From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Sports

Caroline Nihill

itbrew.com

For many companies, big events such as the FIFA World Cup or the Super Bowl are critical for marketing and revenue. However, cybersecurity experts are increasingly concerned about bad actors who could take advantage of any new IT infrastructure spun up for those events.

Just this month, cybersecurity threat intelligence company BforeAI found that bad actors have created malicious infrastructure in preparation for the 

, which will host matches in North American cities such as Los Angeles, Boston, Houston, Philadelphia, Miami, Toronto, and Mexico City in summer 2026.

, researchers identified domains registered for the World Cup, suggesting that attackers are repurposing old domains for new threat campaigns or registering new ones in advance to avoid detection and improve theft success rates.

For example, BforeAI found a webpage that promotes itself as helping fans find hotels and restaurants with electric vehicle chargers for the World Cup, as well as a partnership promotion that encourages companies to apply to participate.

Abu Qureshi, the lead threat intelligence and mitigation researcher at BforeAI, said that bad actors could target enterprises for this event (and others) if they are doing a sponsorship for a related event or if the company is involved in a fan event in a host city.

“For a corporate event to happen, you have to set up new infrastructure,” Qureshi said. “Cybercriminals love when companies have to set up new infrastructure because it means they can get in the middle of that.”

Qureshi isn’t alone in raising concerns about cybersecurity for enterprises taking part in a large-scale, geographically tied event. Brent Johnson, a cybersecurity and infrastructure security officer for Bluefin, said that these events bring high-value targets for cyberattackers.

Specifically, Johnson said he would be concerned about a company standing up networking infrastructure for an event with lower-level systems that are connected to enterprise infrastructure. That could lead to a breach leaking back to a company’s frameworks and database.

“Setting up new infrastructure is a challenge if you’re not putting some of these security measures in place,” Johnson said. “We’re sitting there with months and years to plan, and putting security controls in place and hardening and configuring these things for specific environments and tuning. How you do that in a major event without much time is quite the challenge.”

VP of portfolio marketing at Checkmarx Eran Kinsbruner agreed that enterprises often are forced into short timelines if they choose to participate in big events.

“When these kind of events are happening, you’re trying to expedite as much as you can, your development, so you can obviously get to market as fast as possible and publish, and make all this noise around it,” Kinsbruner said.

“When enterprises are going and doing that, they need to be careful with regards to, what are the shortcuts that are being taken from security and quality perspective? It’s not like you have six months or 10 months, usually it’s a bit less time to prepare.”

The potential consequences of failing to adequately secure event-related infrastructure are massive. In the event of a breach, not only would a company be at risk of losing proprietary information, but the brand damage could prevent the company from participating in future events, according to Johnson.

If a company desires a corporate affiliation with an event like the World Cup, Qureshi said that it should push as “much as possible” to sanction its involvement with the organization heading up the event. A sanctioned event, specifically as it pertains to sporting events, is one that receives official approval from the organization that is managing the event.

“I would weigh on FIFA, and verify local promotions that are happening with World Cups ties to make sure that my enterprise is using the appropriate avenue to link up with a FIFA-sanctioned event,” Qureshi said.

Qureshi advised companies and their security professionals to register infrastructure with the organization hosting the event earlier rather than later, especially since newer infrastructure should undergo extensive testing.

Even better, companies can rely on what’s already in place. “Rather than setting up a brand new infrastructure, you would utilize existing infrastructure,” Qureshi said. “Leveraging known and existing infrastructure is a much better idea than setting up new infrastructure because then you’re just fighting with the attacker to prove who was first.”

This sort of cyber threat isn’t limited to sporting events. 

, the online ticketing platform for events, was the target of hackers who were allegedly able to export 440,000 tickets for the Taylor Swift Eras Tour, leaking 170,000 barcodes as proof that they’d stolen the ticket information.

The attackers told Ticketmaster to pay them $2 million or they’d leak 680 million users’ information and 30 million ticket barcodes for events, including those involving other musical artists and sporting events.

Fisher noted that during this ransomware scheme, bad actors were able to get into the enterprise’s infrastructure, something that could happen to any organization offering online web services.

Qureshi also recommended monitoring for event-specific keyword combinations for infrastructure being set up on the deep web, in places like invitation-only forums, encrypted messaging channels, and underground marketplaces, so that cyber pros can pinpoint who is talking about their enterprise and setting up domains and website content.

“It would be very advisable to get ahead of any sort of activity that you’re seeing about your enterprise environment,” Qureshi said.

