Media and Entertainment Identity Security Guide: Protecting Accounts, Content and Crews

In media and entertainment the most valuable assets, a brand's social accounts, an unreleased episode, a live broadcast feed, a journalist's contacts, are all protected mainly by identity, and the people holding that access are often freelancers, vendors and machines rather than staff. A single help desk call gave attackers Twitter's internal account tools in 2020, and one exposed GitHub token led to the New York Times source code leak in 2024. This guide covers the identity populations specific to broadcasters, studios, publishers, streaming services and games companies: newsroom and talent accounts, brand and distribution accounts, production crews and post-production vendors, broadcast and streaming machine identities, and audience accounts. It is written for IAM, security and production technology teams. For the sector's wider security programme (DDoS, CMS hardening, content provenance) see the Cybersecurity for Media and Publishing Guide; this page goes deeper on identity only.

Key takeaways

• Brand accounts are privileged accounts. A verified social or video channel can move markets or spread a scam to millions in minutes; manage it through named roles, hardware keys and a platform's business manager, never a shared password.
• Internal admin tools are the crown jewels. The 2020 Twitter compromise ran through internal account tools that more than 1,000 employees could use; any tool that can reset, impersonate or download customer accounts needs least privilege, a second approver and full logging.
• The crew changes every project. Freelancers, agencies and post-production houses join for weeks, so access must be issued per project, expire with it and be tied to the person through forensic watermarking and logs.
• Live production is now an IP network of machine identities. NMOS devices, encoders, playout and CDN origin all authenticate to each other; AMWA IS-10 and BCP-003-02 give broadcast control a standard OAuth 2.0 and JWT model.
• Journalists and talent are targets in their own right. Phishing-resistant MFA, personal-account hardening and a fast route to the security team matter more for them than any perimeter control.

The media identity landscape

Media organisations manage more external and short-term identities than most sectors, and the business pressure (air time, release dates, breaking news) favours speed over access control. Mapping each population to its owner is the first step.

Brand, channel and distribution accounts

A newsroom's verified account or a studio's official channel is an authenticated publishing system with an audience in the millions. Attackers want it for crypto scams, disinformation and extortion (Compromise Accounts: Social Media Accounts, T1586.001 in ATT&CK describes the general pattern). Two different failures recur: weak control of the organisation's own access to the account, and attacks on the platform's or the organisation's support processes.

• Use the platform's business layer: manage pages, channels and ad accounts through the platform's business or brand account features so that each person signs in with their own identity and holds a role, instead of everyone knowing the channel password.
• Hardware keys for owners and admins: where the platform supports security keys or passkeys, require them for every owner and admin role. Keep at least two owners from different teams so one departure or compromise does not lock the organisation out.
• Third-party publishing tools: scheduling and social management tools hold OAuth tokens to every channel. Review which tools are connected, remove those no longer used and require SSO and MFA on the tool itself, because it is a single point of control over all channels. See the SaaS and OAuth App Governance Guide.
• Session theft: infostealer malware on a social media manager's laptop can lift session cookies that bypass MFA entirely. Managed devices, browser isolation for personal browsing and short session lifetimes in the tools you control reduce the exposure.
• Recovery plan before you need it: record account IDs, owner identities and the platform's partner support contacts so the takeover response is a phone call, not a search. See the Social Media Account Takeover Playbook.

Lessons from the 2020 Twitter compromise

The New York State Department of Financial Services investigation is the most detailed public account of a media-platform identity attack. Attackers phoned Twitter employees posing as the IT help desk about VPN problems, sent them to a fake VPN login page, replayed their credentials on the real site in real time and had MFA prompts approved. They then targeted employees with access to internal account tools, which could reset passwords, change email addresses and turn MFA on or off. 130 accounts were compromised, 45 used to tweet, and about $118,000 in bitcoin was taken. The report notes that more than 1,000 employees had access to the tools and that Twitter had no CISO from December 2019 until the attack. Its access recommendations apply directly to any media business that operates a platform, a streaming service or a customer support console:

• Limit access to internal tools to what each role needs and recertify it regularly.
• Require stronger authentication for high-risk tools, and a second employee's approval for high-risk actions such as changing a verified account's email.
• Replace app-based MFA with hardware security keys, which the report says would have stopped this attack.
• Log and monitor privileged tool use in a SIEM and run regular vishing exercises.

See the Account Recovery and Help Desk Security Guide and the Phishing-Resistant MFA Guide.

