Most physical security companies have a great opportunity to grow their business by adding or partnering to add cybersecurity offerings.
Among other strong candidates, a compelling case could be made that in the entire history of the electronic security industry, the most transformative and disruptive technology has been IP-enabled devices.
Even the interrelated subsets of that innovation, including networked, cloud and as-a-service model physical security systems, mobile controls on the go, home networks, and the Internet of Things (IoT), mean that some of the Earlier technological “advancements” may seem as revolutionary today as comparing a Kinetoscope to streamed 4K video.
However, there is a big caveat to this paradigm shift, manifested by the now ubiquitous hacking threat and the rise of the enormously large and complex cybersecurity discipline.
I am proud of the fact that for about 10 years, Sales and Security Integration has been at the forefront of industry media recognizing the relevance of cybersecurity to the physical/electronic security channel and the importance of educating the market why professionals should care, and for myriad reasons take action.
That effort has not only included broad and deep coverage, but also participation in dedicated thematic groups/committees and events, the industry’s only annual cybersecurity issue, and the release of a groundbreaking study in 2014 called Physical Security Assessment. -logic (PLSA).
Those new traditions continue with the April issue and the revival of the PLSA, renamed Cybersecurity Deep Dive (watch it here). As part of that engagement, the integrators were asked some open-ended questions. Here are some of their opinions and views:
What is the biggest cybersecurity challenge facing physical security companies?
- The constant change in technology.
- Too many variables to keep everything under control.
- IOT vulnerabilities, especially when operating on the customer’s network.
- Hackers always seem to be one or more steps ahead of our security platforms.
- Professionally organized offenses.
- Installation technicians do not perform installation hardening on devices (weak passwords, open firewall ports).
- Product standards and verification. Lead with protection, not with sales.
- Complacency that it will happen to someone else’s customers.
- Systems are hacked by end user error, but the blame lies with the last person to add or make changes to the customer’s network.
- Discover that there has been a breach.
- Viruses in email. 2. Phishing 3. Upload from corporate network to cloud 4. Remote access 5. Employees use VPN proxy servers and tools.
- Cloud adoption trumps security.
- Ransomware attacks.
What product features or support mechanisms should vendors provide to help your business better maintain cybersecurity?
- Built-in security from the design stage. Automatic firmware and security updates without hard system resets. Password required and 2FA.
- Automatic password changes on any device on the network.
- Forced default password changes: QR codes that have a MAC address in them.
- Stay on top of current applications and patch holes and try MS patches for server and workstation operating systems.
- 24/7 monitoring, either as provider service or links to MSSP platforms.
- Device hardening guides.
- Cloud options only, no hardware.
- Complex password requirements 2. Password sharing 3. Login overload 4. Data hijacking. These mitigation measures also build on the capabilities of the NIST Cybersecurity Framework and promote a defense-in-depth security posture.
- Perform routine penetration tests.
- Encrypted authentication mechanisms. Data encrypted at rest and in transit. No default configuration settings.
Any other comments on the relationship between physical and logical security?
- Physical security must run on your own network, non-negotiable.
- Most physical security companies have a great opportunity to grow their business by adding or partnering to add cybersecurity offerings.
- The world of information and physical security are merging, and I appreciate it. Information security personnel are often better equipped to spot anomalies in a stream of events.
- Physical security brings more devices, many of which are in exposed locations. In addition, they are more difficult to manage at scale. The combination creates a vulnerable cyberattack surface. Cloud recording/management complicates issues because you now have to trust providers when it’s hard to verify they’re doing things right.
- The electronic security partner ecosystem should be ashamed of its history to date. We used to be the “security guys”, now we are mostly just part of the problem.