automation? What can reach the management VLAN? And who can plug a laptop into a spare switch port? Most incidents we assess start with the third question.
Segmentation that operations will accept
Segmentation fails when it breaks a legitimate workflow, so it has to be designed with the transmission team in the room. Management interfaces belong on a separate VLAN with tightly controlled jump hosts; vendor remote access belongs behind a session broker with logging, not a shared VPN account.
Content protection is part of security
For pay-TV operators, conditional access and key management are security-critical systems. Key servers should not share infrastructure with corporate services, and entitlement changes should be auditable.
Rehearse the response
An incident-response plan that has never been exercised is a document, not a capability. We run tabletop exercises against realistic scenarios: a lost transponder, a compromised automation server, a leaked CAS key.