IP-based technology can simplify security mandates and improve ROI

One of the persistent goals of IT management for more than a decade has been aligning IT with the strategies and goals of the business. So why would IT security, which has become one of the biggest preoccupations of IT management and even of C-level executives, be isolated from the physical security of the business? Don’t the two go hand in hand? Quite a few enterprises have concluded that they do, and have begun lowering barriers – helped along by the fact that the technology of premises security is increasingly inseparable from the technology of IT. “At one time, your physical security network ran over a proprietary network,” says Duncan Stewart, director of technology, media and telecommunications, life sciences and GreenTech research at consulting firm Deloitte & Touche LLP in Toronto. But Stewart says that now video surveillance cameras, once connected to stand-alone coaxial cable networks, are more likely than not to transmit their images over the same Internet Protocol (IP) networks used for data and possibly voice. “Security today is more IP-based than analog,” observes Michael Martin, digital media architect at IBM Canada Ltd in Markham, Ont. “It crossed over about three years ago.” “It’s all run on IP,” says Gene McLean, who retired about a year ago after several years as vice-president and chief security officer at Telus Corp, where his legacy includes the creation of an integrated security organization. “It’s all run on an IT backbone, and it’s IT-centric, so to have those separated, it could add some confusion...to your security procedures.” More than that, says McLean, “when you’ve got all aspects of security under one area and one internal mandate, then it’s much easier to get your return on investment.” Soon after joining Telus to take charge of physical security, McLean proposed a company-wide review of security procedures. That six-month process led to the decision to integrate IT and physical security. Implementing the review’s recommendations took about 18 months, the 28-year RCMP veteran says, but led to reduced costs and a more effective security organization. McLean finds it surprising that many organizations, including large corporations, still have separate “stovepipe” organizations handling different aspects of security. That is showing signs of changing, although slowly. Convergence rates differ by industry “There are some industries where this is starting to take a bit of a hold,” says Adel Melek, a partner at Deloitte in Toronto. “In many other industries – financial services for example – they are still run as two separate functions.” Deloitte’s 2009 worldwide survey of technology, media and telecommunications companies found that 44% of companies have now converged their physical and IT security functions to some degree. Only 11% have put the functions together in a single group, though. Fourteen percent have them reporting to the same individual, while another 19% have set up an enterprise risk council – including the heads of both IT and physical security functions as well as representatives from other areas such as human resources and legal – to oversee the over-all security picture. Physical security operations are increasingly dependent on IT infrastructure and expertise, while security video is one of the more advanced and demanding applications running over networks that IT people must maintain. But the increasing interdependence between the two groups doesn’t guarantee a match made in heaven. “The dependence has always existed,” says Chris Anderson, partner at consulting firm Grant Thornton LLP in Toronto, “but the dependence has increased. Whether or not the integration has kept pace with the dependence is probably the bigger question.” Sometimes, he says, dependence without integration carries significant risks. For instance, Anderson says he has seen more than one case where a server controlling a physical access control system was located outside the data centre, in an unsecured area. It would have been fairly easy for someone to go into the database controlling access privileges, make changes allowing access to a restricted area, enter that area, and then afterwards re-enter the access control system to remove all traces of the intrusion. Large public and regulated companies probably have learned enough to eliminate “this kind of nonsense,” he says, but there are probably still examples in smaller organizations. A world of benefits And more than just eliminating obvious security holes, co-operation between the groups can bring useful synergies. Consider the example of a card that controls access to company facilities. First, what if this same card is used to control access to computers? This makes it simpler to add new employees to the system, and – perhaps more importantly – quicker and more foolproof to remove them from the system when they leave the organization. As well, combining information from physical and IT access control systems could be useful. “There should be an automatic alarm going off if somebody tries logging in to my computer – even with my password – if my pass card has not been checked into the building,” Stewart says. In fact, says Steve Hunt, founder of Chicago security consultancy 4A International, LLC, linkages between physical and IT access controls, such as requiring that someone is in the building to