IMS3000 network switch and Internet access – any concerns

[Shai Skiff]

Hi,
Quick question regarding the Dolby IMS3000.

We’re considering connecting the IMS3000’s network switch to the site network so that other devices on that network (like the control PC) can have Internet access. The goal isn’t to expose the IMS itself, but to provide Internet to the other connected devices.

That said, I’m concerned about security and whether doing this could still expose the IMS3000 or cause other issues.

Are there known risks or things to watch out for?
If Internet access is needed for things like updates or monitoring, what’s the usual / recommended way to handle it?

Just want to make sure I’m not creating problems down the road.

Thanks.

[James Gardiner]

Many small 1 and 2-screen cinemas operate with a single flat network for both office and projection use because it is cost-effective and simple. In practice, this setup often runs for years without any issues.
While default credentials for these devices are widely available, they are rarely considered "high-value" targets compared to standard PCs. However, this configuration is still not recommended. Even though the uniqueness of cinema hardware makes it an unlikely direct target, a flat network allows an attacker who hits a common target (like an office computer) to move laterally toward your projection equipment.
The bottom line: While this setup works and the risk of a targeted attack is low, any infiltration of the office network could unintentionally impact your projection systems due to the lack of isolation.

[Marco Giustini]

I am more concerned about IP management. I attended a cinema once where the server stopped working and turned out that there was an IP conflict with a newly installed printer in the office!
What I like to do is to create different networks. Get a decent router - it doesn't have to be expensive - and create different VLANs which can talk between themselves.
This way, if your office network implodes, the projection network is not immediately affected.

Creating VLANs requires a bit of knowledge, routers are often not user-friendly. But if you understand the basics, you can create some separation.

Regarding internet being dangerous, everything is behind your router which acts as a firewall so nobody can see the servers - which usually run VERY old and VERY vulnerable Linux kernels! - from the internet. As James said, if your office computer is compromised, I guess there might be an eventuality where the servers can be affected too - but I'd say it's unlikely.

[Marcel Birgelen]

Cinema systems aren't hardened devices, and most of them run very common operating systems. The IMS3000, for example, runs Linux.

You NEVER want any of your cinema equipment to be directly exposed to the Internet, not on IPv4 and also not on IPv6.

The added risk of putting your IMS into a network with devices that have Internet access is that, if one of those devices, like a PC with a popular browser, gets compromised, the IMS also potentially gets compromised, as there are now no more barriers between those systems.

[Caleb Williams]

As Marco mentioned, if you're going to go this route, make sure you have a segmented network. You can allow the networks to talk to each other throught the firewall, but do not have your projection systems in the same subnet as the office/management equipment. If you want to be extra careful, do not let the projection network access the internet at all, while still allowing connections from other local subnets through. It's not super hard to set this up provided you have a firewall and network switch capable of VLANS. That equipment has only gotten cheaper over the years.

If you want to do some homework, consult the internet/chatgpt for specific hardware configurations, then take your proposal to an IT guru and confirm that it is sane.

I've heard some people say that "linux is not that big of a target compared to Windows PC's", and they may feel that is true, but it is not, especially if it can talk to the internet. It is better to make smart choices and segment vulnerable networks in advance, than suffer the cost of not taking security into consideration up front. Ultimately, each piece of equipment is a computer, and can be infected with malware, even if you don't notice the infection. IE: https://darknetdiaries.com/transcript/22/ Unlike the story in the link, the bad-actors infecting your equipment are far less likely to be benevolent in their actions. Malware infections in cinema are rare, but it would pay to not become a part of that statistic.

[Leo Enticknap]

I have encountered two IMS3000s and one 2000 that were infected with crypto-mining malware over the last couple of years. Dolby's line is that the factory default logins are compromised and should be changed on installation. More here.

[Steve Guttag]

Yeah. If I'm in charge of the the booth network then the Management and Media networks are under my control and firewalled off. The media network has no gateway at all. The management network is gatwayed to a router so that is the pathway in/out. It is never on the theatre's networks. First off...if their credit card system ever has a breach, we don't want to be anywhere near that either. So, a suitable means of allowing the manager access to the booth equipment is established through the firewall with the ports that are needed to talk with said equipment. Even WiFi I keep on a separate network.

Now, the TMS computer, typically, has internet access and it is on both media and management networks, due to its nature. If there is a breach, that is, most likely, where it is coming from...that or a visiting technician that is on one of the networks and the internet. I know of some systems whereby if your MAC address isn't known/approved, even plugging into the physical network won't let you on.

