Help Your Customer Protect Themselves

• By Craig Herman
• Jul 25, 2024

In the world of IT, insider threats are on a steep upward trajectory. The cost of these threats - including negligent and malicious employees that may steal authorized users’ credentials, rose from $8.3 million in 2018 to $16.2 million in 2023. Insider threats towards physical infrastructures often bleed into the realm of cybersecurity; for instance, consider an unauthorized user breaching a physical data center and plugging in a laptop to download and steal sensitive digital information.

In recent years, many security system dealers and integrators have put the majority of their enterprise customers’ IT security focus on cyber elements like routers and firewalls. This is of course beneficial, but integrators are realizing that they can no longer pursue this limited approach without placing equal emphasis on physical areas.

As a security system dealer or integrator, how can you best advise your customers on what level of physical protection and hardening is necessary - for sensitive areas like server rooms, data centers, or any facility with stringent security clearances for that matter? What options are available and what makes the most sense?

Multifactor Authentication
As most of us know, a physical access control system allows organizations to manage who enters a physical space. In the IT realm, multifactor authentication (MFA) is widely used to protect both cyber (digital) and physical assets.

MFA works by requiring multiple protections, usually something a person knows (like a username and password) or something a person has (like a mobile device or email account). In this example, a person would enter a username and password, and then be sent a special code (via phone text or email) which would be required in order to authenticate.

MFA is a more rigorous process than passwords alone, but certain combinations like the common one described above are not impervious to threats, as usernames and passwords can still be stolen, and special codes intercepted by resourceful bad actors. Another drawback of using this type of combination for MFA is that it introduces an element of friction. Imagine a scenario where an authorized sys admin needs immediate access to the data center to implement a fix for a mission-critical server. In such a scenario, requiring more layers of authentication can make the process more complicated, time-consuming and frustrating.

Fobs and Keycards
Traditionally, physical access control systems have relied on fobs and keycards incorporated into electronic systems which then control doors and locks, allowing designated people to enter protected areas at these specific access points.

However, fobs and keycards are not perfect, dupe-proof systems, due to the fact that they are not bound to an individual. It is all too easy for someone to give or loan their fob or keycard to someone else, or for a fob or keycard to be stolen, allowing access to unauthorized individuals.

Harkening back to the issue of insider threats, it’s not hard to imagine one insider (an inadvertent employee) accidentally leaving out a fob or keycard, only to be snatched up by another insider (a malicious employee).

As a security system dealer or integrator, maybe you find that MFA or fobs and keycards are sufficient for your customers. But maybe you do not, as the risks they present are still too great given the sensitivity of their physical areas. And maybe the alternative like having live security guards on hand 24x7 is just too impractical from a cost standpoint. Fortunately, biometric authentication is evolving as an alternative to these porous and costly approaches.

Verify an Individual
Biometrics or, unique individual traits such as fingerprints, facial scans or speaker recognition that can be used to verify an individual's identity - can be the key to overcoming these challenges and providing assurances for your customers.

Biometric authentication can ensure organizational security is effective or get your customers to the next level of physical access control by answering the question - is this really the authorized person? They’re also nearly impossible to subvert due to liveness capabilities, which can detect that a person presenting for authentication is a real, breathing person, and not an attempt at a dupe (someone presenting a photo of an authorized user’s face, for instance).

When it comes to identity verification, biometrics are as close to foolproof as you can get.

There is good news around biometrics today as well - the first is that biometric capabilities or workflows are now available in a cloud-based SaaS model. This means any size customer can now use biometrics as part of their physical access control offering - whether itis a small organization securing a single door, office or closet, or a global enterprise with multiple buildings with various security levels needed. Moreover, customers can quickly get up and running with minimal upfront investment of time and resources. So if you suggest biometrics to a customer, you’re not recommending an expensive, time-consuming overhaul of their security infrastructure. In most cases, customers can leverage the equipment they already have along with the bring-your-own-device (BYOD) trend.

While we have relied heavily on physical access control in an IT sense (protecting server rooms and data centers, for example) to illustrate our point, your customers’ physical access control needs probably extend across a much wider range of use cases and scenarios, to other types of highly classified areas. Being the best steward of their comprehensive physical access control needs means being able to realistically advise on the drawbacks of certain approaches and offering new techniques – specifically those that fortify customers’ physical security more quickly and effectively than ever before, while leveraging their existing investments.

This article originally appeared in the July / August 2024 issue of Security Today.