Automation Can Close the Gap on Cyber Exposures
Security pros can protect their systems without being cybersecurity experts
- By Tom Galvin
- Apr 01, 2019
See no evil, hear no evil, speak no evil: It is tempting
for physical security professionals to take this passive
approach to cybersecurity. End users can be blind to
threats and vulnerabilities from their security system
and other IoT devices. Many integrators and installers
don’t feel comfortable discussing the topic with their customers.
While IT departments may have the responsibility for cybersecurity,
they often don’t have good visibility into the physical security
system and other IoT assets. Even as security systems become
increasingly interconnected and IT-oriented, physical security pros
and IT often don’t want to hear from or talk to each other. Speaking
different languages, many just don’t know how to communicate.
Physical security pros must take responsibility for cybersecurity
now. By using automation technologies, installers can apply cyber
practices without being cybersecurity experts. Monitoring for cyber
and other system health issues sustains a secure and reliable system
for end users and differentiates the service provided by the system
Physical Security Cyber Vulnerabilities
Technologies connected to the physical realm are yielding incredible
applications, from predicting maintenance problems in oil field
equipment to recognizing the signature walk of employees for identity
management. Yet these applications create threats to organizations
and opportunities for criminals. Hackers can use unsecured IoT
devices to infiltrate corporate networks, launch attacks on the public
internet or disrupt the video surveillance system.
A growing list of elements provide attack surfaces that IT organizations cannot see, such as network cameras,
sensors, cloud-based video and mobile
devices, Windows-based video management
systems, and Ethernet networks that extend
to hallways and parking lots.
Neither IT nor their access layer switches
typically monitor site-specific endpoints such
as cameras and access control. Unfortunately,
this means that security managers don’t
know when these units are compromised, go
off-line, stop streaming video or audio, reboot,
or are just missing.
In general, many organizations don’t
know just how many devices they have. For
instance, business units are deploying many
IoT devices with some help from IT but few
consultations with physical security experts.
According to a survey by the Ponemon Institute
and Shared Assessments, just 15
percent of organizations have an inventory
of most of their IoT devices and less than
half have a policy to disable those that present
IT and Physical
While organizations across the globe are
gravely concerned about cybersecurity, the
relationship between IT and physical security
can be blurry. It’s challenging to safeguard
all physical and digital assets when there’s little
communication, collaboration, or shared
understanding between these teams. IT managers
often “solve” the problems by asking
the physical security team to create separate
networks for cameras and other physical security
While such arrangements may give IT
managers a sense of security, rarely is there a
complete, clean break between the enterprise
network and the physical security network.
For example, even well-protected and isolated
“camera only” networks can have both
intentional and unintended connections that
link to the main corporate network. Deploying
just one IP-based camera or other IoT
device at a remote site can open an organization’s
corporate network to a cyber threat.
Lack of Expertise
on Both Sides
IT is struggling to secure the elements in its
traditional domain, and expertise is a scarce
commodity on both sides. The (ISC)2 Cybersecurity
Workforce Study cites a global
shortage of three million cybersecurity professionals,
with 500,000 of those in North
America. Nearly two-thirds of those surveyed
said their organizations lack enough
cybersecurity staff, and this puts them at risk
In Kasperky Lab’s 2018 “The State of
the Industrial Cybersecurity” report, survey
respondents listed their top challenges as hiring
employees with the right skills, securing
new IoT systems, finding dependable partners
and service providers for implementing
cybersecurity solutions, and increasing interconnectedness
with corporate/enterprise IT.
Many physical security pros do not have
the time, budget, or knowledge to properly
harden cameras and other IoT devices. Securing
these endpoints often requires a detailed
understanding of network operations
and a labor-intensive process. Then there’s
the challenge of monitoring and maintaining
hundreds or thousands of installed devices
against evolving risks.
Automation to the Rescue
Even if the industry had enough professionals
in the right positions—or could find the
right partners—humans alone cannot handle
the myriad tasks required to secure, monitor,
and maintain these systems. CSOs know well
the challenges of identifying credible threats
hidden among billions of daily security
events. They’ve been investing in automation
technologies to do things such as threat
hunting, alert triage, event management, incident
response, and user management.
