The missing link for integrating physical and IT security resources

Image supplied

As physical security systems have evolved to include programming components and features for centralised control, the physical and IT security realms have converged. Yet, the tendency to work in silos remains.

He explains, “Historically, you would have specialists in physical security systems who would do the installation of cabling and CCTV and so forth. Nowadays, there are more programming requirements and a better understanding of how systems fit into one another has become necessary. Indeed, the game has changed and they’re all playing on a different playing field.

“Certainly, there is a degree of ‘protection of territory’ happening where IT personnel feel that physical security personnel are encroaching on their space and vice versa. However, IT specialists will always be responsible for IT security and the physical security specialists will still be responsible for the physical systems. IT should do the architecture as physical systems are introduced into their field of expertise being digital networks.

“Communication and collaboration between the different departments will facilitate a common solution that reduces the overall business risk through converging physical and IT security resources. That way, everyone understands the true business objective of a security convergence project, to reduce overall business risk, and how these different systems will be integrated to achieve this objective.”

Aside from poor interplay between the physical and IT worlds, Ueckermann says a lack of planning can also impact the success of integration efforts. Before embarking on any integration project, Ueckermann says companies need to be able to answer a few questions first.

Some of these include

1. Have you done an assessment to ascertain how the converged project will address your business risks?

2. Does your converged project strategy address both quality and cost drivers? For instance, will you get the lowest possible enterprise risk out of the project at the best possible price, and how does this fit into the risk profile of the business?
   
3. Does your choice of people, process and technology to design and implement the converged project align with your converged project strategy? What is the impact on the project’s total cost of ownership to the business in the long term?
   
4. Have you thought about how unauthorised access to restricted areas of the building can impact the business? How can you empower your staff to play a role in preventing or alerting you of unauthorised access, perhaps through awareness programmes?
   
5. What level of intelligence capabilities would your converged project allow and would you be able to proactively monitor and pick up on anomalies or risk indicators in or around your building?
6. Have you identified and communicated a security incident response plan to the rest of the organisation?
   

Ueckermann stresses that when integrating physical and IT security systems like video surveillance or building security systems into IT, it is critical to demilitarise or partition the different systems from each other. Properly evaluate your choice of equipment, such as surveillance systems before buying them.

You want the software that is used in these systems to be rock solid as there could be vulnerabilities written into the code that could compromise your physical security environments. Choose a vendor with a good reputation.

“So, although you want to run your CCTV, fire suppression system or access control on your IT network, it is important to shield each one from the others. Build security into the solution from the start. There should be no open protocol between these physical systems and your IT network that could expose the rest of your business’s infrastructure to unwanted risk.

“It is also essential to ensure that all equipment, whether it’s for an access control system or CCTV, is patched with the latest operating software. Just as computers and servers must be patched, so should the software on physical security systems be patched. The applications that run on these systems should also be kept up-to-date.”

He concludes, “When it comes to integrating physical security and IT, there needs to be more conversation. As long as there is a culture where different teams continue to service their own silos, we will continuously miss the mark. The organisations that are more mature, open to talk, open to listen and open to sharing opinions will be the ones that succeed with full convergence and enjoy a low-risk profile and at a lower cost structure.”