Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Physical & Network Security: Better Together In 2014
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/7/2014 | 9:47:30 AM
Re: Power Over Ethernet - Driving these changes
Fredrik, I love your analogy comparing the relationship network security and physical security with IT and finance: Finance still cuts our checks, but IT might manage the online/payroll software. Within the past few years, IT has become more closely integrated with so many business functions in the enterprise, it's not surprising that the same should alignment should take place with physical security systems. I suspect that will only continue to grow as the IoT brings more physical elements into the IT security sphere. 
FredrikNilsson
100%
0%
FredrikNilsson,
User Rank: Apprentice
1/6/2014 | 10:53:06 AM
Re: Power Over Ethernet - Driving these changes
Lorna: You make a couple great points in this thread that are worth diving into more. In the article I did not mean to imply that physical security will report to the CISO – but rather, that IT needs to be aware that Physical Security is inevitably going IP and the CISO, CIO and/or IT team overall should prepare to work together with the department(s) who "own" video surveillance within their organization. Regardless, more cooperation and communication between physical security and IT is integral in an increasingly IP-centric world. In some companies we work with, the IT group has fully embraced the shift to IP and have taken full ownership of the system. In other companies, the IT group manages the infrastructure, but security/loss prevention/operations 'own' the video. In that case, it's akin to how finance still cuts our checks, but IT might manage the online/payroll software. In many small- to mid-sized organizations who do not have physical security or operations departments, the IT manager is essentially responsible for anything that plugs in. In each case, IT is increasingly more involved, so best to have open, engaged collaboration vs running separate networks.

The second point you call out is also an important detail. I agree the physical security domain is a specialized one, but want to emphasize that there is potential for tremendous cooperation between the two groups, physical security and IT. Physical security best practices from the security world married with IT best practices to run the infrastructure most efficiently can help both disciplines do their job better, and more efficiently. Overall, they simply both need to interact more, so the left hand knows what the right hand is doing, and neither get handcuffed (pun intended).
infosecxx
50%
50%
infosecxx,
User Rank: Apprentice
1/3/2014 | 6:21:01 PM
Re: Power Over Ethernet - Driving these changes
With my last employer, Facilities & IT had an established collaborative relationship which I feel evolved more over the three years I was with the company.  My former employer was a manufacturing company producing technical equipment.  Not only did they maintain the building but also all the tooling equipment on the manufacturing floor.  Relationship was required as we used their equipment (lifts & tools) for some jobs.  And we helped them with their systems and needs.  This proved essential as our site was relocated to a different city within the county (my last project with them as an employee).  We were able to inform facilities of where all the drops needed to be and requirements for the server room.  They were able to have a vendor execute to the scope.  IT was free to focus on IT equipment relocation & IT operations and not spend time on non IT infrastructure.  The added bonus as well is, they know the threshold of circuits and can assist in preventing high power loads.  Whenever the Facilities Department needed anything we jumped and they did the same for us.  I prefer to work in environments like this with all business units.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/3/2014 | 4:35:11 PM
Re: Power Over Ethernet - Driving these changes
Thanks, InfoSecxx, for the details on your PoE project and your advice for scaling up to an enterprise implementation. Sounds like you have a very collaborative relationship with your facilities team. Is that something that has evolved over time, or did it develop relative to the project? 
infosecxx
100%
0%
infosecxx,
User Rank: Apprentice
1/3/2014 | 4:23:09 PM
Re: Power Over Ethernet - Driving these changes
Authorization and assistance in planning was provided by the General Manager of the complex.  All cable connections (fiber-optic, Ethernet) was installed by licensed electric technicians (who were already involved with the remodel of the facility).  End point connections & device installation was completed by myself (IT Professional) as well as the additional IT infrastructure to support them.  Server & software configurations were completed by the General Manager [knowledgeable enough and knew what he wanted (technology can be beautiful sometimes]).  Monitoring and management of the video captures were also the responsibility of the General Manager.  Granted this was a lean company, however it was over a $20,000 investment which matched the quote offered to use traditional CCTV.  Though, the added value of the features and functions are priceless to the facility.

Scaling up to enterprise, I do not believe it would be much different.  Use the skills and tools offered by the Facilities Department to complete physical installs, including cabling.  The IT Department completes software installs and configurations on new or existing equipment.  Management of video capture and review should be left to either Facilities or other responsible Business Unit (they are capable).  In addition, all data & access is maintained by IT.

 
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
1/3/2014 | 12:44:29 PM
Re: Physical/virtual security
I guess it depends how you define a "typical company" -- I was thinking of a larger business that owns its buildings. And I agree you may definitely outsource the monitoring and response to a security company. But I think the actual infrastructure will converge with IT, along with everything else on the Internet of Things (for better or for worse!). IT pros, please chime in!
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
1/3/2014 | 11:16:21 AM
Re: Physical/virtual security
But can you do it cheaper, really? For a typical company that has shared space, physical security typically is baked into what you pay for rent. Picture going into a city high-rise with multiple tenants. The security guards, card scanners and other security elements are managed centrally. Now, once in your offices, IT runs those cameras and card scanners for access to restricted areas, if any. And of course, really large entities do more of their own physical security. But, this is a specialized area -- you may have an ex-cop with years of experience in how criminals operate running a security department. Can the CIO match that? It's not a gamble that CEOs tend to want to take. You're talking the physical safety of your workers.

I'm not arguing that it wouldn't be cost effective to consolidate. But it hasn't happened yet, and I think it'll take more than PoE to change the dynamic. We'll see!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/3/2014 | 11:03:22 AM
Re: Power Over Ethernet - Driving these changes
Thanks for sharing your experience with Power Over Ethernet, @infosecx. Curious to know if the project was managed under the jurisdiction of the IT or physical security department, or a combination of the two.
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
1/3/2014 | 10:54:57 AM
Re: Physical/virtual security
I would equate the physical security system with the old company switchboard. For a long time we kept it as a separate entity just because that's what we always did. Security systmes will just become a part of corporate IT because it makes no sense to maintain a separate network or outsource it to someone else when you can run it internally over IP for a fraction of the cost.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
1/2/2014 | 4:46:24 PM
Physical/virtual security
People have talked about integrating physical and virtual security for years. But companies have largely decided to outsource the physical side of the equation to building management, or firms with that specialized knowledge, depending on their situations. I don't see any compelling argument that this is going to change. Maybe IT will nibble at the edges, taking on video and access cards, for example. But what's the financial incentive to wholesale bring physical security under the CISO?
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises Are Assessing Cybersecurity Risk in Today's Environment
The adoption of cloud services spurred by the COVID-19 pandemic has resulted in pressure on cyber-risk professionals to focus on vulnerabilities and new exposures that stem from pandemic-driven changes. Many cybersecurity pros expect fundamental, long-term changes to their organization's computing and data security due to the shift to more remote work and accelerated cloud adoption. Download this report from Dark Reading to learn more about their challenges and concerns.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-0351
PUBLISHED: 2022-01-25
Access of Memory Location Before Start of Buffer in Conda vim prior to 8.2.
CVE-2021-39031
PUBLISHED: 2022-01-25
IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability and could result in in granting permission to unauthorized resources. IBM ...
CVE-2021-46087
PUBLISHED: 2022-01-25
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.
CVE-2021-34865
PUBLISHED: 2022-01-25
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issu...
CVE-2021-34866
PUBLISHED: 2022-01-25
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of e...