Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Physical & Network Security: Better Together In 2014
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/7/2014 | 9:47:30 AM
Re: Power Over Ethernet - Driving these changes
Fredrik, I love your analogy comparing the relationship network security and physical security with IT and finance: Finance still cuts our checks, but IT might manage the online/payroll software. Within the past few years, IT has become more closely integrated with so many business functions in the enterprise, it's not surprising that the same should alignment should take place with physical security systems. I suspect that will only continue to grow as the IoT brings more physical elements into the IT security sphere. 
FredrikNilsson
100%
0%
FredrikNilsson,
User Rank: Apprentice
1/6/2014 | 10:53:06 AM
Re: Power Over Ethernet - Driving these changes
Lorna: You make a couple great points in this thread that are worth diving into more. In the article I did not mean to imply that physical security will report to the CISO – but rather, that IT needs to be aware that Physical Security is inevitably going IP and the CISO, CIO and/or IT team overall should prepare to work together with the department(s) who "own" video surveillance within their organization. Regardless, more cooperation and communication between physical security and IT is integral in an increasingly IP-centric world. In some companies we work with, the IT group has fully embraced the shift to IP and have taken full ownership of the system. In other companies, the IT group manages the infrastructure, but security/loss prevention/operations 'own' the video. In that case, it's akin to how finance still cuts our checks, but IT might manage the online/payroll software. In many small- to mid-sized organizations who do not have physical security or operations departments, the IT manager is essentially responsible for anything that plugs in. In each case, IT is increasingly more involved, so best to have open, engaged collaboration vs running separate networks.

The second point you call out is also an important detail. I agree the physical security domain is a specialized one, but want to emphasize that there is potential for tremendous cooperation between the two groups, physical security and IT. Physical security best practices from the security world married with IT best practices to run the infrastructure most efficiently can help both disciplines do their job better, and more efficiently. Overall, they simply both need to interact more, so the left hand knows what the right hand is doing, and neither get handcuffed (pun intended).
infosecxx
50%
50%
infosecxx,
User Rank: Apprentice
1/3/2014 | 6:21:01 PM
Re: Power Over Ethernet - Driving these changes
With my last employer, Facilities & IT had an established collaborative relationship which I feel evolved more over the three years I was with the company.  My former employer was a manufacturing company producing technical equipment.  Not only did they maintain the building but also all the tooling equipment on the manufacturing floor.  Relationship was required as we used their equipment (lifts & tools) for some jobs.  And we helped them with their systems and needs.  This proved essential as our site was relocated to a different city within the county (my last project with them as an employee).  We were able to inform facilities of where all the drops needed to be and requirements for the server room.  They were able to have a vendor execute to the scope.  IT was free to focus on IT equipment relocation & IT operations and not spend time on non IT infrastructure.  The added bonus as well is, they know the threshold of circuits and can assist in preventing high power loads.  Whenever the Facilities Department needed anything we jumped and they did the same for us.  I prefer to work in environments like this with all business units.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/3/2014 | 4:35:11 PM
Re: Power Over Ethernet - Driving these changes
Thanks, InfoSecxx, for the details on your PoE project and your advice for scaling up to an enterprise implementation. Sounds like you have a very collaborative relationship with your facilities team. Is that something that has evolved over time, or did it develop relative to the project? 
infosecxx
100%
0%
infosecxx,
User Rank: Apprentice
1/3/2014 | 4:23:09 PM
Re: Power Over Ethernet - Driving these changes
Authorization and assistance in planning was provided by the General Manager of the complex.  All cable connections (fiber-optic, Ethernet) was installed by licensed electric technicians (who were already involved with the remodel of the facility).  End point connections & device installation was completed by myself (IT Professional) as well as the additional IT infrastructure to support them.  Server & software configurations were completed by the General Manager [knowledgeable enough and knew what he wanted (technology can be beautiful sometimes]).  Monitoring and management of the video captures were also the responsibility of the General Manager.  Granted this was a lean company, however it was over a $20,000 investment which matched the quote offered to use traditional CCTV.  Though, the added value of the features and functions are priceless to the facility.

Scaling up to enterprise, I do not believe it would be much different.  Use the skills and tools offered by the Facilities Department to complete physical installs, including cabling.  The IT Department completes software installs and configurations on new or existing equipment.  Management of video capture and review should be left to either Facilities or other responsible Business Unit (they are capable).  In addition, all data & access is maintained by IT.

 
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
1/3/2014 | 12:44:29 PM
Re: Physical/virtual security
I guess it depends how you define a "typical company" -- I was thinking of a larger business that owns its buildings. And I agree you may definitely outsource the monitoring and response to a security company. But I think the actual infrastructure will converge with IT, along with everything else on the Internet of Things (for better or for worse!). IT pros, please chime in!
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
1/3/2014 | 11:16:21 AM
Re: Physical/virtual security
But can you do it cheaper, really? For a typical company that has shared space, physical security typically is baked into what you pay for rent. Picture going into a city high-rise with multiple tenants. The security guards, card scanners and other security elements are managed centrally. Now, once in your offices, IT runs those cameras and card scanners for access to restricted areas, if any. And of course, really large entities do more of their own physical security. But, this is a specialized area -- you may have an ex-cop with years of experience in how criminals operate running a security department. Can the CIO match that? It's not a gamble that CEOs tend to want to take. You're talking the physical safety of your workers.

I'm not arguing that it wouldn't be cost effective to consolidate. But it hasn't happened yet, and I think it'll take more than PoE to change the dynamic. We'll see!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/3/2014 | 11:03:22 AM
Re: Power Over Ethernet - Driving these changes
Thanks for sharing your experience with Power Over Ethernet, @infosecx. Curious to know if the project was managed under the jurisdiction of the IT or physical security department, or a combination of the two.
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
1/3/2014 | 10:54:57 AM
Re: Physical/virtual security
I would equate the physical security system with the old company switchboard. For a long time we kept it as a separate entity just because that's what we always did. Security systmes will just become a part of corporate IT because it makes no sense to maintain a separate network or outsource it to someone else when you can run it internally over IP for a fraction of the cost.
Lorna Garey
50%
50%
Lorna Garey,
User Rank: Ninja
1/2/2014 | 4:46:24 PM
Physical/virtual security
People have talked about integrating physical and virtual security for years. But companies have largely decided to outsource the physical side of the equation to building management, or firms with that specialized knowledge, depending on their situations. I don't see any compelling argument that this is going to change. Maybe IT will nibble at the edges, taking on video and access cards, for example. But what's the financial incentive to wholesale bring physical security under the CISO?
Page 1 / 2   >   >>


Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8813
PUBLISHED: 2020-02-22
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
CVE-2020-9039
PUBLISHED: 2020-02-22
Couchbase Server 4.x and 5.x before 6.0.0 has Insecure Permissions for the projector and indexer REST endpoints (they allow unauthenticated access).
CVE-2020-8860
PUBLISHED: 2020-02-22
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Firmware G973FXXS3ASJA, O(8.x), P(9.0), Q(10.0) devices with Exynos chipsets. User interaction is required to exploit this vulnerability in that the target must answer a phone call. T...
CVE-2020-8861
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue ...
CVE-2020-8862
PUBLISHED: 2020-02-22
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the ...