Stronger security convergence is the need of the hour
Dimitris Raekos, General Manager at ESET Middle East explains as the technology evolves, the barrier between cyber security and physical security are coming down drastically and are creating a new form of challenges and risks.
The physical and cyber security spaces have been closely entwined for over a decade now, as the Internet of Things (IoT) keeps growing and the networking of physical security devices for everyday business functions force enterprises and security service providers to recognize the fact that physical security and cybersecurity must be treated in a unified manner. However, this security convergence poses a growing concern, as companies increasingly begin to recognize the benefits as well as the drawbacks, of this exercise.
While in the earlier days, this convergence was considered challenging and expensive as both realms had very little in common, today, this has changed and modern-day enterprises have managed to integrate both realms and create a holistic security approach. However, aspects like access control and building automation still remain vulnerable, with hackers exploiting vulnerable company networks to steal information.
Consider a modern building for instance, where vital aspects like fire detection & alarm systems, automated fire suppression systems, heating and ventilation, access control systems, power management, lighting systems and other crucial control systems are all network enabled and network accessible. A single security mishap could compromise the entire physical security of the building and expose visitors, residents and even the environment, to grave danger. Hackers literally hold the building for ransom, creating a scenario known as ‘Siegeware’. The challenge here lies in the fact that when one loophole is addressed, hackers quickly gain access to another, in an attempt to completely destabilize their targets, gain financial benefits and explore poorly protected systems, with remote access to their software.
The need of the hour is to understand that although the practical and financial benefits of remotely enabling physical security and control systems are many, businesses today are more vulnerable than they imagine and there exists several vulnerabilities that hackers can quickly take advantage of. For instance, a fast search performed on an online IoT database such as ‘Shodan’ shows thousands of connected physical security and automation systems with default passwords or even no passwords at all.
Another challenge is the lack of awareness of risk among the different stakeholders involved in physical security, such as building owners, property managers and contractors. Then again, in the highly unlikely event of an attack, the building tenants might be able to sue the provider, alarmingly widening the reach of IoT technology from business entities, to home automation and even leisure.
As the lines between physical and cyber security aspects continue to blur, enterprises should remember to forge a greater cooperation between their IT, physical and cybersecurity areas, to keep up with the rapidly changing technology. Then again, physical security suppliers and consumers should be informed about the potential threats and consequences of this convergence and urged to adopt a more comprehensive approach. It also becomes imperative to properly maintain regulate and upgrade security systems and keep tabs on the network, keeping in mind that when implemented properly, this integrated approach could mitigate risks and ensure the smooth and uninterrupted flow of operations.
To conclude, it is our studied belief that physical security systems need to be protected by a firewall and access need to be allowed via VPN and multi-factor authentication rather than a simple password, to prevent attackers from accessing the systems. Also, a crisis response plan should be in place in case the systems are compromised, so that backup measures can be applied, disruptions can be minimized and ransoms that usually refuel the cybercriminals’ businesses can be avoided.
