Nevada Gaming Control Board Suggests Licensees Do More to Assure Cybersecurity

The Sagebrush State Gaming Control Board (NGCB) is recommending that most gaming licensees be required to accept additional steps to protect their data.

The NGCB held a shop on Monday to order of payment amendments to Regulation 5 — the Operation of Gaming Establishments inwards Nevada. The board, which has the primary resolve of “protecting the stability of the tell gaming manufacture through licensing, investigation, and enforcement of laws and regulations, as fountainhead as maintaining public confidence by making regulatory adjustments to the governing conditions,” thinks casinos and other licensees should get along to a greater extent to strengthen their cybersecurity.

Following the workshop, the NGCB drafted an amendment to Regulation 5 suggesting that certain gaming operators, including casinos, non-restricted licenses, and racebook and sportsbook let holders, on a regular basis brushup their cybersecurity protections and news report their findings to the state.

It is vital that gaming operators occupy all appropriate steps to untroubled and protect their selective information systems from the ongoing threat of cyber attacks,” the NGCB amendment outline reads. “Gaming operators must not only when unafraid and protect their have records and operations, but also the personal entropy of their patrons and employees.”

To attain that mission, the NGCB is suggesting that most gaming licensees every year employ an independent third-party auditor specialized inwards cybersecurity to brush up the company’s electronic information, data, hardware, software, and boilers suit information processing system systems and networks. Each licensee would and so be required to implement patches and other fixes and assurances based on the assessor’s findings.

Board Backlash

The NGCB reports to the Sagebrush State Gaming Commission (NGC), the five-member plank that oversees the state’s gaming industry. The NGC is set to take the board’s cybersecurity rules on October 20. In the meantime, licensees are submitting comments on the proposed regulatory changes.

South Point Casino, located in the south of the Las Vegas Strip, is 1 licensee that has verbalized concerns with the cybersecurity recommendation. The casino says such a requirement would unfairly impact its holiday resort compared with larger casino operators.

We firmly believe requiring an yearbook peril assessment is unnecessary and below the belt impacts bingle prop licensees same the South Point. Risk assessments are non inexpensive, and for bingle belongings licensees, generally make to be performed by an exterior consultant,” South Point attorney Barry Lieberman wrote inwards a letter to the NGCB.

South Point is urging the NGC, should it settle to go for the board’s testimonial regarding increased cybersecurity measures, that assessments follow required every deuce-ace years instead of annually.

Attorneys representing Aristocrat Leisure and IGT, two leading gaming manufacturers, appealed for the room to more definitively define “information system.” Boyd Gaming suggested that the gameboard elucidate what constitutes a “cyber attack” and omit unsuccessful IT infiltration attempts from existence required to be reported to the state.

The board’s Regulation 5 cybersecurity bill of exchange includes requiring licensees to inform the NGCB of any cyberattack on their information systems within 72 hours.

Attacks Increasing

Tribal casinos feature emerged as prime quantity targets for hackers. After legion(p) casinos operated past Native American tribes were attacked online in 2020 and 2021, the FBI Cyber Crime Division issued a warning to the tribal gaming manufacture suggesting that tribes get go suitable targets among ransomware groups.

Commercial gaming operators aren’t immune from these attacks either.

In 2019, MGM Resorts admitted that personal information on rough 30 trillion guests had been compromised through and through a cyberattack. And in conclusion year, Dotty’s said it was the dupe of a cyberattack that resulted inwards the personal info of both employees and guests beingness stolen.