A proactive approach to cyber and physical security

In a recent survey conducted by Genetec, 36% of respondents globally said they were looking to invest in cybersecurity-related tools to improve their physical security environment in the next 12 months. In an industry where cybersecurity has not always been top of mind, the results of the survey demonstrate that respondents are starting to recognize that these cyber threats are real and their physical security systems are a potential platform for cyberattacks.
 
The usage of IoT devices has benefited organizations' ability to improve security and monitor activities in large, distributed spaces. However, with the benefits of connectivity, accessibility, mobility, and data sharing come cybersecurity risks. Devices such as video surveillance cameras, access control readers, and alarm panels can provide an entry point to gain access to networks of large and small enterprises via their physical security systems. 

Securing these devices is paramount, and new strategies for managing access to these devices are critical. Companies are increasingly recognizing the importance of proactively protecting against cyber threats and the potential vulnerability of their IoT devices. 

What can organizations do to mitigate cybersecurity threats?

Being proactive is the first line of defense. Here are some considerations to take as you seek to protect against cybersecurity threats to your systems, as well as stay compliant with cybersecurity standards and laws.

1. Partner with a physical security provider who makes cybersecurity a top priority

Select a physical security provider that invests heavily in cybersecurity. There are several questions to help further identify whether or not they are taking the necessary cybersecurity precautions. For example, are they certified by a third party? Are they SOC2 compliant? Are they ISO 27001 certified? Are they using IT security best practices?

Consider selecting a physical security provider who makes cybersecurity a priority as a top-down approach in all that they do. This will include dedicated cybersecurity teams or departments and partnerships with vendors who share the same level of commitment toward cybersecurity.

Certain cybersecurity measures are hard to implement at scale, for example, updating firmware or changing passwords. A company that is committed to cybersecurity will help you develop the right cybersecurity posture to scale. They can vet their suppliers and partners of IoT devices to ensure they have the maturity and longevity to meet your cybersecurity needs both now and as your organization grows. Likewise, they will partner with suppliers that share the same vision of the importance of cybersecurity.

2. Consider solutions with built-in cybersecurity measures

Although a physical security system could be threatened, there are many ways to further mitigate the risk of malicious attacks. Deciding on a solution requires companies to determine whether the solution is designed with security in mind and has built-in cybersecurity measures. When a product is designed, built, coded, and tested with security by default, essential features such as authentication, authorization, encryption, and privacy are built into the system. These measures also ensure only those with set privileges will be able to access specified assets, data, and applications.

Authentication – the process of user authentication is the first level of identity management. This prevents your data from getting into the wrong hands. Modern, multi-factor authentication (MFA) validates the identity of the user so only approved users are able to access information. 

Authorization – authorization helps define the access rights of a person or entity. An organization's administrator can define the rights of different individuals and configure more or less restrictive access privileges depending on their roles and the level of access they are trying to achieve.

Encryption – encryption protects the confidentiality of a company's data both in transit and when stored. When data is encrypted it is rendered unusable unless accessed by authorized users. Encryption can't be effective without authentication, which ensures you are sharing your data with authorized users. When your physical security provider has built-in encryption, sensitive data is protected by default.

Privacy by design – there doesn't have to be a trade-off when it comes to maximizing privacy and security. Security solutions that offer privacy protection by design allow companies to have more control over their data to meet regulations and securely store that data. A physical security provider can help their customers define who has access rights to sensitive video footage without hampering the details required to complete their investigations. 

3. Minimize vulnerabilities by moving to a hybrid or cloud approach  

Moving your physical security to the cloud or using a hybrid approach can further mitigate your cybersecurity risks. Modern cloud systems include many layers of cybersecurity designed not only to protect against malicious actors but also human error. 

Moving to the cloud also helps share the cybersecurity responsibility with your cloud provider. The providers who take advanced cybersecurity precautions often offer the possibility to streamline maintenance and updates – which is crucial to ensuring secure systems. By using a hybrid or cloud solution, you'll always have access to the latest built-in cybersecurity features, including privacy controls, strong user authentication, and various system health monitoring tools. As soon as the latest versions and updates are available, they'll be pushed immediately to your system. This helps your physical security systems remain protected against vulnerabilities and stay actively monitored to detect and defend against cyberattacks. 

Where cyber and physical security meet

To best protect your organization from cyberattacks, physical security and cybersecurity go hand in hand. Physical security systems with built-in security and privacy-by-design features can better ensure people, spaces, and assets are protected. Likewise, a trusted provider can offer a team approach to ensure your entire ecosystem is designed, built, and managed with your organization's end-to-end security in mind.