In-Depth
Seven Best Practices for Managing Physical and IT Security Convergence
How can an enterprise manage the influx of security events in both physical and IT silos that have traditionally operated independently but are now coming together? We offer seven suggestions.
by Tony Lapolito
The end of 2006 witnessed a media wave detailing the convergence of physical and IT security, driven largely by the greatest fear of security professionals—a coordinated assault that combines an attack on the IT network to eliminate an organization’s ability to command, control, and communicate with a physical security attack. The central benefit of converged security is a clear view into all threats to the enterprise and how they interrelate so you can respond intelligently, appropriately and swiftly to the situation at hand.
The convergence of physical and IT security systems brings with it an immense number of technologies that must come together. This convergence is happening primarily in two phases:
- With video surveillance and physical security as an IT application, an organization benefits from lower costs (because there is only a single network to manage); greater security and scalability; remote access and management; and standards-based interoperability with other systems.
- Interoperability between physical and IT security lets an organization share data across the physical and logical plane; and coordinate protection of physical, information, and network assets.
IP video technologies and a growing number of cameras, sensors, and alarms create scalability issues which are compounded by IT security solutions that produce volumes of security events. The amount of data and feeds to watch and analyze can be overwhelming.
As an enterprise, how do you manage the influx of security events in both physical and IT silos that have traditionally operated independently of each other but are now coming together? Theoretically, converging physical and IT security makes sense, but in practice it is much more difficult to achieve. We offer seven best practices for effectively managing the coming security convergence through the two phases we mentioned.
Best Practice #1: Get Executive Buy-in Up Front
As with any fundamental shift in operations, it is crucial to get executive sponsorship. The benefits of a clear view of all potential security threats and events to an organization in today’s security-aware world should serve as the trigger for you to converge physical and logical security systems, and provides a clear reason for executives to support the effort.
Best Practice #2: Don’t Replace Your Infrastructure
Instead, add technologies, processes and policies that leverage your existing infrastructure. We all know rip-and-replace forklift upgrades simply aren’t realistic. Utilize existing infrastructure investments and utilize processes that personnel are familiar with to ensure a smooth transition to a converged security environment. If new processes and policies are not intuitive and familiar, rejection will occur and the new investments will be wasted.
Best Practice #3: Don’t Operate in a Vacuum
Your physical video surveillance network should not operate as an island. Seamless integration with your other security systems investments (alarm systems, video analytics, reporting tools, sensors, identity management systems, access control, and intrusion detection systems)—both within your organization and with other organizations --- is key to the overall effectiveness of your security effort. Your video surveillance network should be able to interoperate with your existing technologies and new deployments alike through open standards, a key consideration when evaluating technologies.
Best Practice #4: Go Hybrid
Advancements in digital technology now dictate an update to the existing infrastructure to take advantage of new capabilities of digital cameras, DVRs, sensors, and surveillance technologies. To successfully manage the information coming from all of the different sources, both analog and digital technologies must be able to work together and communicate with each other. This enables operations center personnel to access all of the data from various systems (including existing legacy and newer digital technologies) in a single management platform without toggling between disparate applications.
The digital migration has begun, but this will only happen over time and as budgets permit. The time estimates for migration from analog to all-digital systems range from 5 to 10 years depending on such factors as the level of involvement and scale.
Best Practice #5: Future-Proof Your Surveillance Network
Don’t get stuck implementing proprietary technologies from vendors that won’t work with your other technology investments and don’t have a clear roadmap for doing so in the future. The value of technologies increases exponentially when interconnected with others, so balance the novelty of a new feature with its ability to provide long-term value. Commit to emerging standards and integrate with the IP network.
Best Practice #6: Correlate for Success
A single car in a parking lot late at night may not be cause for concern. The same can be said of a rattling door handle. Combined with a motion detector alarm in a transformer room typically only accessed by maintenance personnel mid-day, however, and the situation is cause for action.
Today’s security systems produce countless logs of actions and activities that in and of themselves are innocuous, but when taken together, deserve our attention and should elicit a response. Correlating information from all data sources coming into the operations center is crucial, enabling personnel to focus exclusively on preventing, detecting, deterring, and responding to a situation.
Until now, there has been a void at the intersection of physical security and IT security. Despite the staggering number of cameras, alarms, and sensors feeding data to an operations center, there lacked a physical security information management platform that could take in all the data, correlate it with data from IT security systems, and provide insight to help security personnel make effective decisions and respond to security events. Take advantage of emerging physical security information management (PSIM) solutions that can serve as the correlation engine between physical and IT security.
Best Practice #7: Leverage Advances in Communications Technology
Advances and deployments in technology over the last 10 years have produced the ability to instantaneously connect with anyone, anywhere, anytime. Leverage the appropriate tools – including integration with cell phones, radios, video conferencing, chat and desktop—to communicate critical intelligence and data at the moment it is needed most.
Conclusion
Following these best practices can make a significant impact on the efficiency of an operations center and your security organization. Ideally, the management of your entire security network can be handled without employees needing to understand the underlying technology, enabling them to respond swiftly to critical situations, which is what they are trained to do. By more effectively managing data from the thousands of devices, alarms, and cameras you have, operations center personnel, and those they are tasked to protect, benefit from collaborative situational awareness.
By converging video surveillance and other physical security systems with IT security, taking in the enormous volume of information and distilling it into the most pertinent insight, organizations can significantly improve cross-organization communications and efficiencies while fortifying a comprehensive security posture. As enterprises get more comfortable with the inevitability and value of a fully-integrated physical and IT security environment, they’ll realize that following these seven habits will enable their security personnel to effectively manage the flood of new threats emerging daily.
Tony Lapolito is vice president of marketing with VidSys and can be reached at lapolitot@vidsys.com.