Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Physical & Network Security: Better Together In 2014
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
1/7/2014 | 9:47:30 AM
Re: Power Over Ethernet - Driving these changes
Fredrik, I love your analogy comparing the relationship network security and physical security with IT and finance: Finance still cuts our checks, but IT might manage the online/payroll software. Within the past few years, IT has become more closely integrated with so many business functions in the enterprise, it's not surprising that the same should alignment should take place with physical security systems. I suspect that will only continue to grow as the IoT brings more physical elements into the IT security sphere. 
FredrikNilsson
100%
0%
FredrikNilsson,
 User Rank: Apprentice
1/6/2014 | 10:53:06 AM
Re: Power Over Ethernet - Driving these changes
Lorna: You make a couple great points in this thread that are worth diving into more. In the article I did not mean to imply that physical security will report to the CISO – but rather, that IT needs to be aware that Physical Security is inevitably going IP and the CISO, CIO and/or IT team overall should prepare to work together with the department(s) who "own" video surveillance within their organization. Regardless, more cooperation and communication between physical security and IT is integral in an increasingly IP-centric world. In some companies we work with, the IT group has fully embraced the shift to IP and have taken full ownership of the system. In other companies, the IT group manages the infrastructure, but security/loss prevention/operations 'own' the video. In that case, it's akin to how finance still cuts our checks, but IT might manage the online/payroll software. In many small- to mid-sized organizations who do not have physical security or operations departments, the IT manager is essentially responsible for anything that plugs in. In each case, IT is increasingly more involved, so best to have open, engaged collaboration vs running separate networks.

The second point you call out is also an important detail. I agree the physical security domain is a specialized one, but want to emphasize that there is potential for tremendous cooperation between the two groups, physical security and IT. Physical security best practices from the security world married with IT best practices to run the infrastructure most efficiently can help both disciplines do their job better, and more efficiently. Overall, they simply both need to interact more, so the left hand knows what the right hand is doing, and neither get handcuffed (pun intended).
infosecxx
50%
50%
infosecxx,
 User Rank: Apprentice
1/3/2014 | 6:21:01 PM
Re: Power Over Ethernet - Driving these changes
With my last employer, Facilities & IT had an established collaborative relationship which I feel evolved more over the three years I was with the company.  My former employer was a manufacturing company producing technical equipment.  Not only did they maintain the building but also all the tooling equipment on the manufacturing floor.  Relationship was required as we used their equipment (lifts & tools) for some jobs.  And we helped them with their systems and needs.  This proved essential as our site was relocated to a different city within the county (my last project with them as an employee).  We were able to inform facilities of where all the drops needed to be and requirements for the server room.  They were able to have a vendor execute to the scope.  IT was free to focus on IT equipment relocation & IT operations and not spend time on non IT infrastructure.  The added bonus as well is, they know the threshold of circuits and can assist in preventing high power loads.  Whenever the Facilities Department needed anything we jumped and they did the same for us.  I prefer to work in environments like this with all business units.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
1/3/2014 | 4:35:11 PM
Re: Power Over Ethernet - Driving these changes
Thanks, InfoSecxx, for the details on your PoE project and your advice for scaling up to an enterprise implementation. Sounds like you have a very collaborative relationship with your facilities team. Is that something that has evolved over time, or did it develop relative to the project? 
infosecxx
100%
0%
infosecxx,
 User Rank: Apprentice
1/3/2014 | 4:23:09 PM
Re: Power Over Ethernet - Driving these changes
Authorization and assistance in planning was provided by the General Manager of the complex.  All cable connections (fiber-optic, Ethernet) was installed by licensed electric technicians (who were already involved with the remodel of the facility).  End point connections & device installation was completed by myself (IT Professional) as well as the additional IT infrastructure to support them.  Server & software configurations were completed by the General Manager [knowledgeable enough and knew what he wanted (technology can be beautiful sometimes]).  Monitoring and management of the video captures were also the responsibility of the General Manager.  Granted this was a lean company, however it was over a $20,000 investment which matched the quote offered to use traditional CCTV.  Though, the added value of the features and functions are priceless to the facility.

