Everything is connected

March 2018 Information Security, Security Services & Risk Management

Physical security is no longer just a case of a high fence and security guards. Everything is interconnected and reliant on readily available information and visibility in order to maintain security installations.

 John Mc Loughlin.
John Mc Loughlin.

Most businesses have access control systems that are connected to a computer, which often sits outside of the rest of the network. This is part of a bigger network of CCTV, proximity sensors and similar technologies along with the high fences and security guards acting as physical patrols.

All aspects of security are driven by information, and all of this is digital – so by not ensuring that you have the correct cyber-security programme in place all can be lost to a smart cyber-attack. Internet Protocol (IP) phones, cameras, access control are all connected to the Internet. Do you know how much of your footprint is visible to the outside world… and is it secured?

An important point to get out of the way is the ongoing mention of IT security. The name itself is incorrect; if we continue to focus on the words IT security, it means that this field sits purely within IT. This is not the case today. Cybersecurity cannot be done just by IT, it is a specialist field. You would not get an ice cream manufacturer to handle your physical security, so why ask an IT professional to manage your cybersecurity. Both could do the job, but would the outcome be desirable?

Cybersecurity threats are growing exponentially and this is because they are very difficult to trace with a far lower risk while still yielding very high returns.

We have seen many enterprises that have excellent physical perimeter security which includes access control systems, cameras and smart licence scanning at the gates. Access control systems contain sensitive and confidential information of all staff and contractors. These machines are usually attached to the network and accessible from the Internet to maintain a central database or report to HR. Another aspect is that sometimes these machines are not managed and therefore remain unpatched – or run an obsolete operating system such as Windows XP.

I have been told in several meetings that these access control machines are not very important because they just let people in and out, and the information is then used for payroll. This includes biometric data of all staff and visitors; the information that allows direct access into your property. Additionally, with this information a very focused and targeted social engineering or phishing attack on your staff could be launched. When you add personal information security requirements contained in legislation such as PoPIA, it is critical that all these systems are carefully managed and monitored.

Vulnerabilities in systems, especially those considered Internet of Things (IoT) devices, appear almost every day. Yet, most businesses do not even know that their CCTV control system should be updated or patched regularly – let alone what is accessible from the outside world. Many of these systems have direct Internet access and many installers never bother to change the default usernames and passwords. This is because cybersecurity is not thought of during the installation phase of these projects, and this step is then forgotten even after it is live.

A lack of cybersecurity visibility means that there is very easy access to all the information on your systems, including personal information, usernames and passwords. Open access to actual video feeds is also quite easily achieved through compromised or unsecured equipment. A simple Google search can give us access to thousands of camera feeds, images and login details from businesses all over the world.

The reality is that in today’s ever-evolving threat landscape, physical security is only one aspect of an overall requirement to secure businesses. Everything is hyper-connected and constant cybersecurity monitoring is critical – of computer networks and devices, but also the equipment used for physical security.

It is all well and good to have smart devices to scan a licence disc on entry, but without knowing that systems are secure and up to date you stand the risk of suffering a massive cyber breach. Reputational damage alone can destroy a business and lead to personal loss. An unsophisticated attack on a non-secured physical security environment can leapfrog onto other business systems, exposing confidential information, routes, customers, packages or even discount models – all of which can have a major impact on the business or be used to plan a heist or strike a ransomware attack.

The truth of the matter is that it is not only corporate servers and PCs which require cybersecurity monitoring and reporting, but this is also a massive requirement for security systems, cameras, IP phones and all other Internet connected equipment. Without visibility and monitoring you will never know where your cyber risks are.

For more information contact J2 Software, +27 (0)87 238 1870, john@j2.co.za, www.j2.co.za





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Deception technology crucial to unmasking data theft
Information Security Risk Management & Resilience
The ‘silent theft’ of data is an increasingly prevalent cyber threat to businesses, driving the ongoing leakage of personal information in the public domain through undetected attacks that cannot even be policed by data privacy legislation.

Read more...
Data security and privacy in global mobility
Risk Management & Resilience Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

Read more...
Navigating South Africa's cybersecurity regulations
Sophos Information Security Infrastructure
[Sponsored] Data privacy and compliance are not just buzzwords; they are essential components of a robust cybersecurity strategy that cannot be ignored. Understanding and adhering to local data protection laws and regulations becomes paramount.

Read more...
AI augmentation in security software and the resistance to IT
Security Services & Risk Management Information Security
The integration of AI technology into security software has been met with resistance. In this, the first in a series of two articles, Paul Meyer explores the challenges and obstacles that must be overcome to empower AI-enabled, human-centric decision-making.

Read more...
Milestone Systems joins CVE programme
Milestone Systems News & Events Information Security
Milestone Systems has partnered with the Common Vulnerability and Exposures (CVE) Programme as a CVE Numbering Authority (CNA), to assist the programme to find, describe, and catalogue known cybersecurity issues.

Read more...
Understanding the power of digital identity
Access Control & Identity Management Security Services & Risk Management Financial (Industry)
The way we perceive business flourishing is undergoing a paradigm shift, as digital identity and consumer consent redefine the dynamics of transactions, says Shanaaz Trethewey.

Read more...
Access & identity expectations for 2024
Technews Publishing IDEMIA ZKTeco Gallagher Salto Systems Africa Regal Distributors SA Reditron Editor's Choice Access Control & Identity Management Information Security AI & Data Analytics
What does 2024 have in store for the access and identity industry? SMART Security Solutions asked several industry players for their brief thoughts on what they expect this year.

Read more...
What you can expect from digital identity in 2024
Access Control & Identity Management Security Services & Risk Management
As biometric identity becomes a central tenet in secure access to finance, government, telecommunications, healthcare services and more, 2024 is expected to be a year where biometrics evolve and important regulatory conversations occur.

Read more...