Defining a Role

As cyber and physical security converge, the role of the chief security officer must evolve

The sudden long lines at gas stations in the United States, last May were for many, a surprising sight. Indeed, the situation emerged without warning: A ransomware attack disabled computer systems for a major regional provider, Colonial Pipeline, creating shortages and panic-buying. In North Carolina alone, 68 percent of gas stations were out of gas.

The scenes clearly illustrate an emerging conundrum for organizations: Cyber security and physical security are converging. As more systems become interconnected, business operations increasingly depend on digital infrastructure to manage everything from the supply chain and power grids to intellectual property.

Cascading Effects of Dynamic Risk
In 2021, organizations contended with several massive-scale threats, including.

  • One of the largest disruptions of supply chain availability the world has ever seen
  • A record year of security vulnerabilities, particularly to our critical infrastructure
  • The deadliest year for major weather disasters in four years
  • The worst assault on the U.S. Capitol since 1812
  • An all-time high in the number of people working from home

In fact, 99 percent of security and risk management professionals experienced a critical event in the past 18 months, according to a commissioned study conducted by Forrester Consulting. These incidents show no signs of abating. The wide scope of such critical events means no business function or industry can escape the impact.

It is also clear from this list that threats are no longer isolated events. In the modern world, risk is dynamic and complex. Risk A has a high potential to evolve into Risk B. That is, a hacker may steal intellectual property from your most important supplier and potentially impact your operations or revenue goals, as the following examples show.

Supply chain. Hackers breached the servers of Quanta Computer, stealing and leaking proprietary schematics of Apple products. Though the attack didn’t affect Apple’s business operations, the threat to a supplier underscores the fragile link between digital and physical assets.

Critical infrastructure. During a breach of a Florida water treatment facility last year, a hacker reset chemical levels to a potentially dangerous range. The event significantly concerned the Biden administration, which announced plans to bolster security for the sector.

People safety. A ransomware attack can delay or even prevent hospitals from providing critical patient care.

This conundrum – that cyber risk rolls into physical risk – is transforming the chief security officer’s role.
Faster than expected, they’ll need to almost think like a CEO and take a wider view of organizational risk and a more proactive role in responding to these new realities. To get there, here are three key changes you can make right now.

Cultivate a culture of organizational resilience. An initiative as important as this must start at the top, with a leadership vision that outlines what organizational resilience means to your business. Achieving a culture of organizational resilience will require both a shift in thinking as well as a new framework.

The convergence of cyber and physical security points to what should be an obvious fact: Leaders should recognize their functional areas are no longer unique, separate operations. They often overlap or intersect, impacting others. With disrupted events so tightly correlated, collaboration among teams isn’t simply a nice to have. It is table stakes.

The interconnectedness of systems means risk can no longer be handled by individual teams. If a physical threat emerges from a security breach, you’ll need help from human resources, finance, corporate communications, disaster recovery, enterprise risk management, IT, cyber security and physical management, etc. That is why it’s crucial to bring together the right people from across the organization and agree on common objectives and goals.

Eliminate operational silos. With the right people at the table, look at what’s keeping you from accomplishing your vision. What are the pain points – both operationally and externally – hindering you from mitigating risk?

Often, decision-making happens in silos and stands in the way of resilience.

The key to breaking down operational silos is a unified view of risks impacting the whole business. Once you can see the big picture, it is time to expand business continuity programs so you can manage risk more effectively. You’ll need to evaluate and document the risk appetite and tolerance levels of each functional group for product or service delivery disruptions to their internal and external stakeholders. Finally, ensure everyone is on the same page and reaching for the right goals with a set of combined metrics.

Embrace AI and automation. Organizations have more data and information than ever before. In fact, with 2.5 quintillion bytes of data now being created daily, 90% of the world’s data has been created in just the last two years. New information is being created, and at times replicated, every second.

It is no longer humanly possible to monitor and track developments even within your own systems, in a timely manner. AI-powered risk intelligence will help you monitor dynamic risk at scale. Automation can be used to identify and act on the cascading impact of a cyberattack, from activating response teams to alerting those who may be impacted.

It is not enough to know a storm is coming. For faster, better decisions, you also need to know which operations may be affected and which employees are in the path. A single platform combining big data, artificial intelligence and automation of key resilience processes is your best bet for a 360-view of any critical event impacting your business.

The key is you don’t have to sit and wait for the next crisis before you manage it. Much can be done in advance – from identifying the right teams to engage to uncovering the gaps and breaking down silos.
Without question, risk is now a board-level conversation. As cyber security and physical security continue to merge and physical threats become more dynamic, security leaders must understand how their people, places and technology must change to get ahead of these complexities in 2022 and beyond.

This article originally appeared in the April 2022 issue of Security Today.


  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Making Safety and Security Intrinsic to School Design

    Public anxieties about school safety are escalating across the country. According to a 2023 Gallup report, 44% of parents fear for their child’s physical safety at school, a 10 percentage-point increase since 2019. Unfortunately, these fears are likely to increase if the incidence of school tragedies continues to mount. As a result, school leaders are now charged with two non-negotiable responsibilities. The first, as always, is to ensure kids have what they need to learn, grow, and thrive. Sadly, their second responsibility is to keep the children in their care safe from threats and physical danger. Read Now

  • The Power of a Layered Approach to Safety

    In a perfect world, every school would have an unlimited budget to help secure their schools. In reality, schools must prioritize what budget they have while navigating the complexities surrounding school security and lockdown. Read Now

  • How a Security System Can Enhance Arena Safety and the Fan Experience

    Ensuring guests have both a memorable experience and a safe one is no small feat for your physical security team. Stadiums, ballparks, arenas, and other large event venues are increasingly leveraging new technologies to transform the fan experience and maintain a high level of security. The goal is to preserve the integrity and excitement of the event while enhancing security and remaining “behind the scenes.” Read Now

Featured Cybersecurity


New Products

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3