Trusted Platform, Trusted Game

Trusted Platform, Trusted Game

Speakers: Temi Adebambo (CISO, Xbox), Nicole Dove (Head of Security, Games, Riot Games), Jerich Beason (CISO, WM)

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=dJMzrOcI9Nc

Overview

The gaming industry stands as one of the most high-pressure and high-velocity sectors in technology, where security is not merely a technical challenge but a deeply personal concern for millions of players worldwide. This Black Hat MEA talk, "Trusted Platform, Trusted Game," brought together two exceptional leaders in gaming security: Temi Adebambo, CISO at Xbox (Microsoft), and Nicole Dove, Head of Security for Games at Riot Games, moderated by Jerich Beason, CISO at WM. The discussion delved into the unique cybersecurity landscape of gaming, contrasting it with traditional enterprise security and highlighting the intricate balance required to protect intellectual property, maintain player trust, and ensure seamless experiences.

The core of the conversation revolved around the unprecedented scale of threats, the unconventional nature of adversaries (often the players themselves), and the imperative to embed security deeply into the entire game development lifecycle without stifling creativity or introducing friction. The speakers shared their philosophies on designing secure platforms, leveraging advanced technologies like AI for anomaly detection, and managing the delicate interplay between confidentiality, integrity, and availability in an industry where release dates are sacrosanct and player loyalty is paramount. This talk offers crucial insights for any security professional grappling with the complexities of consumer-facing, high-stakes digital environments.

Background

▶ Watch: Speakers' diverse paths into gaming security (0:40)

The journey into gaming security for both Temi Adebambo and Nicole Dove highlights the diverse paths professionals take to this specialized field. Temi, with over 20 years in cybersecurity, found his passion for gaming converging with his professional expertise, describing it as an "impossible opportunity to pass up." His background provides a perspective rooted in traditional enterprise security, which he now applies to the unique demands of Xbox. Nicole, on the other hand, began her career in gaming with voiceover work for titles like Grand Theft Auto, later transitioning into risk and then cybersecurity about a decade ago. Her experience offers a "gamer turned security expert" viewpoint, deeply empathetic to the player experience.

The fundamental problem addressed by the speakers is the inherent divergence of gaming security from traditional enterprise models. In a typical enterprise, security focuses on protecting customer data from external adversaries. In gaming, however, the customer base is often also the attacker base. Players are motivated not just by financial gain, but by passion, competitive advantage, and the desire to circumvent game mechanics through cheats or exploits. This creates a complex "twist on insider threat" where the very users who drive revenue can simultaneously pose significant risks to the game's integrity and community. Furthermore, the expected security maturity of gamers, ranging from 8-year-olds to casual players, is often lower than that of enterprise users. This necessitates building security "by default" and throughout all layers, rather than relying on user vigilance. This problem is exacerbated by the internal structure of gaming companies, where a significant portion of employees are engineers and creatives, many of whom are also avid gamers, presenting unique insider threat challenges related to IP protection and unapproved releases.

Key Findings

▶ Watch: Integrating security across the entire game lifecycle (6:00)

The talk unveiled several critical findings that underscore the distinct challenges and innovative solutions within gaming security:

• The Player as Adversary: A central theme was the unique dynamic where the customer base is simultaneously the primary source of attacks. Gamers, driven by passion and competitive spirit, actively seek exploits and cheats to gain an advantage, directly threatening the integrity and community health of the game. This phenomenon is directly correlated with revenue growth; as a game becomes more popular, so does the motivation to attack it.
• Secure by Design, Secure by Default, Secure Operations: This philosophy forms the bedrock of gaming security. It emphasizes integrating security from the absolute earliest stages of ideation (e.g., threat modeling a AAA game three years before release), ensuring that the default user experience is secure, and maintaining robust security practices throughout the operational lifespan of the game. This contrasts with traditional enterprise approaches where security might be an add-on.
• Unprecedented Scale of Threat Landscape: Gaming platforms deal with an immense volume of data and potential threats. Xbox, for instance, manages 500 million active monthly gamers on its first-party titles and processes approximately 75 terabytes of telemetry data daily. This scale translates into an astronomical number of alerts, potentially 3 trillion alerts per year, which necessitates advanced techniques for management.
• AI for Anomaly Detection: To cope with the sheer volume of data and alerts, Artificial Intelligence (AI) is indispensable for anomaly detection. While AI may not yet differentiate between a player being "creative and novel" versus "cheating," it can effectively flag abnormal behavior, reducing 3 trillion alerts to a manageable 50 actionable events per year for human analysts.
• Balancing the CIA Triad under Extreme Pressure: The traditional security triad of Confidentiality, Integrity, and Availability takes on unique dimensions in gaming. While integrity (fair play, anti-cheat) and availability (no lag, always-on service) are critical for player experience, confidentiality of intellectual property (IP), release dates, and surprise content is equally, if not more, damaging when compromised. Leaks can derail marketing campaigns, shift market dynamics, and impact business decisions significantly. The inflexible "hard dates" for game releases further intensify this pressure, demanding impeccable security despite unpredictable cyber threats.
• Supply Chain as a Critical Vulnerability: The heavy reliance on numerous third-party vendors and development partners makes the supply chain a crucial area for security focus. Ensuring the reliability and security of these partners is paramount for maintaining the seamless, frictionless experience players expect.
• Identity as the New Perimeter: With players and employees often being avid gamers, identity protection becomes a key focus. Securing accounts against takeover attempts and preventing internal access to sensitive IP are ongoing challenges.
• Protecting Player Experience (PX): Any security measure must be carefully designed to avoid negatively impacting the player experience. This includes minimizing lag, preventing account takeovers and smurfing (experienced players using new accounts to play against novices), and mitigating toxicity within game communities to foster a safe environment for all players.

