Casino cybersecurity guide: protecting against cyber attacks

What is casino cybersecurity?

Cybersecurity for casinos relates to protecting networks, devices and data from unauthorized access. For the gaming industry, numerous technologies are deployed to help run daily operations. From casino surveillance cameras and access control to gaming machines and payment systems, these systems are a potential base for a cyber attack on casinos.

An expert predicts that cybercrime will cost the world $10.5 trillion USD by 2025, reflecting the growing risk of casino cyber attacks. As a result, close attention should be paid to enhancing casino cybersecurity strategy to prevent cyber attacks that could harm operations, lead to millions of dollars in damage, and cause reputational harm.

Why is casino cybersecurity important?

The importance of cybersecurity for casinos couldn’t be overstated. Recent news of a group of hackers successfully carrying out a cyber attack against two of the world’s largest casinos shows the potential disruption they can cause to any gaming operation. This event saw a 10-day disruption that affected gambling payouts, hotel check-ins and significant data breaches. It is estimated that the disruption and damage cost one of the casinos $100 million USD, while the other reportedly gave into the hacker group’s ransom demands.

Casino and gaming operations need a robust cybersecurity strategy. An effective strategy can help to keep daily casino and gaming operations running smoothly, such as carrying out financial transactions, maintaining gaming machines and welcoming guests. Additionally, a strong cybersecurity defense can protect a casino’s finances, from an attacker accessing the business’ funds and the financial costs incurred if a cyberattack occurs. The safety of customers and staff can also be enhanced with a powerful cybersecurity strategy by protecting their well-being, personal data and experience. From a business perspective, this can lead to happy patrons who are more likely to return to enjoy the experience and spend their money again.

Why are casinos a top target for hackers?

Casinos are a top target for hackers for a variety of reasons. From having a large surface area for a hacker to penetrate one of the casino’s systems or networks to the lure of a large database of personal data, here are a few of the top reasons why casinos are an attractive target for hackers.

Large volume of personal data

Casinos house large amounts of data, from personally identifiable information (PII) to financial data. This valuable information attracts the attention of hackers, as obtaining it can allow the individual or group to use the data for criminal activity, such as identity theft, financial fraud and money laundering.

Numerous channels for a cyber attack

Modern casinos often have other businesses like hotels, retail stores and restaurants all located under one premises for a complete entertainment experience. However, this improvement in convenience and customer experience comes at a potential cost for the casino.

From video security and alarm systems to slot machines and payment terminals, it is difficult for casino IT and security teams to secure each device, system and network, leaving them vulnerable to casino cyber attacks. In one unique incident, a casino fell victim to hackers who accessed private data by exploiting an internet-connected fish tank thermometer. This ​“behind the back” security breach was linked to this casino hack and goes to show the innovative ways in which a bad actor can breach a casino’s cybersecurity defenses.

Willingness to submit to the hacker’s demands

Due to the nature of the industry and the huge cashflows involved, casinos often attract ransomware cyber attacks. The disruption, downtime, and revenue loss that these cyber attacks can cause mean that some casinos are more inclined to give in to the hacker’s demands to avoid further disruption and reputational harm.

Best practices to avoid casino cyber attacks

Next, businesses in the gaming industry need to implement key steps to improve their cybersecurity posture. Some of the following best practices are straightforward to follow, and some require expertise and investment, but these proven practices can help highlight vulnerabilities and improve casino cybersecurity.

1. Regularly perform security assessments and testing

One of the most important best practices is to perform security assessments and penetration testing to analyze your casino cybersecurity defenses. This process will help you evaluate the effectiveness of your defenses and identify any potential vulnerabilities that bad actors may exploit to carry out a cyber attack on casinos.

2. Perform software and system updates

As mentioned earlier, with so many connected and integrated technologies, such as video security, gaming businesses should install the latest updates and upgrades when available. This will help remove outdated software from your system and ensure your existing solutions don’t contain any known vulnerabilities and can handle the latest casino cyber attacks.

