Cyber Defense for Physical Security

The demand for IP-based, physical security solutions and specifically remote access to video surveillance is growing with each passing year; however, with each additional IP security device that is deployed and connected online, the risk for network penetration increases.

Cyber criminals are getting more sophisticated at exploiting network vulnerabilities, and physical security equipment has become just as vulnerable to intrusion as any other smart device linked to the Internet. As such, it is important for security manufacturers, dealers and integrators to understand the cyber risk and common attacks on physical security equipment.

Both vendors and their channel partners have their own unique responsibilities to fulfill when it comes to increasing cyber safety. Vendors should provide up-to-date, safe and hardened products, while educating their suppliers; and suppliers must work with the end-user’s IT department to develop and apply best practices.

There was a time when budget for cybersecurity measures was rather low on the list of important items for many end-users. With limited funds, those in charge of purchasing security systems became accustomed to spending a certain amount on equipment. The continued demand for cost-effective products moved the vendor community to train to sell lower-cost options. All of these actions led to a lack of investment in cyber defense mechanisms, which in turn affected the development of technologies that were sold for many years.

Today, the industry has turned 180 degrees, with customers asking for their security equipment to implement cybersecurity controls of the same caliber as those installed in mission-critical applications in the IT sector, regardless of the vertical. Consequently, the physical security industry is lagging; in fact, when it comes to cyber protection, security devices, attack protocols and overall defenses may be to 10-15 years outdated.

Leveraging a VMS for Cybersecurity

Misconceptions about effective defense strategies have additionally hindered cybersecurity advances in physical security equipment. Prior to the increased demand for system integration and transition of devices from analog to IP, security controls were predominantly viewed as disconnected – CCTV cameras ran on exclusive analog signals, access control mechanisms operated on an isolated network, and people generally believed that anything held inside a physical building was safe. This became known as “hard shell” security, which refers to the assumption that the outside physical wall protects everything.

Unfortunately, this technique is simply no longer relevant in an era where infected USB drives can be directly plugged into a server, cameras can be hacked via web server attacks, and users can accidently infect an entire network with malware in seconds by using an internet browser.

To adequately address both the cyber and physical security issues of today, integrators and their customers must implement a solution that incorporates a structural approach that covers all the system’s end-points.

As cyberattacks become increasingly sophisticated, having the capacity to effectively manage and protect a large population of devices on one system through a VMS is essential. As part of an enterprise security system, the VMS acts as a centralized data hub located at the solution’s core. It is capable of providing an excellent view into the entire infrastructure, with regular assessments of device behavior, operations, general system health and more. However, this ability to access every part of the network is a double-edged sword, as it also makes the VMS a primary target for attacks.

Both end-users and integrators are looking to vendors for direction on how to combat this challenge. In terms of cyber, both the physical security devices and VMS itself are being attacked; thus, an organization can only truly be defended by securing both ends.

Ref: http://www.securityinfowatch.com/article/12335318/cyber-defense-for-physical-security