Technical Deep Dive

▶ Watch: Philosophy: Secure by design, secure by default (8:00)

The technical strategies employed in gaming security are characterized by a proactive, deeply integrated approach, often leveraging cutting-edge technologies to manage immense scale and unique threat vectors.

At the heart of the operational security philosophy is "secure by design, secure by default, and secure operations." This begins years before a game's release, particularly for AAA titles. For instance, Temi Adebambo highlighted that threat modeling commences three years out, even before the story narrative is finalized. This initial phase considers whether a game will be multiplayer or cross-platform, anticipating potential attack vectors and building foundational security into the architecture. As development progresses, this involves rigorous adherence to a secure development lifecycle (SDL), incorporating penetration testing, code reviews, and other security gates throughout the process. Nicole Dove elaborated on this, detailing the creation of secure and robust spaces for ideation, followed by robust infrastructure security programs that ensure the use of secure base images and secure containers. Data flow diagrams are routinely subjected to threat modeling early in the process to identify and mitigate risks.

A key differentiator from enterprise security is the emphasis on "secure by default." Gaming platforms cannot assume a high level of security awareness from their users. Temi explained that the default behavior in a game should always be to be secure, with options to open things up only if the user explicitly chooses to. This principle extends beyond technical configurations to trust and safety features, such as limiting the kind of language used in communication channels to prevent bullying and harassment. Users can adjust these settings for more "adult language" if desired, but the default is always safe and secure. This approach is vital when considering the diverse age range of players, from 8-year-olds who might click on "free coins" links to adults.

To foster innovation while maintaining security, gaming companies decentralize security responsibilities. With a significant portion of staff being developers and creatives, security is "baked into the templates" and "pipeline design." This ensures that security measures don't impede creativity, allowing teams to "innovate at the speed of imagination." This means providing developers with secure frameworks and tools that guide them towards secure coding practices rather than imposing restrictive security gates late in the development cycle.

The scale of the gaming threat landscape necessitates advanced solutions. With platforms like Xbox generating 75 terabytes of telemetry data daily from 500 million active monthly gamers, manual analysis is impossible. This is where AI for anomaly detection becomes crucial. Temi described how AI can process trillions of alerts annually, sifting through vast datasets to identify behaviors that deviate from the norm. While AI might not definitively distinguish between a genuinely novel gameplay strategy and a cheat, it can effectively narrow down the focus, reducing 3 trillion alerts to approximately 50 manageable events per year for human investigation. This targeted approach allows security teams to efficiently address the most significant threats without being overwhelmed.

Furthermore, the protection of intellectual property (IP) and unreleased content is a paramount concern. Nicole Dove highlighted the risk of leaks, particularly from influencers who test games during development. To counter this, measures like watermarking and building strong trust relationships with influencer management teams are explored. This proactive approach aims to deter unauthorized sharing and trace the source if a leak occurs. The concept of "identity is the new perimeter" is also critical, focusing on robust authentication and authorization mechanisms to protect both player and employee accounts from compromise, especially given that many employees are also active gamers themselves.

Finally, the discussion touched upon the extensive use of third-party development partners and vendors. Nicole stressed the importance of rigorous assessment of these partners, both initially and on an ongoing basis. This includes understanding changes in scope for third-party tools or services across the enterprise to ensure that all security implications are thoroughly evaluated. This comprehensive approach to supply chain security is vital for maintaining the overall integrity and availability of gaming platforms that rely heavily on external contributions.

Demo / Proof of Concept

▶ Watch: High stakes: Leaks and inflexible release dates (14:30)

This talk was a panel discussion focused on strategic insights and challenges in gaming security, rather than a technical demonstration. Therefore, no specific demo or proof of concept was presented during the session. The speakers engaged in a high-level conversation about their operational philosophies and the unique aspects of securing gaming platforms.