I believe in separate networks with, at most, a firewall router to separate them, if there is any connectivity at all between them. Heck, my QLANs (Q-SYS are islands, if at all possible) as there is no need for them to reach the internet or anywhere else.

[James Gardiner]

Security is about spending enough to achieve the desired outcome — but not so much that you erode profitability. An overly complex approach, such as a VLAN-heavy, MAC-address-restricted implementation, requires regular and often expensive servicing by a highly trained integrator. It can also be difficult to troubleshoot and recover from a “dark screen” event if certain equipment is affected.

I do not recommend this path for most cinema environments.

A simpler approach, based primarily on solid physical segmentation (and in many cases avoiding unnecessary VLAN complexity), is generally preferable. It is far easier for less specialised engineers to understand and maintain, and over the long term it significantly reduces operational costs and downtime risk.

You may need to invest slightly more in inexpensive hardware upfront — for example, additional basic physical switches — but this is usually more cost-effective over time.

Best practice would include:

• A dedicated 10GbE uplink from the media switch to the TMS
• No routing for the media subnet (air-gapped at Layer 3 as a matter of common sense)
• Administrative networks routed as required for remote telemetry and monitoring

Administrative networks typically require routing because remote monitoring by integrators is common. In many cases, integrators require direct access to the player network to retrieve logs and telemetry data — although this can be controlled using NAT or other containment strategies if you are comfortable implementing more advanced network controls.

In short: keep the media path simple and robust, and only introduce complexity where it delivers clear operational value.

[Marcel Birgelen]

In my opinion, it depends on the kind of installation you have. In any way, you want to keep your office/POS/whatever networks separated from the networks in your booth. My way of achieving this situations is VLANs. VLANs have been around for decades now. This is especially true for multi-screen sites that operate centralized services like storage, TMS, automation systems and network audio systems. Centralized systems can also benefit from cheaper redundancy, by having a redundant set of "core" switches and e.g. gateways/firewalls. Requirement for this is that the network is actively maintained, either by in-house teams or some trustworthy external provider of said services.

The operational value is a well-maintained, segmented, secure network, where responsibilities (e.g. booth v.s. POS) are properly segmented, where failures are the exception and when they happen, a knowledgable person should be capable of isolating them in minutes in most cases.

For those setups where there is no network knowledge available, I usually propose separate switches and gateways for separate networks.

Cinema servers and their makers aren't known for their stellar security, cinema operators aren't known for applying all the last updates every day and minute, so those devices are a high risk, if exposed to potentially bad actors and any system with Internet access you plug into such a network is such a device.

[Steve Guttag]

James, I don't think, even with your methodology, as you described it, that the Media network is really "air-gapped" To me, that means there is no connectivity to it (the air gap). However, since you need a means for the TMS to move content, you have connectivity (10G in your description and I have some that are 20G and more). If the TMS has connectivity to any other network that is not air gapped and if it has internet access...then your air gap is not really there. So, we're back to the TMS being the most likely breach in a cinema booth system.

I've seen two philosophies on the management network. Some restrict it from the internet since no device in the booth really needs direct internet access (though some subscription things are going to thwart that as time goes). They have ONLY the TMS being a blessed device. You need a means of remote support so something has internet access and booth network access. You need to be able to get the time via an NTP server, of some sort (it need not be a PC...it can be a dedicated, though expensive NTP clock). You need to be able to get KDMs into the booth so something needs external access to get them to the TMS. And your content needs to come from some source and that is likely either on your Media network or even if firewalled off and on a separate VLAN/LAN, is able to send things to the Media network. So, air-gapped is not a practical means unless you want to

• Sneaker-Net everything AND
• Scan all devices for harm.

That is just not a reality for a cinema booth. In general, I think that the value of booth equipment, as a target is very low. Make it so the biggest means of security is that you have to be physically plugged into the network to access it. Consider how you set up your firewall to allow what needs to be allowed but not what doesn't. Strongly discourage using a TMS server as "another computer." Let it JUST be the TMS as that is, most likely, your weak-link in your security plan because what networks it touches. It is on the media network, it is on the management network and it, likely has some form of internet access.

