Why security integration is important

Issue 9 2020 Information Security

When we talk about enterprise security, it can only mean two things: logical (network/cyber) security and physical access control. While physical security, consisting of alarms, access control and CCTV has been in place for over two decades, network security is a relatively recent phenomenon.

Cybersecurity is mainly concerned with viruses, malware, and IP theft. However, network and physical security were never independent. The merging of both has been mentioned for many years, but the implementation is quite complex for many enterprises.

For this reason, they are still treated as siloes, and convergence remains long overdue.

The following are eight reasons why unifying physical and network security is crucial:

1. The explosion of IoT

Physical security assets such as control panels, readers, alarms, and security cameras are now connected to the Internet, thanks to the advancements in IoT. However, it also makes them vulnerable to attacks.

A decade ago, it would be hard to imagine that HVAC systems could also pose a significant risk to an organisation's safety. However, this happened in 2014 when hackers exploited a peculiar defect in Target's HVAC systems and stole the personal data of nearly 40 million customers.

This is an example of how physical security assets are threatened due to lapses in network security. However, the concern is not limited to just cyber-attacks.

The scenario can be the exact opposite, where a highly secured network is left unprotected due to lapses in physical security.


Adrienne Campbell.

2. Threats to physical systems

Instead of penetrating network security, the attacker could decide to leverage the gaps in physical security. By doing so, they can gain access to building control operations such as the energy grid, video surveillance cameras and smart locks.

In that case, no level of cybersecurity can stop the attacker from entering the facility and walking out with the server. For this reason, the premises must be as secure as the network – something that is feasible with integration.

Think about this: as soon as an intrusion alarm goes off, the server room locks itself. Such robust physical security, combined with powerful cybersecurity, can protect servers on both fronts.

3. The need for centralisation

Visibility has been a big issue with connected devices. It is because most of the organisations don't have a centralised location to control IoT devices. Instead, these devices are connected across distant locations, such as a remote office, supplier's truck or a wind turbine. What complicates the matter is that many IoT devices are not manufactured with security in mind.

Hence, organisations not only need to centralise control, but also ensure that their connected devices are secure.

4. Coordination between OT and IT

Operational technology (OT) and IT don't operate in siloes anymore. We have observed that most organisations have separate departments for both. This needs to change. The integration should start with coordination between OT and IT teams.

Everything, right from industrial systems and manufacturing plants to mobile devices and smart cameras, is on the same network. Therefore, it makes sense that both IT and OT teams should be on the same page as well.

To achieve that, CIOs (chief information officers) and other senior executives should establish a security command centre where physical and cybersecurity teams can work together.


5. The affordability of technology

‘Smart’ tools, as we call them, are becoming cheaper and smaller. The affordability of technology leads to broader utility and availability. It also creates a frightening situation since malicious third parties no longer need a huge budget or sophisticated systems to hack into enterprise security.

Several sensor technologies, including pressure, smoke, temperature, optical, image, infrared and proximity sensors are blurring the line between digital and physical security as well.

For instance, setting the office temperature is now as simple as changing controls on a smartphone app. It is not something that security experts usually consider as risky or undefended. However, what happened in Target's case clearly establishes that these low-risk, automated systems need to be taken into account as well.

6. The proliferation of cloud-based platforms

Businesses are increasingly moving from on-premise IT infrastructure to cloud-based platforms. There are several reasons for doing this. Maintenance is no longer an issue since most of the updates occur via the cloud. Besides, vendors offer annual and monthly subscription plans which are budget-friendly for startups.

That said, cloud-based platforms are also supported by hardware (however minimal) within the facility. Only authorised personnel must get access to the system. Moreover, the emergence of cloud-based enterprise applications underlines the significance of IoT cybersecurity.

7. The efficiency of operations

The whole purpose of merging physical and network security is to enhance the efficiency of operations. We all know that physical security systems have been upgraded owing to smart features such as two-factor authentication. In addition, biometric scanning is generally used to secure physical access.

A live feed can be sent via the cloud to generate alerts when an intruder is detected by adding a motion-activated camera. Therefore, the unification of physical and network security stands to offer better protection to organisations.

8. Internal vulnerabilities

Without question, employees are an organisation's first line of defence. Traditionally, they have to manage multiple credentials to access their workspace and computers. Weak passwords can also pose a security risk for enterprises. It's common for IT help desks to receive multiple calls due to employees forgetting their credentials.

An integrated system can solve this problem. Besides, it's easier to train new employees on using a single interface to access both their workspace and computers.

The bottom line

Technological advancements present new security challenges to businesses. The role of a cloud services vendor, cybersecurity expert, IT security manager, and CIO is increasingly becoming tangled. In fact, new security roles such as IoT cybersecurity experts may arise in the future when the binary distinction becomes virtually impossible.

Organisations may still choose to hire different personnel to manage both components of security – physical and network. What matters is that each person assumes the greater responsibility of tightening the security of the organisation by integrating both components.

Adrienne Campbell is a security consultant and holds a Bachelor of Science degree in cyber/computer forensics and counterterrorism from the University of Illinois, Chicago. Hacking is one of the most misunderstood areas of modern life and she helps audiences that are interested in technology, coding and other fields to understand that hacking is something that can be addressed. You can find Adrienne at https://adrienne-campbell.com/




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Managed security solutions for organisations of all sizes
Information Security News & Events
Cyber attackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
Data resilience at VeeamON
Technews Publishing SMART Security Solutions Infrastructure Information Security
SMART Security Solutions attended the VeeamON Tour in Johannesburg in August to learn more about data resilience and Veeam’s initiatives to enhance data protection, both on-site and in the cloud.

Read more...
Troye exposes the Entra ID backup blind spot
Information Security Infrastructure
If you trust Microsoft to protect your identity, think again. Many organisations naively believe that Microsoft’s shared responsibility model covers Microsoft Entra?ID – formerly Azure AD – but it does not.

Read more...
Secure data protection without hardware lock-in
Infrastructure Information Security News & Events
New Veeam Software Appliance empowers IT teams to achieve instant protection with Veeam’s fully preconfigured, software-only appliance, delivering enterprise-ready simplified deployment and operational efficiency, robust cyber resilience.

Read more...
Check Point launches open, vendor-neutral MDR services
Information Security News & Events Products & Solutions
New Check Point MDR 360° and MXDR 360° offerings deliver 24/7 managed continuous threat monitoring protection across endpoints, cloud and network environments with built-in identity threat detection and 160+ integrations across hybrid, multi-vendor environments.

Read more...
Credential theft surges in South Africa
NEC XON Information Security
NEC XON issues a critical cybersecurity warning about the dual threat of massive credential theft and AI-powered cyberattacks sweeping across the region, with an increasing number of incidents and evolving threat tactics.

Read more...
Want effective Attack Surface Management? Think like an attacker.
Information Security
Effective ASM requires companies to think like attackers, anticipate risks, and act decisively to reduce exposure by knowing their environment, deploying a structured approach, leveraging capable tools, and addressing both internal and external risks.

Read more...
The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...
POPIA non-compliance puts municipalities at risk
Information Security Government and Parastatal (Industry)
Digital responsibility must go beyond POPIA compliance to recognising that privacy and service delivery are fundamentally linked. Despite this, only 51 out of 257 municipalities submitted their mandatory data protection and access to information reports in 2024.

Read more...
Choicejacking bypasses smartphone charging security
News & Events Information Security
Choicejacking is a new cyberthreat that bypasses smartphone charging security defences to confirm, without the victim’s input or consent, that the victim wishes to connect in data-transfer mode.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.