Head In The Cloud Feet On The Ground

Things to remember when choosing a cloud PACS in the federal government

More government agencies are taking their physical access control system (PACS) to the cloud, and it’s easy to see why. The cloud simplifies what otherwise can be an arduous operation. Even the National Institute of Standards and Technology, in its recent “Definition of Cloud Computing,” identifies cloud computing in terms of its simplicity. Cloud operations, it notes, require “minimal management effort or service provider interaction.”

But in the rush to claim a spot in the cloud to enhance HSPD- 12 and PIV services, agencies would benefit by looking at the bigger picture. While a simple cloud solution is good, a cloud solution that is both simple and secure is even better.

The Benefits

Cost savings alone lure many information technology officers. Thanks to Software-as-a-Service (SaaS), the expense and hassle of dedicated application server and workstation maintenance, upgrades, repairs and specialized personnel effectively become the responsibility of the solution host. With these savings, enterprises are able to reconfigure budgets so that more money is allotted for things such as operations. They also can more efficiently use IT and server resources, potentially sharing them for a more collaborative enterprise.

Centralization is likewise appealing, particularly to multi-tenant and multi-facility enterprises. Managing a separate server room or system at each facility is a far cry from efficient. Cloud deployment allows these enterprises to use minimal physical IT resources to support the maximum level of IT demand—whether that be through a private or hybrid cloud.

And let’s not forget scalability. Agencies can enjoy the benefits of the cloud regardless of their size. Should these agencies expand, the cloud can allow their PACS to grow with minimal disturbance.

These benefits are significant. To many enterprises, they are too appealing to pass up. But this is only half the story.

A Simpler, More Secure Cloud

Distracted by the obvious advantages of cloud PACS, enterprises must take the time to ensure that the cloud solution they choose is complete and secure. To do its part, the federal government has established an accreditation process for cloud providers called the Federal Risk and Authorization Management Program (FedRAMP). While FedRAMP is a step forward for standardization, a robust, viable cloud solution is one that mixes the benefits of reliability and cost savings with the promise of security and streamlined operations. With the assumption that all cloud PACS are created equal, some agencies may overlook an even simpler—and more secure—solution.

Secure Infrastructure

First, agencies should do well to ask vendors if their cloud PACS infrastructure is engineered as a complete solution—designed to serve the entire enterprise equally. A solid infrastructure supporting an agency’s PACS cloud solution can eliminate unforeseen challenges such as the complexity and costs associated with elaborate integration efforts.

Using seamless infrastructure can simplify this aspect of cloud PACS. For example, solution providers that upgrade an entire team of readers with the click of a button eliminate the need to service individual readers one by one and thereby showcase the benefits of an enterprise cloud solution. Likewise, the inconvenience and difficulty this work could present for an enterprise’s operations is removed.

In the move from a local server solution to a cloud PACS or SaaS, enterprises should ensure that they don’t trade one means of simplicity for another source of complication.

Authentication

By the same token, nothing undermines the benefit of simplicity and the single purpose of a PACS like the threat of fraud. For that reason, viable PACS cloud solutions in the federal government should be capable of strong authentication. With a tool as sophisticated as the PIV card, agencies should utilize the technology, which is called for in HSPD-12, OMB M11-11 and FICAM.

Agencies should deploy strong authentication that reinforces facility security with each access control transaction. Information should not be cached or reused for days at a time, creating an unnecessary security risk.

In short, cloud PACS in the federal government should use PIV and PIV-I credential authentication that:

  1. Verifies that the credential is genuine, cryptographically validating that the credential is not counterfeit or fraudulent by performing a challenge-response exchange for every single reader transaction.
  2. Verifies origin to ensure that the issuers are trusted and legitimate.
  3. Confirms that the credential data has not been altered; the system should verify that the unique ID and all information on a user’s card were not altered and that the certificate is signed and trusted.
  4. Confirms certificate status by using a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) Responder to confirm that the certificate is active.

The introduction of fraud to an access control system can complicate the operation and undermine the end goal of a PACS. Strong authentication enables enterprises to identify fraudulent credentials and prevent unauthorized access with each transaction. Some vendors offer one or two of the criteria but not all four, which is a shortsighted approach.

Opting for a cloud PACS solution is, without argument, an upgrade. However, the benefits are limited if that solution is not supported by a solid, holistic infrastructure and also protected from fraud. After all, only a secure enterprise cloud solution is truly simple.

This article originally appeared in the October 2012 issue of Security Today.

Featured

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

  • DHS to End ‘Shoes-Off’ Travel Policy

    Homeland Security Secretary Kristi Noem announced a new policy today which will allow passengers traveling through domestic airports to keep their shoes on while passing through security screening at TSA checkpoints. Read Now

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.