What big events like the World Cup mean for cybersecurity professionals

One CISO says that an event-related cyberattack could lead to a loss of proprietary information and a reputation of security.

Kelcee Griffis

For CommScope’s Thierry Chau, capacity and caution are king.

The network infrastructure company operates cellular data and wireless connectivity systems in more than two-thirds of the NFL stadiums across the country, supporting everything that makes a live event tick, from mobile entry and cashless sales to fan-generated internet traffic. (How else will you post that #touchdown tweet?)

Chau, CommScope’s VP of market development who specializes in large venues, recently spoke with IT Brew about the challenges of keeping high-density networks functioning and safe—whether they’re enabling fans to buy a beer during a Sunday night football game or Swifties trying to livestream a performance of “All Too Well (10 Minute Version).”

According to Chau, the Covid-19 pandemic accelerated the adoption of wireless, touchless, and cashless technologies, putting a premium on network stability and capacity.

“The adoption rate was forced upon us, and it was kind of expected. So, [in] places like the Dallas Cowboys and a lot of [other] NFL stadiums, there was no option to have paper tickets. To reopen, they went ticketless,” he said. “That puts a demand on the wireless network.”

Keeping pace with that demand means making sure the venue has enough bandwidth to accommodate everyone at once. On a high level, this means ensuring access to licensed and unlicensed spectrum that can carry high-density 5G mobile and Wi-Fi traffic, he said.

“Both sides have technical challenges around putting that much spectrum and that much gear into an area that’s fairly confined,” Chau said.

From a security perspective, Chau said admins typically build privacy into a venue’s infrastructure so that users can’t see other network users, or so that the default internet gateway is the only host that shows up in a network scan.

Large-scale networks are also engineered to spot and prevent popular scams, like the “evil twin” scheme that mimics a venue’s real Wi-Fi network and tries to steal a user’s data once someone unwittingly connects to it.

Most enterprise Wi-Fi networks can detect these “malicious rogues”and prevent other users from connecting while admins pinpoint the source and shut them down, according to Chau. Administrators can apply artificial intelligence tools to “fingerprint” such behaviors and proactively alert security staff the next time the pattern surfaces, he said.

In man-in-the-middle attacks, another common scam, a bad actor will try to capture signals emanating from users’ phones searching for networks to which they’ve previously connected. (That’s why Chau said you should always tell your phone to “forget” the coffee shop’s Wi-Fi network when you’re done using it.) Use of an encrypted browser usually provides some protection against bad actors tracking your online activity this way, he noted.

Administrators also have to make sure the network isn’t consumed by capacity-hogging background apps.

Photo syncing services that automatically start dumping freshly taken gameday selfies and winning-touchdown shots into the cloud used to be a problem. Now, admins “have gotten a little smarter,” Chau said. “They’ll filter some of those sites out so that traffic can be consumed for other things, as opposed to just being consumed directly with uploading photos.”

Chau’s takeaway for network administrators? Make sure you think about upgrades holistically, not in a piecemeal fashion. After all, fans won’t be able to enjoy the touchless venue entry or super-fast Wi-Fi if their virtual tickets refuse to load or the DHCP server is bottlenecked.

“When you’re building a large-scale network, everything has to scale within that ecosystem, not just the access, or the switching. The core also has to come, and the backhaul as well,” Chau said. “It’s only as strong as that least common denominator.”

Keeping fans connected, safe is top priority for network admins.

Security Super Bowl: How NFL stadiums think about IT

CommScope VP says scaling up the whole network—not just pieces of it—is key.

Security Super Bowl: Here’s how stadiums think about IT

Eoin Higgins

You might think a baseball team like the Boston Red Sox generates a lot of data, and you’d be right: Player stats, payroll records, ticket sales, years without a World Series win, the list goes on. But you might not be prepared for the number of apps and services it uses to manage said data.

“The Red Sox actually have…if you can believe this—I was shocked myself—over one thousand different applications that they’re running at any given time,” said Simon Taylor, founder and CEO of cloud security provider HYCU.

All that data needs protection from bad actors, which is why a recent partnership between the Boston Red Sox and cloud security provider HYCU could cause ransomware attacks against the iconic baseball team to strike out.

Taylor told IT Brew that the deal, announced in May, between the two Boston-based organizations allows the data-heavy business of baseball to protect its information.

“At a very high level, I can tell you that every baseball team, whoever it is, has an enormous amount of data they’re capturing on a daily, hourly, minute-by-minute basis, and it’s not just the classic IT infrastructure data,” Taylor said. “The Red Sox have cataloged, managed, and they probably have an enormous amount of data that really provides a deep history of baseball as a sport, and is leveraged by the baseball team and franchise to support all of their ongoing daily activities.”