3. Implement protective controls and secure data

With so many security technologies and systems in use, gaming businesses should look to implement protective controls to help secure private data from bad actors. This includes:

• Install security software: Use firewalls and antivirus programs across your systems and perform regular security updates and audits.
• Encrypt data: Encrypt data from the point of collection to rest. This helps better protect that data from being intercepted and is crucial for payment processing, where it’s vital to protect the customer’s credit card details. If a hacker does gain access to the data pack, it will take them significantly longer to break the encryption to access the information. This means the security and IT teams will have more time to discover and respond to the hack in progress to shut it down.
• Access control systems: Implement a robust access control system to help secure restricted spaces, such as data centers. These physical security barriers at key access points help limit access to hardware from which hackers, or even disgruntled employees, can enter the wider database and network for their nefarious purposes.

4. Network segmentation

As a casino may also be housed in the same premises as a hotel, restaurant and retail store, the casino’s systems will likely be interconnected with the other businesses’ systems. As a result, a hacker who can gain access through one of these businesses can move laterally across the others and access systems without resistance.

With segmentation, casinos can divide their network into isolated segments, allowing for more visibility and control. It also stops a hacker in its tracks, preventing further casino cybersecurity damage and disruption, as the bad actor won’t be able to access more areas of the network via lateral and horizontal movement.

5. Train your staff

Casino and gaming operations staff are often not trained to the levels required to detect the latest cybersecurity threats, such as social engineering attempts, or to carry out proper cyber hygiene. This lack of awareness and understanding creates a fertile ground for an attacker to navigate cybersecurity defenses and carry out cyber attacks on a casino.

Implementing a thorough cybersecurity staff training program that is updated and revisited regularly can educate staff on the latest cybersecurity threats, best practices and appropriate incident response procedures.

6. Regularly review and restrict access privileges

A key best practice that casinos in the gaming industry should follow is to regularly review and limit who has access to networks, data and security systems. By only allowing a user the minimum access privilege they need to perform their role, casinos can significantly reduce the chances of a hack using a staff member’s access credentials.

7. Adopt strong passwords and multi-factor authentication (MFA)

Casinos should adopt a strict strong password policy that focuses on length, character requirements and requires updating every 90 days. This not only relates to the login and account information for internal staff, such as security operators accessing a video security system. It also extends to customers who are using a casino’s online platform for their gambling activities. This is to help protect their personal information, such as their name, address and financial information.

Alongside a strong password policy, the casino should adopt MFA for all staff and customers using its online platform. This extra security layer helps bolster defenses and reduces the potential of casino cyber attacks should a hacker learn of an individual’s login details.

8. Vet your vendors

According to the FBI, ransomware threat groups exploit vendor-control remote access systems to hack into casino servers and initiate casino cyber attacks. This warning follows the ransomware security attacks linked to being behind the casino hacks of two major casinos mentioned earlier in this guide. Additionally, a 2022 report states that 54% of businesses have suffered a data breach caused by a third party. This news highlights the need for businesses in the gaming industry to vet their vendors to understand the strength of their cybersecurity posture and whether they are following industry protocol.

9. Plan for casino cyber attacks

It’s not possible to prevent every casino cybersecurity attack. Therefore, businesses must include a detailed incident response plan as part of their casino cybersecurity strategy. This will help ensure the correct steps are followed to minimize the potential damage and disruption. Such plans are essential to regulatory compliance and help casino security and IT teams understand their roles and responsibilities should an attack occur.

It also pays to collaborate with partners in the gaming industry, as well as law enforcement, to understand the latest threats, vulnerabilities and effective countermeasures.

Conclusion

With the rise in casino cyber attacks, the gaming industry faces difficulty mitigating risk and successfully protecting against every type of cyber attack. The large volume of technologies used by staff and customers in person and online means that the surface area for a potential casino cybersecurity breach is greater, making it an attractive victim for hackers and a challenge for casinos to safeguard. But by following the above best practices, casinos can substantially improve their cybersecurity posture, comply with industry regulations, and offer a safer gaming experience for their customers.