I have some sites that are using a "headless" NAS as the TMS with a virtual machine to run the TMS software. One of the things I like about this plan is NOBODY is on the "TMS." Its only access is via web browser to the TMS' web page. There is no means for them to use it as a workstation. Being a NAS by nature makes its storage pretty decent in size (40TB) and speedy too (20GB/s though 100GB/s is possible with the hardware). It's also cheaper than using traditional servers like Dell, with less capacity and slower network speeds.

[Marcel Birgelen]

Air-gapping a modern booth isn't realistic, especially in the days of remote management and digital content distribution. TMS systems are often the weakest links, because they need to interface with other networks.

My preferred setup is a central firewall or firewall cluster as the gateway for every zone. A TMS system likely ends up in its own zone and I just open up the ports necessary for communication. While this takes some extra initial configuration work, it prevents most damages from escalating into other operational domains, in case of a systems breach. So e.g. a compromised POS will not affect your projection networks.

The nice thing about such a setup is that your gateway/firewall can also double as NTP server and even local DNS server and cache. Vendors can either get a permanent IPSec tunnel with access to the machines relevant for them or they can deil in via e.g. SSL VPN for incidental maintenance.

I mean with high-profile breaches like the Kaseya VSA ransomware or the Solarwinds attack, where millions of endpoints got infected via automatic software updates from their respective vendors, you simply need some form of isolation between "you" and stuff maintained by others. Many MSPs nowadays blindly trust on those remote management agents and "endpoint protection software" by e.g. Kaseya, Solarwinds, NinjaOne, etc., which are all just ticking time bombs... and if they aren't getting hacked, some blow up themselves... remember Crowdstrike?

[Steve Guttag]

I can't think of any reason the POS system needs to be on a booth network. For those that export their schedules within the theatre, we do provide a port on the router for that network that allows a simple FTP to a designated destination...ONLY. That's it. It can either be via a NAT translation or setting up a persistent static route on their PC. More systems are moving to a cloud based schedule so the TMS is reaching out and putting the schedule that way. So, again, the TMS is the one with internet access plus touching the management and media networks.

[James Gardiner]

@Steve — it’s not so much traditional air-gapping. It’s more about ensuring the media network is non-routable from the TMS and other networks.

By doing that, the media network is effectively removed from any ability to laterally move between network segments. I’d describe it as a form of virtual air-gapping. The media segments really only exist within the projection environment itself, which is securely fenced off and accessible only to qualified staff.

The TMS, however, has always been the cornerstone of a projection network. It necessarily bridges multiple domains. It requires access to the front-of-house network and often the internet for legitimate operational reasons:

• Running content delivery software
• Communicating with POS systems to retrieve schedules
• Fetching KDMs from internet-based mail or key delivery systems
• Supporting monitoring and reporting workflows

You can operate without a TMS connected to other networks, but doing so significantly increases the workload on local staff.

Increasingly, sites are moving toward NOC-style centralised management, where a technically skilled operator can oversee multiple venues. This reduces the training burden at each individual site and improves operational consistency. (example: I contract to numerous sites on an hourly bases to work out more difficult issues the local managers cannot)

As I always say — security is about balancing risk versus cost. You can always make a system more secure, but beyond a certain point the incremental gains become commercially impractical.

[Marcel Birgelen]

@Steve — it’s not so much traditional air-gapping. It’s more about ensuring the media network is non-routable from the TMS and other networks.

What do you exactly mean with non-routable? Do you imply they don't share the same broadcast domain, so they're technically split below layer 2, or do you simply imply they don't share the same IP subnet, whereas they still are in the same broadcast domain?

[Shai Skiff]

Hi again,

Thank you all so much for your thoughtful advice. I truly appreciate your insights, and I’ve decided to proceed as follows:

IMS server (IMS3000) that needs to remain isolated from the internet, but we also need a laptop (connected via Wi-Fi) to have:

1. Internet access (for Google Sheets updates and general connectivity)
2. Direct IP access to the IMS on a separate private subnet

This is actually for festival operations, where we’re required to test a high volume of films within a limited timeframe.

My current plan is:

• Internet network: 192.168.10.0/24
• IMS network: 192.168.100.0/24 (No additional devices - just the IMS)
• Using an EdgeRouter ER-X to separate the networks
• No port forwarding to the IMS
• NAT only toward the internet
• Firewall rules to allow Wi-Fi → IMS but block IMS → Internet

The goal is full isolation of the IMS from external access, while still allowing controlled access from the local Wi-Fi laptop.

Does this approach align with best practices for cinema environments?
Would you recommend any additional safeguards?

Thanks in advance for your advice.