NIGC Praises Tribal Casinos for Cybersecurity Measures

In the wake of recent cyberattacks on major commercial casinos, the National Indian Gaming Commission (NIGC) has lauded tribal-owned properties, including those in New York, for their robust cybersecurity measures. 

National Indian Gaming Commission Employs Strong Cybersecurity Blueprint

Drawing parallels to medieval castle defenses, the NIGC outlined its “Defense in Depth” strategy, which encompasses multiple layers of protective mechanisms designed to secure data, information, and information systems.

NIGC noted in a recent statement: “Cybersecurity attacks have become increasingly prevalent across organizations, regardless of their size, and show no signs of abating. To substantially reduce the vulnerability of IT systems, organizations should employ a comprehensive and redundant cybersecurity approach.”

The NIGC release provided insight into the cybersecurity strategies employed by its member casinos, highlighting the utilization of antivirus software, hardware firewalls, disk encryption, authentication controls, and Multi-Factor Authentication.

According to the NIGC, the disparity in cybersecurity outcomes can be attributed to its member casinos’ three-pronged approach: physical controls, technical controls, and administrative controls.

New York boasts seven tribal casinos, with prominent establishments such as the Turning Stone Casino Resort in Verona and the Seneca Niagara Resort & Casino in Niagara Falls.

Hackers Disrupt MGM and Caesars, Resulting in Multi-Million Dollar Losses

In a remarkable contrast, both MGM and Caesars Resorts and Casinos were targeted by hackers last month, resulting in significant disruptions to their operations. 

One MGM-owned casino in New York fell victim to the attack, attributed to a criminal group known as “Scattered Spider.” The cyberattack against MGM Resorts was estimated to cost the company over $8 million in revenue per day, according to Jefferies Group‘s gaming industry analyst, David Katz. 

Caesars Entertainment reportedly also paid millions of dollars to hackers following a cyberattack, which may have links to a similar incident at MGM Resorts International. The attack, attributed also to the Scattered Spider or UNC 3944 group, targeted Caesars’ confidential data and caused a dip in the company’s stock prices. 

In the cases of both Caesars and MGM, hackers exploited vulnerabilities in the form of social engineering. The “Scattered Spider” group deceived IT Help Desk personnel through phone calls, subsequently employing VoIP technology to impersonate support staff and pilfer passwords.

Despite the effectiveness of its “Defense in Depth” security architecture, the NIGC maintains that it cannot completely eliminate the risk of cyberattacks. The NIGC acknowledges that such insidious methods are not solely dependent on software safeguards but also necessitate robust policy implementation.