Defensive Implications

▶ Watch: Key takeaways: Partnership, persistence, creativity in security (18:00)

For security professionals, the insights from "Trusted Platform, Trusted Game" offer a compelling blueprint for navigating complex, high-stakes digital environments, especially those with large, active user bases and rapid development cycles.

1. Embrace "Secure by Design, Secure by Default, Secure Operations": Defenders must shift left, integrating security from the absolute earliest stages of product ideation. This means proactive threat modeling long before development begins, embedding security into infrastructure (e.g., secure base images, containers), and making security an inherent part of the software development lifecycle, rather than a reactive afterthought. The default configuration of any product should be the most secure, with users actively opting into less secure settings.
2. Understand Your Adversary (and Your Customer): Recognize that in consumer-facing industries, your customers can also be your adversaries, driven by motivations beyond financial gain (e.g., passion, competitive advantage, social status). Security programs must account for a lower expected security maturity among users, designing controls that are intuitive and robust without requiring advanced user knowledge. This also extends to managing the insider threat where employees share the same passion for the product.
3. Leverage AI and Automation for Scale: The immense volume of telemetry data and potential alerts demands sophisticated solutions. Security teams should invest in and implement AI and machine learning for anomaly detection to efficiently identify unusual behavior. This allows for the prioritization of critical alerts, transforming petabytes of data and trillions of events into a manageable number of actionable incidents.
4. Prioritize Supply Chain Security: Given the heavy reliance on third-party vendors and development partners, robust supply chain security is non-negotiable. This includes thorough and ongoing assessments of all external parties, understanding their security postures, and monitoring their potential impact on your ecosystem. A compromise in the supply chain can directly impact your product's reliability and integrity.
5. Protect Confidentiality with Dedicated Measures: For industries where intellectual property (IP), release dates, and surprise content are critical business assets, confidentiality must be vigorously protected. Implement measures like digital watermarking for early access content and secure channels for influencer engagement to prevent leaks. Recognize that leaks can be as damaging, if not more, than direct cyberattacks on systems.
6. Balance Security with User Experience and Innovation: Security measures must be designed to be effective without introducing friction or negatively impacting the user experience (e.g., avoiding lag). Similarly, security should empower developers to innovate rapidly, not hinder them. This requires baking security into development templates and pipelines, decentralizing security responsibilities, and fostering a culture where security is seen as an enabler, not an impediment.
7. Focus on Identity as the Core Perimeter: In an environment where users and employees are deeply engaged with the product, identity management becomes paramount. Implement strong authentication (e.g., MFA) and authorization controls to protect both player accounts from account takeover and employee access to sensitive internal resources.

Key Takeaways

• Players as Adversaries: In gaming, the customer base often doubles as the attacker base, motivated by passion and competitive advantage rather than just financial gain, creating a unique "insider threat" dynamic.
• Security by Design, Default, and Operations: Robust gaming security is integrated from the earliest ideation stages through continuous operations, ensuring secure foundations and default settings that protect users with varying security maturity.
• AI for Scale: Managing petabytes of telemetry and trillions of alerts necessitates AI-driven anomaly detection to identify significant threats efficiently, reducing an overwhelming volume to actionable insights.
• Confidentiality is Critical: Protecting intellectual property, release dates, and unannounced content from leaks is paramount, as these compromises can have severe market and business implications, often rivaling the impact of direct cyberattacks.
• Supply Chain Vulnerabilities: Extensive reliance on third-party vendors and development partners makes supply chain security a critical focus area, requiring rigorous and ongoing assessment to maintain platform reliability.
• Balancing Act: Effective gaming security requires a delicate balance between robust protection, maintaining a seamless player experience (e.g., no lag), and fostering developer creativity and rapid innovation.

About the Speaker(s)

Temi Adebambo is the CISO at Xbox (Microsoft), bringing over 20 years of experience in cybersecurity to the gaming industry. He describes his role as a blend of his lifelong journey in security with his lifelong passion for video games. His perspective is rooted in a deep understanding of traditional enterprise security, which he now applies to the unique and high-velocity challenges of securing a global gaming platform with hundreds of millions of active users.

Nicole Dove serves as the Head of Security for Games at Riot Games. Her path to cybersecurity is somewhat non-traditional, having initially worked in the gaming industry doing voiceover work for popular titles like Grand Theft Auto. She transitioned into risk management and then cybersecurity about 10 years ago. Nicole's background as a gamer herself deeply informs her approach to security, emphasizing the player experience, managing insider threats from a creative workforce, and balancing security controls with the need for artistic expression and rapid game development.

Jerich Beason is the CISO at WM and served as the moderator for this insightful panel discussion. His role was to guide the conversation, drawing out key distinctions between gaming and traditional enterprise security and facilitating the exchange of perspectives between Temi and Nicole.