get on the network, are common areas of co-operation between IT and physical security teams today. Or, suppose someone makes several attempts to log onto a company computer using incorrect passwords. Images from a nearby security camera could indicate who was at – or at least near – that computer at that time. The webcam on a computer might even serve the function of a surveillance camera, Stewart suggests, particularly if the machine has been stolen. Running surveillance video over IP took a while to catch on, because the quality was initially poor, but “now the technology has evolved to the point where video over IP is almost as good and in some cases better than analog,” says Stewart. And examples like the above show that integration could have benefits beyond cost savings. “It’s not just cheaper than having two separate systems,” says Stewart – “it’s more powerful.” The obvious downside, of course, is the reliance on a single network. “When you put all your eggs in one basket, it means guarding the basket gets pretty important,” says Stewart. “You could shut a company down if this combined system went down.” Despite that risk, video is moving to the IP network. But the headaches of integrating security and IT technology could be mild compared to the headaches of bringing together the groups responsible for them. Bringing together IT and physical security teams Although they can hardly avoid working together on some technology issues, neither IT people nor physical security specialists necessarily want to become part of the other group. “To take on a security integration project is pretty huge,” McLean says. “The factor you’ve got to deal with is people, their sensitivities – am I going to lose my job, am I going to be kind of lost in the integration?” “Traditionally the security aspects have been totally independent of IT,” Martin says, “and it’s pretty hard for the security people to be put under IT or vice versa.” Some of the friction occurs because the groups are used to operating in different ways, according to Martin. Security has always been a 24-hour-a-day, seven-day-a-week operation. IT is used to being able to take systems and networks down in the evening or on the weekend for maintenance. When IT takes down a network that carries security video, Martin says, security people aren’t amused. By the same token, surveillance video traffic can be a headache for network administrators. “Video’s like an 800-pound gorilla,” Martin says. “It’s a bully – it just comes on the network and it’s so abusive to the network.” “There are people who say okay, converging the traffic doesn’t mean combining the functions,” Melek adds. “They would argue that there are different skills associated with each. So, people who are doing logical security are people who are technologists by background, and people doing physical security would have a different background.” McLean seems to have proven at Telus that it can be done. He says the keys to success included support from the most senior levels of management, a patient effort to sell the integration project to everyone affected, and building post-integration rapport among people from both sides of the house. The initial security review, involving people from outside as well as inside security, provided a clear picture of the potential benefits, McLean says. It also helped that Telus, as a growing organization, was able to integrate the functions without cutting any jobs. Then came the tricky process of turning two separate groups into a team. McLean admits it wasn’t always easy. IT security people may see the physical security group as unsophisticated, while physical security people may see the IT group as “gung-ho and full of themselves.” The antidote at Telus was to get them working together. Over time, says McLean, “people started to have an appreciation for each other and the roles that they were doing,” As Telus’ once-distinct security groups began working as one, McLean says, they began to see how they could help each other. For instance, IT specialists could contribute to designing better card access systems. Though it worked for Telus, actually integrating the physical and IT security groups hasn’t worked for everyone, and many enterprises fear attempting it. There are ways of bringing the functions closer together without necessarily making them one. Martin says quite a number of organizations today are putting both physical security and IT security under a common executive – most often a vice-president – so that each group retains its independence but there is some common oversight. Some have tried combining them into a single group, and some of those that did have run into problems and had to separate them again, he adds. The most important thing is that specialists in the different areas of security communicate and have input into the design of new systems at the right time, Anderson says. “You might be able to do this by bringing them all together, or you might have them in different groups, as long as you have proper communication.” When it comes to integrating IT and physical security, it’s still very early in the game. “I’m not even sure we’re even in the first inning,” says Stewart. “I think the pitchers may still be warming up on the mound.”

IP-based technology can simplify security mandates and improve ROI

News | 05/07/2009 6:16 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us