Digital Signage Security — Best Practices for a Safe Deployment

Why Digital Signage Security Matters

A digital signage screen is a computer connected to your network, potentially visible to hundreds or thousands of people. If it’s compromised, an attacker could:

• Display offensive, misleading, or brand-damaging content
• Use the player as a foothold in your network
• Exfiltrate any data the player can access
• Disrupt business operations by taking screens offline

Securing your signage deployment is not optional — it’s part of responsible IT management.

The Alliance’s Security Architecture

The Alliance is designed with security-first principles:

Outbound-only connectivity — Alliance Players initiate connections outbound to the Alliance cloud. No inbound connections are required. Ports 80 and 443 (HTTPS) only. No remote desktop, no open SSH, no inbound firewall rules needed.

Content-only payload — Players receive content packages (images, video, HTML templates, JSON data). They do not execute arbitrary code from the server.

Encrypted communications — All content and configuration data is transmitted over TLS 1.3. Sensitive configuration uses end-to-end encryption.

Signed content — Content packages are cryptographically signed. The player verifies the signature before displaying. Tampered packages are rejected.

Read-only filesystem — The Alliance Player OS uses an overlay filesystem that makes the system partition read-only. Malware cannot persist across a reboot.

Automatic security updates — The Alliance platform updates player software automatically, including security patches. Players can be configured to update during maintenance windows.

Network Best Practices

Segment the signage network — Put media players on a dedicated VLAN, separate from the corporate network. The players need internet access only — they don’t need to reach the corporate file server, the finance system, or any other internal resource.

Firewall rules — Allow outbound traffic on port 443 to Alliance infrastructure only. Block all inbound traffic. Block outbound traffic to any other destination from the signage VLAN.

Wi-Fi vs. Ethernet — Ethernet is preferred for reliability. If Wi-Fi must be used, use WPA3 and a dedicated SSID for signage devices. Do not use the same SSID as guest Wi-Fi.

Static IP assignment — Assign static IP addresses or DHCP reservations to media players. This makes it easier to identify and isolate a device if it behaves unexpectedly.

Physical Security

Lock the cabinet — Media players should be in a locked cabinet or secured enclosure, not accessible to the public or casual visitors.

Disable unused ports — USB ports on the player should be disabled in the OS if not needed. Physical USB access can be used for cold-boot attacks.

Screen lock — Screens should be in commercial enclosures or mounted in a way that prevents access to the input connectors.

Access Control

Principle of least privilege — Users in the Alliance dashboard should have only the permissions they need. Content creators don’t need to manage hardware. Location managers don’t need to access other locations.

Two-factor authentication — Enable 2FA on all Alliance accounts, particularly admin accounts.

API key rotation — Rotate API keys regularly. Revoke keys that are no longer needed. Use scoped keys that can only access specific screens.

Audit logs — Review the Alliance audit log periodically. Flag unusual activity — content published at unusual hours, access from unexpected locations, bulk screen restarts.

What to Do If a Screen Is Compromised

1. Isolate immediately — Remove the player from the network. If this isn’t possible, blacklist the device in the router’s MAC address filter.
2. Revoke access — Disable the screen in the Alliance dashboard. This prevents the attacker from using the platform to push further content.
3. Assess the content displayed — Was harmful or false information displayed? For how long? Who saw it? This informs your incident response communications.
4. Reimage the player — Do not attempt to clean a compromised player. Reflash the OS from the official Alliance Player OS image.
5. Investigate the attack vector — How was the device accessed? Network vulnerability? Physical access? Credential compromise? Fix the root cause before redeploying.
6. Report — If customer or employee data may have been accessed, assess your GDPR notification obligations. Contact the Alliance security team for support.

Compliance

The Alliance platform holds:

• SOC 2 Type II (security, availability, confidentiality)
• ISO 27001 (in progress, expected Q2 2027)
• GDPR compliance (UK and EU GDPR)
• Cyber Essentials Plus (UK government certification)

Documentation is available for enterprise customers and public sector tender responses.