When physical and logical security converge

By Billy Hurley, Assistant Editor 05 Feb 2007 | SearchSecurity.com

Digg This!     StumbleUpon     Del.icio.us

In today's enterprise security market, mainstay physical security products like door access-control systems and closed-circuit cameras often rely on TCP/IP. "These systems aren't dedicated pieces of hardware running proprietary OSes anymore," said Forrester Research analyst Jonathan Penn. "They are built atop Windows or Linux."

RSA Conference 2007 Can't make it to the show? SearchSecurity.com staff members are on the RSA floor, on hand to deliver the latest RSA Conference 2007 news and updates.

When physical systems are connected to corporate IP networks, there is an obvious need to incorporate the IT shop into the management of those physical security assets. "You can't go on keeping IT in the dark on these deployments. If you do, you risk that your security systems are vulnerable to attack," Penn said.

This more holistic view of security requires cooperation between two security teams that have often been not just separate but sometimes at odds.

"Each can have a stereotype of the other, and that adds to the challenge of getting the two groups to collaborate," Penn said. Today's breed of logical security folk are frequently grad-school trained, specializing in fields like systems management. Physical security officers many times have law enforcement backgrounds and work with more isolated systems.

"There is a need, but the technology vendors have not been fast enough in meeting that need." Steve Hunt, president of 4ai International

And it is the physical security group--perhaps uninterested or unskilled in managing IP networks--that is often looking for better ways to integrate with IT. "Convergence as a concept is not being driven by IT or IT security. The movement is being driven almost entirely by physical security champions," said Steve Hunt, president of research company 4A International. "They're the ones with the greatest pains and potential upsets."

It's not always about getting the two sides on the same page, either. Much of the security systems in Las Vegas, for example, have not been switched over to IP, said Brian Contos, CSO at ArcSight. "[Security officers] have to consider the risks of moving their entire operations onto IP. It is not as cut and dry as videotapes and hard wires," he added.

The availability of high-quality products to address this convergence is also a major hurdle.

"There is a need, but the technology vendors have not been fast enough in meeting that need," said Hunt, adding, "Even if there's an excellent technology, it still has to be approved by a systems integrator, and then go through the sales cycle."

An initiative that demonstrates how physical and logical security are converging is HSPD-12, a Homeland Security Presidential Directive requiring a single identity management card for federal government employees. "Some agencies are further ahead than others," said Tom Greco, vice president of enabling infrastructures for Cybertrust, a management services provider that produces HSPD-compliant identity cards.

The directive frees government employees from carrying multiple identity credentials. "HSPD-12, as a concept, is a great idea," said Hunt, "The trouble is there's no one helping to answer fundamental questions: What technology should I acquire? How do I deploy it? Who's going to pay for it? [But,] it's the first standard that's got some legs under it."

"As the deployment of these cards picks up, we'll start to see the enablement of applications," said Greco, suggesting a potential for growth. "Network logical access of this card will be leveraged by the physical."

Looking forward, experts say that addressing evolving threats to enterprise systems without an integrated security program seems inadequate, if not impossible. Physical and logical security teams have little choice but to work together, and there will be setbacks before integrated offerings become commonplace.

<< Return to our special coverage of RSA Conference 2007

Tags: Information Security Jobs and Training,  Identity Theft and Data Security Breaches,  Information Security Incident Response,  VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Information Security Jobs and Training Despite recession, information security certification pay continues to climb Bruce Schneier on outsourcing, awareness training Creating a personal brand in information security Feds push cybersecurity jobs, PCI DSS changes ahead. Feds announce 1,000 new security jobs Some IT security certifications are overvalued, analyst says How to prepare for an information security job interview Security industry remains resilient to tough economy Top social networking sites to boost your information security career Q2 2009 data shows IT security certification pay still climbing Identity Theft and Data Security Breaches Chip and PIN adoption serves lesson for U.S. payment industry Group to shed light on secure identity management threats Heartland CIO is critical of First Data's credit card tokenization plan Heartland CIO on end-to-end encryption, credit card tokenization Heartland CIO on PCI, E3 project Visa probes tokens, encryption for PCI card data protection University data breach exposes 163,000 women to identity theft TJX thrives following breach, bucks sour economy Security expert's PCI analysis misguided, says PCI Council GM External attacks start with unintentional mistakes, survey finds Information Security Incident Response Data breach notification legislation: What info must be released? Incident response planning Mature SIMs do more than log aggregation and correlation New partnerships, creative thinking help security bust recession Senators hear call for federal cybersecurity restructuring Tying log management and identity management shortens incident response Tabletop exercises sharpen security and business continuity Security incident response 101 Firms muddle security breach response, expert says Microsoft Conficker worm offers attack prevention lesson Information Security Incident Response Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Cisco Certified Security Professional (CCSP)  (SearchSecurity.com) CSO  (SearchSecurity.com) security clearance  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary