The Center for Internet Security has identified digital ticketing platform vulnerabilities as one of five significant emerging risks facing large-scale events. For organizations navigating cybersecurity for live events, that risk has particular implications. Ticketing platforms handle valuable customer, payment, account and behavioral data, making the protection of that information critical to both the organization and its audiences.
As cyber threats continue to evolve, live event organizations need to understand how their information and the systems behind it are protected. Cybersecurity shouldn’t be something organizations leave entirely to IT or their technology provider. The people who use ticketing systems, access audience data and make technology decisions all have a role to play in reducing risk. Ticketing, operations and executive teams should understand where risks exist, what good protection looks like and what they should expect from the platforms handling their ticketing and audience data.
Where Do Ticketing Cybersecurity Risks Exist?
Cybersecurity and ticketing fraud often intersect, but they aren’t the same thing.
Cybersecurity focuses on protecting systems, accounts, applications and data from unauthorized access or attack. Fraud prevention focuses on identifying and stopping malicious transactions and behaviors, such as card testing, fraudulent purchases, account takeover, reseller bots and chargeback abuse. The two can overlap. For example, compromised customer accounts can be used to make fraudulent ticket purchases, while credential-stuffing and card-testing attacks can target the systems and accounts involved in ticket purchases.
Cybersecurity risks can also occur beyond the transaction itself. A compromised employee account could provide unauthorized access to patron information or important ticketing functions. A phishing message might target a box-office employee with a fraudulent password reset or login request. Attackers may also look for vulnerabilities in public-facing ticketing applications or third-party systems connected to them.
The impact can extend beyond exposed data. A security incident can disrupt ticket sales and operations, create additional work for staff and undermine audience trust.
For a deeper look specifically at card testing, reseller bots, account takeover, chargebacks and other forms of ticketing fraud, explore AudienceView’s Fraud Prevention Guide.
What Does Good Cybersecurity Protection Look Like?
Effective cybersecurity relies on layers of protection across people, systems, applications and data.
Strong authentication and access controls help ensure people can access only the systems and information they need. Employee education helps teams recognize phishing and other attempts to obtain credentials or sensitive information.
Customer and payment data also require appropriate safeguards. Organizations should understand how their providers protect cardholder data and whether applicable payment-security requirements are being met.
Secure development practices, vulnerability management and protections for public-facing applications help reduce opportunities for attackers to exploit weaknesses. Ongoing monitoring can help identify suspicious or abnormal activity as threats change.
What Should You Expect From a Ticketing Technology Partner?
You don’t need to understand every technical layer behind your ticketing platform, but you should be able to understand how your provider approaches security and protects your systems and audience data.
Questions to ask include:
- How is access to systems and sensitive information controlled and authenticated?
- How are customer and payment data protected?
- How does the provider approach secure software development and vulnerability management?
- How are public-facing ticketing applications protected?
- How are systems monitored for suspicious activity?
- What security standards or payment-security requirements does the provider follow?
- How does the provider respond to emerging threats?
- Which security responsibilities belong to the provider, and which remain with your organization?
The answers can help teams understand the protections built into their ticketing environment and the security practices they need to maintain internally.
How AudienceView Approaches Ticketing Cybersecurity
AudienceView uses multiple layers of security to help protect the systems and data supporting live event organizations.
Access controls and authentication help organizations manage who can access different areas of their ticketing environment and what individual users are able to do. AudienceView Professional and Unlimited operate within PCI DSS-compliant payment environments, with payment protections that include tokenization and encryption.
AudienceView also uses web application firewalls to help identify and block malicious traffic before it reaches applications, along with security-focused development practices that include secure coding, regular code scanning and automated server patching.
Cybersecurity is an ongoing responsibility, and the technology behind your ticketing operation plays an important role in that protection. Understanding the safeguards built into your platform—and the practices your own team needs to maintain—can help reduce risk and protect the trust you’ve built with your audiences.
Want to learn more about how AudienceView protects your ticketing environment and audience data? Talk to our team.