 That means a lot of data in the cloud, which needs backing up and protecting. Brian Shield, Red Sox SVP and CTO, 

 in May on announcement of the deal that because “the business of baseball is very complex,” the team needed to modernize its cloud capabilities.

“As our data protection needs continue to grow, we [need] a more effective way to protect our mission-critical data and HYCU has allowed us to do that,” Shield said.

Data will be backed up to cloud storage company Wasabi via the HYCU Protégé DPaaS platform.

 Attackers are likely to target the Red Sox for a couple of reasons, Taylor told IT Brew. The organization is a money machine, yes, but there’s also the prestige that comes with a successful attack on an institution with huge brand recognition.

“An organization like the Boston Red Sox has cache and cash,” Taylor said.

It’s a real concern for IT leaders across the sports industry. At a panel at RSA 2023 on sports cyber threats, NHL CISO Dave Munroe 

 the attack surface that exists in arenas and around teams—and how that means security teams need to take care of everyone in the organization and the building.

“We have to really protect all of those people, even someone who’s doing payroll, or someone who’s in HR—they’re all part of the brand, they’re all an extension of the brand,” Munroe said at the time. “And we have to protect them as such.”

 Of particular concern is, of course, ransomware. As IT Brew has reported, attacks have increased across all industries over the past year, and sport is no exception—most notoriously in February 2022, when the San Francisco 49ers suffered an 

Taylor told IT Brew that the question isn’t if a ransomware attack succeeds, but how to manage that attack when it happens. For companies like HYCU, that means making sure that data is encrypted and recoverable.

“Everything that HYCU does is fully encrypted; everything that HYCU builds is on a hardened Linux base, or code, so it’s not Windows,” Taylor said.

 Attackers target sports teams, too—so the Red Sox are taking steps to protect information

“An organization like the Boston Red Sox has cache and cash,” HYCU CEO Simon Taylor tells IT Brew.

Every industry is susceptible to hacking, and US sports are no exception. The industry pulls in 

 of dollars a year and has an audience of millions across the major franchises, making it an appealing target for threat actors.

At the RSA 2023 conference in April, security heads from the NFL, NHL, and NBA 

 to discuss how they manage the threats to fans and players. During the panel, moderated by FBI Cyber Division Section Chief Joseph Szczerba, the cybersecurity experts discussed their biggest challenges.

Sporting-event cybersecurity is a priority from entrance to egress, NFL CISO Tomás Maldonado said. Maldonado explained that his job starts when people buy tickets online. Any cyber event that could affect the consumer from that moment until they get home from the game is on his radar. It’s a matter of scale.

“Normally, you probably went to the venue and came back and you were happy or sad depending upon what the outcome was—you weren’t thinking about anything digitally impacting your experience,” Maldonado said. “And that’s because we were able to do our job and connect the dots for you to be able to have that experience.”

That doesn’t mean things are easy. In 2016, 

, seemingly angry over the country’s exclusion from the Olympics, released information on US and other athletes competing at the games. The San Francisco 49ers were the 

 in February 2022, and 10 months later, during the World Cup, hackers 

 during the airing of the semifinal match between France and Morocco.

One of the biggest problems of managing cybersecurity threats during sporting events, NHL CISO Dave Munroe said, is the number of “high-profile individuals” in the arena at any one time. This includes players and celebrity fans, all of whom would be juicy targets for threat actors—but the threat surface includes everyone else, too.

“We have to really protect all of those people, even someone who’s doing payroll, or someone who’s in HR—they’re all part of the brand, they’re all an extension of the brand,” Munroe said. “And we have to protect them as such.”

Finals make things even wilder, said NBA CISO Steve Grossman, but protection comes in part from teamwork. The back and forth collaboration between leagues helps them all to manage the unique industry challenges that come from the world of professional sports. Working together in concert with the FBI makes that process smoother.

“We make sure that we’re reaching out to the field office, we make sure that we are engaging with CISA,” Grossman said, and “ that everybody, from an all-hands-on-deck perspective, has visibility into really what’s going on in a city where we’re hosting a tier-one type of event.”

a basketball going into a net, but the net looks like a phone with a podcast on it

Sports

What big events like the World Cup mean for cybersecurity professionals

Security Super Bowl: Here’s how stadiums think about IT

Attackers target sports teams, too—so the Red Sox are taking steps to protect information

Sports industry cybersecurity pros talk shop

Top insights for IT pros