Hey folks, it has been a year since my last update, and it’s been a busy one – lots of meeting, eating and greeting. I know I’ve seen several of you in my travels and I hope to see a few more as 2026 winds down!
When I was asked for a Tips ‘n Tricks article for this issue, the first thing that came to mind was cybersecurity… it’s kind of a hot topic this year for a few reasons.
First, in the U.S., the FCC came out with a rulemaking for EAS (Emergency Alerting System) cybersecurity. There have been issues with EAS gear getting compromised and bad actors sending false alerts out. In the process, the folks at the FCC indicated that the new rules would apply to anything the EAS signal might travel through that had an IP connection – such as STLs and transmitters, to name a few related items. That got some folks’ attention!
This was published in the Federal Register on July 30 of this year and officially took effect on September 29th. The highlights as far as broadcasters are concerned is that any IP facing equipment in the EAS signal path must be (a) behind a firewall, (b) have a 15-character password that doesn’t include a dictionary word (although passphrases consisting of multiple dictionary words are acceptable) and isn’t reused anywhere else on any product in the air chain (i.e. unique passwords for each piece of equipment), and (c) if a complex password can’t be used, then either software or hardware MFA is permitted.
Further to this – and more critical for the folks not in the U.S., the European Union is in the process of adopting the CRA (Cyber Resilience Act). This is a much deeper dive into IT security, covering all hardware and software products with digital elements placed on the market in the EU. While compliance isn’t mandatory, it definitely will figure into purchasing decisions, so you can be certain that both hardware and software manufacturers will be paying attention and adapting product to fit the requirements. The CRA focuses on both ends – on cybersecurity of the products themselves and on education of end users, so it’s a unique approach. It was originally proposed in 2021 and is set to take effect in stages between now and the end of 2027. You can expect to see some changes in how different manufacturers respond.
More information on the CRA can be found here. Note that there are links for even deeper dives throughout that article. Also note that we have no affiliation with Cyber Risk GmbH, but the article provides a great resource!
Regarding Nautel, I reached out to our software development lead – some of you may have met Cameron at NAB or seen him on various webinars. Some of the things we discussed have already been made part of the progressive web app software that will be replacing the AUI as we continue to work to get everything off Flash. I’ll only mention those that are already well into the implementation stage, but I’ll give some examples of things that you can expect to see – noting most of these will apply to many manufacturers and good network design/security in general.
As Cameron mentioned during our talk, the historical approach by most manufacturers has been “put a webserver in a device and hope the customer puts it behind a firewall.” As has been shown by the number of devices visible on the public internet, this has not proven to be the best solution…
Some of the things we discussed that you could expect to see coming out in the very near future would include:
- Signed software artifacts – All upgrade packages are digitally signed and verified before installation to ensure they haven’t been modified or tampered with.
- Zero Trust authorization – The transmitter is the source of truth for authentication and authorization. The browser is treated as an untrusted client and never decides what a user is permitted to do.
- No exposed inbound ports – Remote access is designed so customers don’t need to open firewall ports or configure port forwarding, significantly reducing the attack surface.
- Strong credential requirements – Password policies enforce modern security practices rather than allowing weak credentials.
That’s the short version – there’s quite a bit more already implemented for first release and more again that’s planned for future updates. I chose these items because a lot of this makes up the basis of any network security and should be implemented well beyond the transmitter site. Hopefully there’ll be some useful tidbits in there that folks can implement in their own network configurations!
Further to this, you could definitely expect to see manufacturers implementing encryption and various forms of MFA. That creates its own challenges, as tying to a device – sending a code to a trusted cellphone, for example – can be problematic, if the owner of the device leaves. Hardware dongles get lost of misplaced. The result could be setting up or using a station email account to receive an authentication token, or using an authenticator app – this is the sort of discussion happening at many manufacturers right now.
Definitely the more secure something is, the harder it will be to use. The reverse is also true – the easier it is to use, the less secure it will be. Finding the balance is always the challenge, so if you’ve got thoughts, feel free to send them over (jwelton@nautel.com) and I’ll pass them along. Unless those thoughts are about where to find the best barbecue – because if the answer is anywhere but Kansas City, I’ll need to do more research before making a judgement on whether to share the input!
Those are my thoughts for the moment – two more trade shows and a few more customers visits left in 2026, so it’s time for me to get rolling. See you all on my travels and happy engineering to all!
Jeff
Jeff Welton, has worked with Nautel for 30+ years. He is currently the Nautel Sales Manager for U.S. Central Region but previously he spent 16.5 years as a Nautel Customer Service Technician. A regular speaker and contributor on broadcast engineering, Jeff was elected to the Board of Directors for the Society of Broadcast Engineers in August 2023, and has been recognized with the following awards: 2020 NAB Radio Engineering Achievement Award; 2019 APRE Engineering Achievement Award; and 2018 SBE Educator of the Year Award.
Submissions for this Tips ‘n Tricks column are encouraged and if published you’ll receive a Nautel T-shirt. Submissions should be typed and emailed, with high resolution photos, to info@nautel.com using the subject line Tips ‘n Tricks.