Journalists, talent and high-risk staff

Reporters, editors, presenters and executives are targeted for their sources, their reach and their personal lives. The identity programme for them extends past the corporate tenant into personal email, phones and social accounts, because that is where attackers go when the corporate account is hard.

• Phishing-resistant MFA everywhere: FIDO2 security keys or device-bound passkeys on corporate accounts, and help to set the same up on personal email and social accounts. Issue two keys per person so a lost key is not a lock-out.
• Enhanced protection programmes: major consumer platforms offer enrolment programmes for high-risk users that enforce security keys and tighten recovery; offer to enrol staff who agree.
• SIM swap and number port protection: remove SMS as a recovery factor where possible and ask carriers to add port-out protection for high-risk staff. See the Mobile Communications Protection for High-Risk Individuals Guide.
• A fast escalation route: staff need one number or channel that reaches security out of hours when an account is taken over or a suspicious approach arrives. See the Executive Protection and Digital Footprint Guide.

Production crews, freelancers and post-production vendors

Film, television and game production run on temporary teams. A series might bring in hundreds of freelancers, several post-production houses, a VFX vendor, localisation partners and a marketing agency, each needing pre-release material. Studios have long set the bar for these vendors through the Motion Picture Association's Content Security Best Practices, which the Trusted Partner Network (TPN), wholly owned by the MPA, maintains and uses as the basis for vendor assessments.

Zero trust for production: MovieLabs CSAP

MovieLabs' Common Security Architecture for Production (CSAP, current download v1.3) is a zero trust architecture for cloud-based media creation that protects individual assets, not only the infrastructure. Its principles translate directly into identity requirements: assume the infrastructure may already be breached, authenticate every user, device and service before it takes part in any activity, make authentication mutual, and authorise all activity through policy. CSAP keeps authentication and authorisation sources separate, so a studio can trust a vendor's identity provider for authentication while keeping its own policy decision on what that person may see. Part 5B covers identity, authentication and authorisation policies, and security levels 100, 200 and 300 let a production apply stronger controls to its most sensitive assets.

Per-recipient watermarking is an identity control as much as a content one: it only deters leaks if every viewer is an individually authenticated person, which is why shared crew logins defeat it. See the Contractor Identity Lifecycle Guide and the Third-Party Access Guide.

Broadcast, live production and streaming machine identities

Live production has moved from SDI cables to IP networks under SMPTE ST 2110, controlled through AMWA's Networked Media Open Specifications (NMOS). Every camera, gateway, multiviewer and control system is now an endpoint that can be told to route or drop a feed, so the control plane needs authentication like any other API.

• NMOS authorisation: AMWA IS-10 lets an NMOS API server accept or reject requests depending on what a client is authorised to do. It is based on OAuth 2.0 and JSON Web Tokens: a control client presents credentials to an authorisation server, obtains an access token and sends it with each API call. AMWA BCP-003-02 recommends using IS-10 across NMOS systems, and treats encryption under BCP-003-01 as a prerequisite. Plan for device and controller registration with the authorisation server when buying new IP facilities.
• Device credentials: change default passwords on encoders, IP gateways and intercom before connecting them, use per-device credentials and keep management interfaces on a separate network. See the Device and IoT Identity Guide.
• Stream keys and ingest tokens: a stream key lets whoever holds it broadcast on your channel. Store keys in a secrets manager, rotate them after each event with external crews and use expiring keys where the platform offers them.
• CDN, origin and DRM: origin storage keys, CDN signing keys and DRM licence server credentials decide who can publish or play content. Separate the identities that can write to origin from those that serve it, and sign playback URLs with short expiry.

Code, data and integrations

Streaming services, publishers and games studios are software companies, and their breaches often start with a developer credential. In the New York Times GitHub breach one exposed token led to around 270GB of source code being posted publicly. The Twitch breach leaked around 6,000 repositories after a server misconfiguration, along with thousands of secrets. The controls are the general ones, applied with urgency:

• Fine-grained, expiring repository tokens and secret scanning on every repository and CI log.
• Workload identity for build, render and data pipelines instead of stored cloud keys. See the Secrets Management Guide.

Audience and subscriber accounts

Streaming, gaming and subscription accounts are resold in bulk after credential stuffing, and support desks are pressured to change the email on an account. The CIAM decisions specific to media are:

• Passkeys on TV and console apps: device-code sign-in (a code entered on a phone) avoids typing passwords on a remote control and pairs naturally with passkeys on the phone.
• Step-up on account changes: require re-authentication to change email, password, payment method or to add a profile, which are the resale steps.
• Support verification: agents should never change contact details on request without verification through an existing factor.

