ELL//OSElectric Laser Limousine
0 cookiesNo trackersSearchRSS
← All episodes/Episode #042
EP // 042
1h 14m

·Host: RawkyBlaq·Episode 42

Zero Days in the Stadium Suite: When OT Meets Pro Sports

Industrial control systems don't stop at power grids. They run the scoreboards, turf systems, turnstiles, and fire loops in modern arenas. We walk through the attack surface of a stadium and how venue operators can segment it. Links and references are in the full show notes at electriclaserlimousine.com.

ReadyEP // 042

Show notes

Modern arenas run on operational technology: HVAC controllers, turnstiles, scoreboards, retractable roofs, and fire systems, often on networks shared with guest Wi-Fi and suite amenities. Marcus Sterling joins to walk through how a venue’s attack surface is put together and what good segmentation looks like.

In this episode

  • Why “IT” and “OT” teams inside a venue often don’t talk to each other
  • The guest Wi-Fi to building-controls path, and how to break it
  • Badge cloning, ticket scanners, and the physical side of venue security
  • A practical segmentation plan you can take to a facilities team

Transcript

8 passages · RawkyBlaq, Marcus Sterling
  1. RawkyBlaq[00:04]

    Welcome to Electric Laser Limousine, episode forty-two. Tonight we're pulling back the sheet on what happens when an eighty-thousand-seat stadium is, underneath it all, a very large building-automation network with a roof. Marcus, thanks for coming on.

  2. Marcus Sterling[00:31]

    Thanks for having me. When people picture a venue they picture the field and the fans. I picture the controllers: HVAC, lighting, turnstiles, the scoreboard, the fire system. All of it is on a network somewhere.

  3. Marcus Sterling[04:12]

    The first thing we look at is guest Wi-Fi. It should be completely isolated from building systems, and most of the time it is. The problems show up in the exceptions: a vendor laptop, a temporary network for an event, a suite with its own switch.

  4. RawkyBlaq[09:48]

    And that's where IT and OT stop talking to each other.

  5. Marcus Sterling[10:02]

    Exactly. The facilities team owns the controllers, IT owns the network, and nobody owns the gap between them. A normal vulnerability scan against an OT network can knock over devices that were never built to handle it, so you need a different playbook.

  6. Marcus Sterling[18:45]

    Physical access matters just as much. Badge readers, ticket scanners, service doors. If someone can walk into a network closet on game day, your firewall rules don't matter much.

  7. RawkyBlaq[36:10]

    Let's end with something practical. If a listener works at a venue, what's step one?

  8. Marcus Sterling[36:18]

    Inventory. Find every controller and every network it touches. Then draw the zones, decide what is allowed to talk to what, and enforce that at the boundaries. Segmentation is boring, and boring is what keeps the lights on.