Communication is the missing link for integrating physical and IT security resources
Better communication is the key to integrating physical and IT security in enterprises today. This is according to Charl Ueckermann, CEO ofAVeS Cyber Security, who says physical and IT security resources have traditionally been treated as separate disciplines.
As physical security systems have evolved to include programming components and features for centralised control, the physical and IT security realms have converged. Yet, the tendency to work in silos remains.
He explains: "Historically, you would have specialists in physical security systems who would do the installation of cabling and CCTV without considering the role their systems will play in relation to the organisation's other security initiatives, like IT security. Nowadays, a better understanding of how systems fit into one another has become necessary as physical security systems are managed as an integral part of companies' overall security programmes. The security game and its rules of engagement have changed; to win, role players need to collaborate rather than compete.
"Certainly, there is a degree of 'protection of territory' happening where physical security personnel feel that IT personnel are encroaching on their space and vice versa. However, IT security specialists will always be responsible for IT security, and the physical security specialists will still be responsible for the physical systems. IT should do the security architecture as physical systems are introduced into the organisation's digital networks, which are their field of expertise.
"Communication and collaboration between the different departments will facilitate a common solution that reduces the overall business risk through converging physical and IT security resources. That way, everyone understands the true business objective of a security convergence project, to reduce overall business risk, and how these different systems will be integrated to achieve this objective."
Aside from poor interaction between the physical and IT worlds, Ueckermann says a lack of planning can also impact the success of integration efforts. Before embarking on any integration project, Ueckermann says companies need to be able to answer a few questions first. Some of these include:
1. Have you done an assessment to ascertain how the converged project will address your business risks?
2. Does your converged project strategy address both quality and cost drivers? For instance, will you get the lowest possible enterprise risk out of the project at the best possible price, and how does this fit into the risk profile of the business?
3. Does your choice of people, process and technology to design and implement the converged project align with your converged project strategy? What is the impact on the project's total cost of ownership to the business in the long term?
4. Have you thought about how unauthorised access to restricted areas of the building can impact the business? How can you empower your staff to play a role in preventing or alerting you of unauthorised access, perhaps through awareness programmes?
5. What level of intelligence capabilities would your converged project allow, and would you be able to proactively monitor and pick up on anomalies or risk indicators in or around your building?
6. Have you identified and communicated a security incident response plan to the rest of the organisation?
Ueckermann stresses that when integrating physical and IT security systems like video surveillance or building security systems into IT networks, it is critical to demilitarise or separate the different systems from each other. "Properly evaluate your choice of equipment, such as surveillance systems, before buying them. You want the software that is used in these systems to be rock solid; poorly developed software could include vulnerabilities in their code that could compromise your entire security environment. Choose a vendor with a good reputation.
"So, although you want to run your CCTV, fire suppression system or access control on your IT network, it is crucial to shield each one from the others. Build security into the solution from the start. There should be no open protocol between these physical systems and your IT network that could expose the rest of your business's infrastructure to unwanted risk.
"It is also essential to ensure that all equipment, whether it's for an access control system or CCTV, is patched with the latest operating software. Just as computers and servers must be patched, so should the software on physical security systems be patched. The applications that run on these systems should also be kept up-to-date."
He concludes: "When it comes to integrating physical security and IT, there needs to be more conversation. As long as there is a culture where different teams continue to service their own silos, we will continuously miss the mark. The organisations that are more mature, open to talk, open to listen and open to sharing opinions will be the ones that succeed with full convergence and enjoy a low-risk profile and at a lower cost structure."