See the Customer IAM (CIAM) Guide and the Game Platform Account and Anti-Cheat Security Guide.

How to implement

The steps below are NHI Mgmt Group recommendations.

1. Inventory (weeks 1 to 4): list every brand and channel account with its owners, every internal tool that can act on customer or creator accounts, every vendor and freelancer population, and every machine credential in broadcast, streaming and build systems.
2. Brand accounts first (weeks 2 to 6): move channels into business manager roles, enforce security keys on owners and admins, remove ex-staff and unused publishing tools, and record recovery contacts.
3. High-risk staff (weeks 4 to 10): issue two security keys each, enrol willing staff in platform protection programmes and publish the out-of-hours escalation route.
4. Internal tools (months 2 to 4): cut access to account administration tools to named roles, add second-person approval for high-risk actions and send all use to the SIEM.
5. Production access (months 2 to 6): pilot project-scoped guest identities with automatic expiry on one production, measure onboarding time, then make it the default for new titles. Keep the old process available during the pilot so rollback is a policy change.
6. Broadcast and streaming (months 3 to 9): rotate stream keys and origin credentials into a secrets manager, specify IS-10 support in IP facility procurement, and test token issuance in a lab gallery before any live event.
7. Review and exercise (ongoing): quarterly role reviews for channels and tools, access review at every production wrap, and a tabletop based on a brand account takeover during a breaking story.

Decision guidance

• Federate vendors or issue guest accounts: federate large, TPN-assessed vendors with their own mature identity provider; issue guest accounts with your MFA policy to small vendors and individual freelancers.
• Security keys or passkeys: hardware keys suit brand account owners and high-risk staff because they work across platforms and survive phone loss; synced passkeys suit the wider workforce and audiences.
• Small publisher or large group: a small publisher should focus on social and CMS admin MFA, a password manager for any remaining shared credentials and removing leavers fast; a studio or broadcaster with live facilities needs IGA for project access, PAM for broadcast control and a CIAM platform.

Detection and measurement

• Log: role changes on brand accounts, new connected publishing apps, internal tool actions on customer or creator accounts, guest sign-ins to production storage, bulk downloads of pre-release content, stream key use from new ingest addresses, and new MFA registrations (Device Registration, T1098.005).
• Correlate: help desk reset followed by new device and tool access; MFA prompt storms (T1621); a freelancer account active after wrap; content downloads that do not match the recipient's watermark role.

Framework mapping

Common failure patterns

• Shared channel passwords: one login for the brand account known to the whole social team and the agency, so leavers keep access and no action can be attributed.
• Too many people on internal tools: account administration consoles open to broad support and engineering groups, as in the 2020 Twitter compromise, where more than 1,000 employees had access.
• App-based MFA on high-value accounts: push and code approvals that a convincing caller can talk someone through, where a hardware key would have held.
• Freelancers who never leave: guest accounts and shared links that outlive the production by years.
• Static stream keys and device defaults: stream keys reused across events and broadcast devices still on factory credentials.
• Secrets in code: repository tokens and cloud keys in source, as the Twitch breach showed when thousands of secrets leaked with the code.

Practitioner checklist

• Move every brand, channel and distribution account into named roles with at least two owners.
• Require hardware security keys for brand account owners, admins and high-risk editorial staff.
• Review and remove unused social publishing and scheduling tools and their tokens.
• Restrict internal account administration tools to named roles with second-person approval for high-risk actions.
• Issue production access per title with an expiry on the wrap date and remove it automatically.
• Require named accounts for every vendor staff member and align vendor contracts with the MPA best practices.
• Use authenticated, per-recipient watermarked access for dailies and screeners.
• Specify AMWA IS-10 support and per-device credentials in IP broadcast procurement.
• Move stream keys, origin keys and DRM credentials into a secrets manager with rotation dates.
• Rehearse a brand account takeover during a live news event.

Standards and references

• New York State Department of Financial Services: Twitter Investigation Report
• Trusted Partner Network: MPA Content Security Best Practices and TPN
• MovieLabs: Common Security Architecture for Production (CSAP)
• AMWA: IS-10 NMOS Authorization Specification
• AMWA: BCP-003-02 Authorization in NMOS Systems
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0
• MITRE ATT&CK: Compromise Accounts: Social Media Accounts (T1586.001)

Related NHI Mgmt Group resources: Cybersecurity for Media and Publishing Guide · Social Media Account Takeover Playbook · Contractor Identity Lifecycle Guide · Phishing-Resistant MFA Guide · AI Content Provenance and C2PA Guide