There is a famous story within the industry about a Las Vegas casino whose cyber defenses were breached via its lobby fish tank. As the tale goes, hackers in Finland accessed the casino’s IT network via internet-connected sensors used to monitor water temperature and food distribution, ultimately downloading 10GB of data that included its high-roller database.
It’s a cautionary episode around what can go wrong when the security protocols of an operator and vendor aren’t aligned – and it is precisely the sort of scenario that led global test lab Gaming Laboratories International (GLI) to create GLI Secure.
Launched in June, GLI Secure is a dedicated cybersecurity and professional services division of GLI that helps operators and suppliers protect their digital assets by providing a standard framework against which the entire industry ecosystem can test vulnerabilities.
By providing a vendor security framework based on CIT (Center for Internet Security) and NIST (National Institute of Standards and Technology) best practices, GLI Secure provides operators with trusted certification that the third-party vendors it utilizes – each of which create another potential entry-point into the network – have already been assessed by GLI.
Not only does this ensure all parties adopt the same cybersecurity protocols but it also supersedes the arduous process of operators sending lengthy questionnaires to each and every vendor they work with.
“Right now, operators are sending out these massive questionnaires [to vendors] about their cybersecurity to make sure they don’t add a vulnerability,” explained GLI’s Head of casino Services North America, David Elmore, during a conversation with Inside Asian Gaming at G2E in Las Vegas last week.
“They don’t really want to send them for the vendors to fill out, and they don’t really want to have to review then when they are sent back. The vendors don’t want to fill them out either because if I’m a supplier going into, say, a dozen jurisdictions, then every casino in every one of those jurisdictions is going to have a questionnaire. The time and effort that goes into having to review those questionnaires is just astronomical.
“So, we created GLI Secure based on the best practices of two well-known cybersecurity standards called CIS and NIST and built a program that is not so restricted as to prevent new technologies but at the same time won’t affect cybersecurity integrity.
“The biggest issued casinos are facing at the moment, both on the commercial side and the tribal gaming side, is that third-party vendors are adding these vulnerabilities because they’re not being checked properly. And every vendor they deal with represents a potential vulnerability within that supply chain network.
“What we have done is create a standard that’s almost like a stamp, like a golden ticket they can use and know that they are not going to add any more vulnerabilities to their network.
“This means the operator can say, “Listen, you don’t have to review my questionnaires,” and the vendor can say, ‘That’s great because we don’t want to fill them out!’”
The threat posed by cyberattacks to the global gaming industry was thrust into the spotlight in September 2023 when two of the largest operators in Las Vegas were hit within weeks of one another. At MGM Resorts, hackers utilized social engineering to access customer information, forcing the company to shut down portions of its systems and resulting in operational failure across its Vegas properties. Caesars was also a social engineering hack, resulting in the culprits accessing the loyalty program database.
Around the same time, Australian slot machine supplier Aristocrat Leisure reported a cyber incident linked to a third party file transfer application, resulting in the personal information of employees being stolen, while Singapore’s Marina Bay Sands saw the information of over 665,000 lifestyle rewards members stolen in an October 2023 data breach.
One of the biggest threats today, according to Elmore, is faced by America’s tribes with a 2025 study by Tribal ISAC, called State of Cybersecurity Within Tribal Nations, finding that 37% of tribal organizations have no dedicated cybersecurity personnel and another 30% just one person.
“That’s a major issue,” Elmore said. ”For some of the tribes, the casino itself can be the economic engine of the entire tribe. I mean, it’s funding health and human services, emergency services like the police department and fire department, health care for the elderly, child care, diabetes treatment, alcohol treatment – all these ancillary functions. And if they get hit like Caesars or MGM, they can’t survive that. You’re talking about killing the golden goose and the whole community goes under.”
And it’s an issue that is only going to become more pressing, given the rapid development of artificial intelligence and the greater opportunities this poses for cybercriminals the world over. A recent report by Check Point alleged there were an average of 1,968 cyberattacks per week against organizations in 2025, rising to 2,336 as of July – the equivalent of an attack against an organization every four minutes.
It is for this reason that Elmore encourages companies of all shapes and sizes to at least open a discussion around their cybersecurity options.
“GLI can help with this,” he explained. “At the very least, we have subject matter experts you can lean on, people who will hop on the phone and talk to anybody and answer any questions you have about anything. And that doesn’t cost anything.”
RelatedPosts