Scaling up to enterprise, I do not believe it would be much different.  Use the skills and tools offered by the Facilities Department to complete physical installs, including cabling.  The IT Department completes software installs and configurations on new or existing equipment.  Management of video capture and review should be left to either Facilities or other responsible Business Unit (they are capable).  In addition, all data & access is maintained by IT.

 
Susan Fogarty
50%
50%
Susan Fogarty,
 User Rank: Apprentice
1/3/2014 | 12:44:29 PM
Re: Physical/virtual security
I guess it depends how you define a "typical company" -- I was thinking of a larger business that owns its buildings. And I agree you may definitely outsource the monitoring and response to a security company. But I think the actual infrastructure will converge with IT, along with everything else on the Internet of Things (for better or for worse!). IT pros, please chime in!
Lorna Garey
50%
50%
Lorna Garey,
 User Rank: Ninja
1/3/2014 | 11:16:21 AM
Re: Physical/virtual security
But can you do it cheaper, really? For a typical company that has shared space, physical security typically is baked into what you pay for rent. Picture going into a city high-rise with multiple tenants. The security guards, card scanners and other security elements are managed centrally. Now, once in your offices, IT runs those cameras and card scanners for access to restricted areas, if any. And of course, really large entities do more of their own physical security. But, this is a specialized area -- you may have an ex-cop with years of experience in how criminals operate running a security department. Can the CIO match that? It's not a gamble that CEOs tend to want to take. You're talking the physical safety of your workers.

I'm not arguing that it wouldn't be cost effective to consolidate. But it hasn't happened yet, and I think it'll take more than PoE to change the dynamic. We'll see!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
1/3/2014 | 11:03:22 AM
Re: Power Over Ethernet - Driving these changes
Thanks for sharing your experience with Power Over Ethernet, @infosecx. Curious to know if the project was managed under the jurisdiction of the IT or physical security department, or a combination of the two.
Susan Fogarty
50%
50%
Susan Fogarty,
 User Rank: Apprentice
1/3/2014 | 10:54:57 AM
Re: Physical/virtual security
I would equate the physical security system with the old company switchboard. For a long time we kept it as a separate entity just because that's what we always did. Security systmes will just become a part of corporate IT because it makes no sense to maintain a separate network or outsource it to someone else when you can run it internally over IP for a fraction of the cost.
Lorna Garey
50%
50%
Lorna Garey,
 User Rank: Ninja
1/2/2014 | 4:46:24 PM
Physical/virtual security
People have talked about integrating physical and virtual security for years. But companies have largely decided to outsource the physical side of the equation to building management, or firms with that specialized knowledge, depending on their situations. I don't see any compelling argument that this is going to change. Maybe IT will nibble at the edges, taking on video and access cards, for example. But what's the financial incentive to wholesale bring physical security under the CISO?
Page 1 / 2   >   >>


Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We are really excited about our new two tone authentication system!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4126
PUBLISHED: 2020-12-01
HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and iNotes versions 10.0.1 FP6 and 11.0.1 FP2 and later.
CVE-2020-4129
PUBLISHED: 2020-12-01
HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker could use this vulnerability to mount a brute force attack against the LDAP service. Fixes are available in HCL Domino versions 9.0.1 FP10 IF6, 10.0.1 FP6 and 11.0.1 FP1 and later.
CVE-2020-9115
PUBLISHED: 2020-12-01
ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of ...
CVE-2020-9116
PUBLISHED: 2020-12-01
Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification, this could be exploited to cause the attackers to obtain higher privilege.
CVE-2020-14193
PUBLISHED: 2020-11-30
Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside the WEB-INF/classes & <jira-installation>/jira/bin directories via a template injection vulnerability in Jira smart values using mustache partials. The ...