Why physical and IT security are converging
- By Stephen Joseph
- Mar 01, 2016
Today’s retail banks are nothing like they were in your grandfather’s
day. Back then customers conducted all their banking business in a
physical branch. Now, thanks to mobile technology, most customers
rarely step across the threshold, opting instead to bank remotely
from whatever device and location they want. This shift in banking
practices has forced financial institutions to rethink their security measures and go
beyond brick and mortar to include the cyber realm, as well.
In essence, physical security is now converging with IT security. With today’s
technology evolving at blinding speed, this blurring of the boundaries was inevitable.
The goals, however, remain the same: protect assets, mitigate risk and maintain
business continuity. There are a few important differences. With these new
network-based technologies, financial institutions become more agile and responsive
Furthermore, these security solutions are easily scalable as the business grows.
But to fully embrace the potential benefits of this converging technology, banks need
to understand how this technology maps into their previous security landscape.
THE CHANGING ROLES OF IT AND PHYSICAL SECURITY
For many years, the IT and physical security departments were two very distinct
entities, both necessary and vital to an organization but with different objectives.
The main focus of IT was to ensure that the enterprise networks were operational,
secure and ready, and that business operations were connected and running
smoothly. The main focus of the corporate security director was to ensure that the
company’s financial assets were protected, brick and mortar facilities were secure
and a security presence was visible to deter potential treats. Until now, it wasn’t
uncommon for these two departments to have very little interaction.
But, that is beginning to change with the growing number of smarter, networkbased
security technology now available on the market. Today the two departments
are sharing common tools and working in concert to mitigate both physical
and cyber threats to the institution.
One of the main drivers behind this change is that the average size of internal
security staff is shrinking. To compensate, corporate security directors have had
to augment their limited security staff with smart technology that can provide
traditional security support while also handling some of the decision making.
Banks have begun programming their intelligent network devices to conduct critical
analysis based on preconfigured embedded functionality, and then make decisions
automatically without having to wait for someone manning a PC to provide
A good example of this is network routers that can be programmed and segmented
to detect and route specific network traffic, such as financial transactions,
e-mail or surveillance video, according to preset conditions and priorities. As intelligent
devices for physical security become ever smarter and processing capacity
ever greater, eventually most important decisions and/or processing will be
performed in the field on the endpoint devices connected to the network. This is
known as a distributed or decentralized model. The solution is highly scalable: all
that’s required is a PoE connection to both power and transmit data.
Because IP devices run on the enterprise network and are based on open standards,
they provide a clear advantage over analog technology where systems and sites usually operate as independent silos, which require extra manpower to manage
and retrieve information. These proprietary systems have limited scalability
and don’t easily integrate across locations or with other security technologies, such
as fire detection and access control. As a result, unlike IP-based systems, their investment
value tends to diminish as the institution grows and expands its portfolio
of security tools.
MITIGATING POTENTIAL THREATS
The rise in cyber attacks and their potentially devastating impact on business operations
has led many retail banks to spend more time and money on improving
cyber security programs and implementing best security practices. They’re taking
steps to assess how much they know about potential threats to the institution’s enterprise
network and then taking strategic action to ensure that it is kept as secure
Often the first step in assessing threats is to recognize that any enterprise network
and all devices connected to it can leave a door open for a cyber-attack.
Therefore, financial institutions need to be especially diligent when adding any
device to the network. When it comes to deploying a physical security system technology
on the bank’s network, it’s important for corporate security directors to
work closely with IT to evaluate network capacity and vulnerability, understand
corporate security procedures, and follow best practices.
Statistics show that the majority of security breaches stem from human error,
misconfiguration and a lack of processes. So it is critical that not only the retail
banking organization but also the entire vendor supply chain share responsibility
for protecting the network and all its devices and services by adhering to stringent
THE RISE OF IP SURVEILLANCE
One of the more popular physical security devices being deployed across banking
networks today are IP video cameras. From an IT perspective, an IP camera being
used in a security system is a network end-point similar to a desktop computer.
Therefore the security camera should meet certain basic IT security standards
such as having assigned password protection as a first line of defense. As with
any network device, the banking institutions should follow some basic protection
- Perform a risk analysis of the enterprise network: Identify internal and external
threats and vulnerabilities.
- Gain knowledge on system protection and possible threats: Determine what levels
of protection exist and the known weaknesses.
- Secure the network: Create a standard IT security policy that can be audited.
- Review and change factory default settings: Change default usernames and passwords
regularly and frequently.
- Use strong passwords: The strength of a password is a function of length, complexity
- Prevent cameras from being directly accessible on the Internet: This feature
should be selectable in the camera configuration during programming.
- Use encrypted connections when possible: This is a method of using security
functionality or devices to encrypt network traffic to and from a device.
- Check security logs frequently: Information should always be logged for later
review and audit.
- Monitor devices on a regular basis: Develop random, periodic testing and confirmation
for all devices on the network.
- Use the latest device firmware available: Always promptly install required security
patches and firmware that correct known vulnerabilities.
Although there will always be potential threats when adopting new technology,
the benefits should be weighed by both IT and physical security to ensure that
every possible step has been taken to seamlessly merge cyber
and physical security programs. Doing so will make it possible
for the institution to become more proactive, collaborative and
successful in mitigating potential risks.
This article originally appeared in the March 2016 issue of Security Today.