Physical security teams should do the
same. Instead of see no evil, hear no evil,
speak no evil, operators should explore automation
tools that enable them to see all assets,
secure all assets and monitor all assets.
See all assets. The fundamental first step
to securing the security network is knowing
what is connected to it. An effective system
automatically detects what devices are connected
to the network. This “device” scan
should be continuous, discovering when new
devices are placed on the network.
For instance, have new network cameras
been added or broken cameras replaced?
Have other devices been added to the network
ports either unintentionally or maliciously?
Newly detected devices should not
be allowed to communicate with the network
until they are acknowledged and bound to
the network port with MAC binding or with
A complete, real-time inventory of connected
devices can help identify potential
threats and weaknesses. In addition to identifying
devices by type such as camera, access
control device, IP phone, and laptop, the inventory
should include manufacturer, model,
and firmware version.
Secure all assets. Once devices are detected,
automation should protect or “harden”
legitimate ones with best practices. Rogue or
unnecessary devices should be automatically
blocked or locked out.
IoT hardening is usually unique to the IoT
device type. For example, camera hardening is
different from IP phone hardening. Automation
can correctly identify the device type and
guide the installer through the hardening process
that is appropriate for that device.
Automation tools can also configure
best practices such as enabling a protected
VLAN for the security system, changing a
camera’s default login credentials, and binding
a camera’s MAC-ID to the network.
This ensures that rogue devices are not
plugged into exposed Ethernet ports on the
perimeter of the network.
Other key hardening practices that
can be automated include closing unused
ports, removing unneeded network services, whitelisting to restrict traffic to known networks, locking down exposed
network connections, and enforcing password complexity to
stop default and common password usage.
Monitor all assets. Once detected, automation can passively monitor
all assets 24/7. Yet monitoring to the server or switch is insufficient.
Visibility is needed down to the IoT device to provide notifications
when devices have vulnerabilities or performance problems.
Automated cyber protections can monitor network flows, detect
abnormalities, and respond immediately to suspected attacks. These
tools can be configured to look for events such as cable changes, device
disconnections, changes in data flow and direction, abnormal bandwidth
and power consumption, and camera image quality changes.
When abnormal behavior is detected, automation technologies
can generate alerts and take proactive interventions such as disabling
a device’s data or power port. For example, is that camera that just
went offline for a second a momentary glitch, or a hacker plugging
in a laptop?
Cyber monitoring is most effective if it is integrated with the existing
dashboards used to monitor physical security systems. For many
systems, the video management software or central station alarm
software is the primary health dashboard. Other physical security
systems are integrated with IT-oriented tools such as network monitoring
Physical security pros can take the same approach as CSOs who are
investing in automation technologies to evolve their security programs.
CSOs recognize that innovations in AI, machine learning, and automation
can bridge their gaps in expertise and the sheer manual labor
required to properly secure their IT assets. According to Accenture’s
2018 “State of Cyber Resilience” report, 40 percent of CSOs are investing
in automation and more than half are investing in IoT security.
The physical security industry does not have enough of these automated
tools, but some early models have emerged. For example, Axis’
Device Manager has evolved to facilitate device discovery and device
hardening functions for Axis branded cameras, access control, and
audio devices. Razberi’s CameraDefense cybersecurity solution automatically
discovers, hardens, and monitors cameras and IoT devices.
Integrating these types of tools with existing security management
tools can help provide comprehensive coverage of the physical
security ecosystem. A single management and operational dashboard
creates a more efficient workflow to address cyber threats within the
surveillance system infrastructure. For instance, alerts from Razberi
CameraDefense are supported by video management systems such as
Milestone XProtect or IT network tools such as SolarWinds.
It is time for the physical security industry to take control of its own
destiny. See no evil, hear no evil, speak no evil is not a security strategy.
Working more closely with IT to secure the burgeoning number
of IoT devices is imperative. Applying automation
to physical security can ensure that best practices
are done correctly and at scale, saving staff hours,
preventing cyber attacks, and avoiding adverse impacts
to bottom lines and reputations.
This article originally appeared in the April 2019 issue of Security Today.