Assessing risks in security technology systems

September 2017 Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)

The process of risk assessment and implementing mitigating actions is well known to us all. In the business world, the risk assessment process is often undertaken following the PESTEL format. PESTEL refers to the components that need to be evaluated, i.e. PESTEL stands for Political, Economic, Social, Technology, Environmental, Legal.

Rob Anderson
Rob Anderson

To a large extent, this approach does carry over to the methods used when doing a security risk assessment. It is, however, unusual for the security risk assessment to evaluate the risks ‘embedded’ in the technology solutions, be they existing or new technology. Even more interesting is that the technology solution was probably implemented because of a physical risk assessment. The technology was used to mitigate the physical risk, and much to the surprise of all, it comes with its own risks.

One of the challenges is that the technical risk assessment needs to be undertaken by a technically competent person who understands the risk assessment process. Do these individuals exist? Probably, yes, but they are few and far between.

Common risks

Let’s look at some of the technology risks that are most common, easy to assess and resolve. At present, the biggest risk must be the sudden rush of ransomware and virus infections. If these get into your security system you will remember it for a long while. The problem is that almost 100% of security systems are connected to the Internet. The security ‘guru’ will tell you this is vital for:

(a) Software upgrades

(b) Remote maintenance

(c) Cloud-based security systems

Before the digital age, we had ’closed’ systems, now it seems that this is not possible. The solution, employ a specialist who puts actions and processes in place to reduce the risk, and provide a recovery solution for when your systems are attacked by a cyber criminal. True to form, most organisations take action after the first infection.

Moving on to the other risks seen on many sites:

Camera systems

Have you checked that the camera is still recording? If the camera has been set up with analytics, is it still functioning as planned? What happens when the power fails? Is there a backup power system (that works)? Is the camera still showing the view intended and does it provide a good picture 24/7?

And of course, in the IP camera world the threat of the camera being ‘hacked’ has become real.

Power backup systems

• How often are the batteries checked to see if they are at the end of their life?

• Does the standby generator support the UPS correctly, or does the UPS see the generator as a ‘bad supply’ and runs on batteries?

• Are cables sized correctly so that voltage drops are not excessive?

Lightning and surge damage

• Are the power as well as data systems backed up with surge protection?

• Does the earth system comply with the surge protection equipment requirements?

• Surge protectors fail and need to be checked regularly. Is that being done?

Data backup

We have all learnt the hard way, so in most cases this is being done. The most common problems are:

• The system fault or virus migrates to the backup as well. Then there is no backup other than an accurate copy of the problem.

• Has anyone ever tried to recover the system from the backup to see if it works?

Access control systems

The access control systems are just as good as the current database of valid users and the way the system is used. In most cases (hopefully), the access control is synchronised with the CCTV to create a visual image of the person gaining access and egress. The most common failures here are:

• The security guard gives access and there is no visual or data record of the transaction.

• The database is years old. People still have access that should not.

• The database backup method is incorrect. This is most often the case with the SQL database.

• Who has the system setup access codes? Have they been shared? Or worse, if the maintenance chap is gone, how do you get into the system? But don’t worry, in most cases the systems are run on the default access codes…

Installation defects

This is probably the most common area of concern.

• Are there drawings and network diagrams of the systems? If not, what happens when service providers change?

• Are cables numbered and installed neatly so that it’s possible to trace faults?

• Have the correct cable types been used? Solid core, braided core, current carrying capacity etc.

• Is the electric fence energiser installed well away from the other components?

• Is there fuse or circuit breaker protection on the power circuits?

• Has the surge protection been by-passed?

• Are there tamper switches, power fail and low battery notification systems?

• Have all the system clocks been synced to one time?

The maintenance contract and procedures

So, the systems are all well managed and kept as risk free as possible. And then the monthly maintenance crew arrived and switched some equipment off for repairs and maintenance. As luck will have it, there is an incident while the equipment is off. We usually call it bad luck, but actually it is a real risk and there must be procedures to be able maintain a minimum level of security.

Interlinkages and dependences

The above risks are often linked: e.g. if the power fails then your other systems go down. Some interlinkages and dependencies will be obvious, but others less so. Does anyone consider mapping these and trying to work out how robust the whole system is?

This is a situation that we have all found ourselves in, with systems failing and we can’t believe so much can go wrong at the same time. Well, maybe it was one of those ‘lurking’ risks we need to be aware of.

And so, we can go on evaluating possible risks in the technology and putting actions in place to reduce the chance of a risk showing its potential. For the security technology sector to mature and play a positive part in this industry, much needs to be done to manage these risks.

Being aware of them is the first step.

Taking action is the most important next step to provide reliable solutions, and it has to be a client and integrator/ service provider joint action.

Let’s reduce our technology risks in the security sector.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Why rehearsals and drills for crises and evacuation are so important
August 2019, Leaderware , CCTV, Surveillance & Remote Monitoring, Security Services & Risk Management
The rehearsal of concept (ROC) drill has been used extensively in the military, but is just as important when facing risks in organisations and institutions to protect people on the ground.

Read more...
24-hour emergency response for staff
August 2019 , News, Security Services & Risk Management
The FirstRand Group has partnered with PanicGuard to create a 24-hour emergency response programme for staff.

Read more...
Keeping our changing environment secure
August 2019 , Editor's Choice, Security Services & Risk Management
For a crime to take place there needs to be a victim and a criminal who sees an opportunity. For a cybercrime to take place we need the same set of circumstances.

Read more...
Augmented security with drones
August 2019, Drone Guards , Editor's Choice, Integrated Solutions
Drone Guards is moving into an untapped market of using drones to secure residential estates and other high-value assets such as mines, farms and commercial properties.

Read more...
The importance of real security risk assessments
August 2019, Sentinel Risk Management , Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)
Andy Lawler, MD, Sentinel Risk Management, says a security risk assessment is an onerous task, but is not something estates can consider optional or a luxury item anymore.

Read more...
Risk assessment or product placement?
August 2019, Technews Publishing, Alwinco, SMC - Security Management Consultants , Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)
Hi-tech security solutions asked a couple of experts to provide estate managers and security managers with some insights into what a ‘real’ risk assessment includes.

Read more...
How far are we really at with artificial intelligence?
August 2019, Axis Communications SA , Editor's Choice, CCTV, Surveillance & Remote Monitoring, IT infrastructure, Residential Estate (Industry)
Justin Ludik unpacks exactly how far AI has come and what it potentially can do for society and more importantly, surveillance.

Read more...
More than simply a camera
August 2019, Forbatt SA, Secutel Technologies , CCTV, Surveillance & Remote Monitoring, Residential Estate (Industry)
With the human element being the weakest link in all security solutions, Hi-Tech Security Solutions looks at the pros and cons of using body-worn cameras in estates.

Read more...
Residential security – caveat emptor
August 2019, Stafix , Integrated Solutions, Security Services & Risk Management
When it comes to improving your property’s security, make sure you take all the options into account as you build a layered approach to keeping people safe and assets secured.

Read more...
The importance of effective perimeter security
August 2019, Elf Rentals - Electronic Security Solutions, Stafix , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Residential Estate (Industry)
Protecting the perimeter is critical for any residential estate; how does one go about making sure your perimeter is as secure as possible?

Read more...