classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2018


Assessing risks in security technology systems
September 2017, This Week's Editor's Pick, Security Services & Risk Management, Residential Estate (Industry)

The process of risk assessment and implementing mitigating actions is well known to us all. In the business world, the risk assessment process is often undertaken following the PESTEL format. PESTEL refers to the components that need to be evaluated, i.e. PESTEL stands for Political, Economic, Social, Technology, Environmental, Legal.

Rob Anderson
Rob Anderson

To a large extent, this approach does carry over to the methods used when doing a security risk assessment. It is, however, unusual for the security risk assessment to evaluate the risks ‘embedded’ in the technology solutions, be they existing or new technology. Even more interesting is that the technology solution was probably implemented because of a physical risk assessment. The technology was used to mitigate the physical risk, and much to the surprise of all, it comes with its own risks.

One of the challenges is that the technical risk assessment needs to be undertaken by a technically competent person who understands the risk assessment process. Do these individuals exist? Probably, yes, but they are few and far between.

Common risks

Let’s look at some of the technology risks that are most common, easy to assess and resolve. At present, the biggest risk must be the sudden rush of ransomware and virus infections. If these get into your security system you will remember it for a long while. The problem is that almost 100% of security systems are connected to the Internet. The security ‘guru’ will tell you this is vital for:

(a) Software upgrades

(b) Remote maintenance

(c) Cloud-based security systems

Before the digital age, we had ’closed’ systems, now it seems that this is not possible. The solution, employ a specialist who puts actions and processes in place to reduce the risk, and provide a recovery solution for when your systems are attacked by a cyber criminal. True to form, most organisations take action after the first infection.

Moving on to the other risks seen on many sites:

Camera systems

Have you checked that the camera is still recording? If the camera has been set up with analytics, is it still functioning as planned? What happens when the power fails? Is there a backup power system (that works)? Is the camera still showing the view intended and does it provide a good picture 24/7?

And of course, in the IP camera world the threat of the camera being ‘hacked’ has become real.

Power backup systems

• How often are the batteries checked to see if they are at the end of their life?

• Does the standby generator support the UPS correctly, or does the UPS see the generator as a ‘bad supply’ and runs on batteries?

• Are cables sized correctly so that voltage drops are not excessive?

Lightning and surge damage

• Are the power as well as data systems backed up with surge protection?

• Does the earth system comply with the surge protection equipment requirements?

• Surge protectors fail and need to be checked regularly. Is that being done?

Data backup

We have all learnt the hard way, so in most cases this is being done. The most common problems are:

• The system fault or virus migrates to the backup as well. Then there is no backup other than an accurate copy of the problem.

• Has anyone ever tried to recover the system from the backup to see if it works?

Access control systems

The access control systems are just as good as the current database of valid users and the way the system is used. In most cases (hopefully), the access control is synchronised with the CCTV to create a visual image of the person gaining access and egress. The most common failures here are:

• The security guard gives access and there is no visual or data record of the transaction.

• The database is years old. People still have access that should not.

• The database backup method is incorrect. This is most often the case with the SQL database.

• Who has the system setup access codes? Have they been shared? Or worse, if the maintenance chap is gone, how do you get into the system? But don’t worry, in most cases the systems are run on the default access codes…

Installation defects

This is probably the most common area of concern.

• Are there drawings and network diagrams of the systems? If not, what happens when service providers change?

• Are cables numbered and installed neatly so that it’s possible to trace faults?

• Have the correct cable types been used? Solid core, braided core, current carrying capacity etc.

• Is the electric fence energiser installed well away from the other components?

• Is there fuse or circuit breaker protection on the power circuits?

• Has the surge protection been by-passed?

• Are there tamper switches, power fail and low battery notification systems?

• Have all the system clocks been synced to one time?

The maintenance contract and procedures

So, the systems are all well managed and kept as risk free as possible. And then the monthly maintenance crew arrived and switched some equipment off for repairs and maintenance. As luck will have it, there is an incident while the equipment is off. We usually call it bad luck, but actually it is a real risk and there must be procedures to be able maintain a minimum level of security.

Interlinkages and dependences

The above risks are often linked: e.g. if the power fails then your other systems go down. Some interlinkages and dependencies will be obvious, but others less so. Does anyone consider mapping these and trying to work out how robust the whole system is?

This is a situation that we have all found ourselves in, with systems failing and we can’t believe so much can go wrong at the same time. Well, maybe it was one of those ‘lurking’ risks we need to be aware of.

And so, we can go on evaluating possible risks in the technology and putting actions in place to reduce the chance of a risk showing its potential. For the security technology sector to mature and play a positive part in this industry, much needs to be done to manage these risks.

Being aware of them is the first step.

Taking action is the most important next step to provide reliable solutions, and it has to be a client and integrator/ service provider joint action.

Let’s reduce our technology risks in the security sector.


Credit(s)
  Share via Twitter   Share via LinkedIn      

Further reading:

  • Significant differences in ­perceptions on state of digital trust
    November 2018, CA Southern Africa, Access Control & Identity Management, Security Services & Risk Management
    Nearly half of businesses admit to selling customer data, despite claiming data ­protection as paramount; consumer behaviour shows strong correlation between loss of business and lack of digital trust.
  • Trust but continually verify
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions, IT infrastructure
    Hi-Tech Security Solutions looks at access and identity management and asks some industry players what ‘zero trust’ and ‘least privilege’ access means.
  • Managing who, what and why
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security
    Today’s access control isn’t only concerned with who has access, but also what has access, why they need it and what they are doing with it.
  • Physical/logical convergence
    November 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Integrated Solutions, IT infrastructure
    The convergence between physical and logical (or cyber) security will be a game-changer because it will change the way we do everything, from planning to design and all the way to installation and maintenance.
  • Physical and logical convergence is a fact
    November 2018, This Week's Editor's Pick, Integrated Solutions, IT infrastructure
    Convergence, the next buzzword? A dated buzzword? Is convergence ­merely ­integration on steroids? What is convergence?
  • The expanding role of IT in access control
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, IT infrastructure
    What role is IT playing in the world of physical access control and how far will its role expand in future?
  • Taking augmented identity to the world
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    Hi-Tech Security Solutions spoke to Gary Jones, VP Global Channel and Marketing biometric access and time solutions) at IDEMIA (formerly Morpho) about his career with the company and its new vision of Augmented Identity.
  • Tracking biometrics into a brave new digital world
    November 2018, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    The industry is increasingly transitioning from unimodal to more integrated multimodal biometric solutions for more accurate identity verification and faster real-time results.
  • A better approach to fingerprint biometrics
    November 2018, This Week's Editor's Pick, Access Control & Identity Management
    Not all optical biometric fingerprint scanners are created equal. The type of sensor used has a powerful impact on speed, accuracy, reliability and portability.
  • The right access decisions
    November 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management
    Making the right access control decision depends on what you want secured and how secure it should be.
  • Reliability a fundamental in visitor management
    November 2018, Powell Tronics, Access Control & Identity Management, Integrated Solutions, Security Services & Risk Management
    With the rapid evolution of biometric technology, there are many options available in the marketplace that promise varying levels of performance.
  • Digital channels and the evolution of ID
    November 2018, This Week's Editor's Pick, Access Control & Identity Management, IT infrastructure
    While the concept of identity (ID) remains unchanged, the rapid evolution of digital technology has dramatically extended both its application and form factor.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.