Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Physical & Network Security: Better Together In 2014
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
1/7/2014 | 9:47:30 AM
Re: Power Over Ethernet - Driving these changes
Fredrik, I love your analogy comparing the relationship network security and physical security with IT and finance: Finance still cuts our checks, but IT might manage the online/payroll software. Within the past few years, IT has become more closely integrated with so many business functions in the enterprise, it's not surprising that the same should alignment should take place with physical security systems. I suspect that will only continue to grow as the IoT brings more physical elements into the IT security sphere. 
FredrikNilsson
100%
0%
FredrikNilsson,
 User Rank: Apprentice
1/6/2014 | 10:53:06 AM
Re: Power Over Ethernet - Driving these changes
Lorna: You make a couple great points in this thread that are worth diving into more. In the article I did not mean to imply that physical security will report to the CISO – but rather, that IT needs to be aware that Physical Security is inevitably going IP and the CISO, CIO and/or IT team overall should prepare to work together with the department(s) who "own" video surveillance within their organization. Regardless, more cooperation and communication between physical security and IT is integral in an increasingly IP-centric world. In some companies we work with, the IT group has fully embraced the shift to IP and have taken full ownership of the system. In other companies, the IT group manages the infrastructure, but security/loss prevention/operations 'own' the video. In that case, it's akin to how finance still cuts our checks, but IT might manage the online/payroll software. In many small- to mid-sized organizations who do not have physical security or operations departments, the IT manager is essentially responsible for anything that plugs in. In each case, IT is increasingly more involved, so best to have open, engaged collaboration vs running separate networks.

The second point you call out is also an important detail. I agree the physical security domain is a specialized one, but want to emphasize that there is potential for tremendous cooperation between the two groups, physical security and IT. Physical security best practices from the security world married with IT best practices to run the infrastructure most efficiently can help both disciplines do their job better, and more efficiently. Overall, they simply both need to interact more, so the left hand knows what the right hand is doing, and neither get handcuffed (pun intended).
infosecxx
50%
50%
infosecxx,
 User Rank: Apprentice
1/3/2014 | 6:21:01 PM
Re: Power Over Ethernet - Driving these changes
With my last employer, Facilities & IT had an established collaborative relationship which I feel evolved more over the three years I was with the company.  My former employer was a manufacturing company producing technical equipment.  Not only did they maintain the building but also all the tooling equipment on the manufacturing floor.  Relationship was required as we used their equipment (lifts & tools) for some jobs.  And we helped them with their systems and needs.  This proved essential as our site was relocated to a different city within the county (my last project with them as an employee).  We were able to inform facilities of where all the drops needed to be and requirements for the server room.  They were able to have a vendor execute to the scope.  IT was free to focus on IT equipment relocation & IT operations and not spend time on non IT infrastructure.  The added bonus as well is, they know the threshold of circuits and can assist in preventing high power loads.  Whenever the Facilities Department needed anything we jumped and they did the same for us.  I prefer to work in environments like this with all business units.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
1/3/2014 | 4:35:11 PM
Re: Power Over Ethernet - Driving these changes
Thanks, InfoSecxx, for the details on your PoE project and your advice for scaling up to an enterprise implementation. Sounds like you have a very collaborative relationship with your facilities team. Is that something that has evolved over time, or did it develop relative to the project? 
infosecxx
100%
0%
infosecxx,
 User Rank: Apprentice
1/3/2014 | 4:23:09 PM
Re: Power Over Ethernet - Driving these changes
Authorization and assistance in planning was provided by the General Manager of the complex.  All cable connections (fiber-optic, Ethernet) was installed by licensed electric technicians (who were already involved with the remodel of the facility).  End point connections & device installation was completed by myself (IT Professional) as well as the additional IT infrastructure to support them.  Server & software configurations were completed by the General Manager [knowledgeable enough and knew what he wanted (technology can be beautiful sometimes]).  Monitoring and management of the video captures were also the responsibility of the General Manager.  Granted this was a lean company, however it was over a $20,000 investment which matched the quote offered to use traditional CCTV.  Though, the added value of the features and functions are priceless to the facility.

Scaling up to enterprise, I do not believe it would be much different.  Use the skills and tools offered by the Facilities Department to complete physical installs, including cabling.  The IT Department completes software installs and configurations on new or existing equipment.  Management of video capture and review should be left to either Facilities or other responsible Business Unit (they are capable).  In addition, all data & access is maintained by IT.

 
Susan Fogarty
50%
50%
Susan Fogarty,
 User Rank: Apprentice
1/3/2014 | 12:44:29 PM
Re: Physical/virtual security
I guess it depends how you define a "typical company" -- I was thinking of a larger business that owns its buildings. And I agree you may definitely outsource the monitoring and response to a security company. But I think the actual infrastructure will converge with IT, along with everything else on the Internet of Things (for better or for worse!). IT pros, please chime in!
Lorna Garey
50%
50%
Lorna Garey,
 User Rank: Ninja
1/3/2014 | 11:16:21 AM
Re: Physical/virtual security
But can you do it cheaper, really? For a typical company that has shared space, physical security typically is baked into what you pay for rent. Picture going into a city high-rise with multiple tenants. The security guards, card scanners and other security elements are managed centrally. Now, once in your offices, IT runs those cameras and card scanners for access to restricted areas, if any. And of course, really large entities do more of their own physical security. But, this is a specialized area -- you may have an ex-cop with years of experience in how criminals operate running a security department. Can the CIO match that? It's not a gamble that CEOs tend to want to take. You're talking the physical safety of your workers.

I'm not arguing that it wouldn't be cost effective to consolidate. But it hasn't happened yet, and I think it'll take more than PoE to change the dynamic. We'll see!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
1/3/2014 | 11:03:22 AM
Re: Power Over Ethernet - Driving these changes
Thanks for sharing your experience with Power Over Ethernet, @infosecx. Curious to know if the project was managed under the jurisdiction of the IT or physical security department, or a combination of the two.
Susan Fogarty
50%
50%
Susan Fogarty,
 User Rank: Apprentice
1/3/2014 | 10:54:57 AM
Re: Physical/virtual security
I would equate the physical security system with the old company switchboard. For a long time we kept it as a separate entity just because that's what we always did. Security systmes will just become a part of corporate IT because it makes no sense to maintain a separate network or outsource it to someone else when you can run it internally over IP for a fraction of the cost.
Lorna Garey
50%
50%
Lorna Garey,
 User Rank: Ninja
1/2/2014 | 4:46:24 PM
Physical/virtual security
People have talked about integrating physical and virtual security for years. But companies have largely decided to outsource the physical side of the equation to building management, or firms with that specialized knowledge, depending on their situations. I don't see any compelling argument that this is going to change. Maybe IT will nibble at the edges, taking on video and access cards, for example. But what's the financial incentive to wholesale bring physical security under the CISO?
Page 1 / 2   >   >>


Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5524
PUBLISHED: 2020-02-21
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.
CVE-2020-5525
PUBLISHED: 2020-02-21
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.
CVE-2020-5533
PUBLISHED: 2020-02-21
Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2020-5534
PUBLISHED: 2020-02-21
Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.
CVE-2014-7914
PUBLISHED: 2020-02-21
btif/src/btif_dm.c in Android before 5.1 does not properly enforce the temporary nature of a Bluetooth pairing, which allows user-assisted remote attackers to bypass intended access restrictions via crafted Bluetooth packets after the tapping of a crafted NFC tag.