RiskUKAugust2017

Physical and IT Security
Convergence: Are We There Yet?
Although historically
distinct, physical
security and
information security
have grown closer in
recent times as a
direct result of the
integration of IPenabled
devices
within traditionally
closed and isolated
security systems.
Where are we now,
then, on the road to
genuine convergence?
Damien Pezza
investigates
Damien Pezza MSc FIHEDN
FINHESJ: Security Consultant
at CornerStone GRG
Over recent decades, the increasing
visibility and resourcefulness of cyber
threat actors and the Internet of Things
(IoT) have combined to revolutionise the
security sector. Gartner recently forecasted that
8.4 billion connected ‘things’ would be in use at
the global level in 2017, representing an
increase of nearly a third from 2016, and also
predicted that the number of devices would
reach 20.4 billion by 2020, with a rise in the
share of ‘cross-industry business devices’ such
as HVAC and physical security systems.
For their part, video surveillance, access
control, perimeter detection and alarm systems
have become increasingly dependent on
network electronics. Security systems are
therefore exposed to a variety of cyber threats,
necessitating that cyber protection is now as
relevant to the security industry as it is for lowend
and domestic ‘smart’ devices. This has
prompted the need for holistic approaches
towards security and risk management that
emphasise formal co-operation between
previously separate security functions. In
industry parlance, this is ‘Convergence’.
The interdependence of IT, physical and
operational technology systems can bring
concrete advantages to public and private
sector organisations that wish to secure their
assets. The same applies for convergence.
Theoretically, the latter enables fast and
informed responses to all types of threats,
while bridging gaps between IT and Security
Departments by merging them into a
centralised risk management unit or otherwise
creating overarching supervisory structures –
thus improving organisational efficiency and
eliminating both the vulnerabilities and
inefficiencies of managing security and risks
across silos.
In such a converged risk management
framework, cyber security plays an essential
role in securing an organisation’s infrastructure
and operations. In tandem, physical security
measures ensure the integrity of its network
and information assets.
Problematic endeavour
However, convergence is far easier and safer to
achieve in theory than is the case in practice.
Integrating an increasing number of devices
into corporate networks presents a significant
security risk to organisations. It has enabled
external or ‘insider’ threats not only to impair
security systems, supervisory control and data
acquisition platforms or critical infrastructure
through the Internet, but also to infiltrate or
attack an organisation’s network by targeting
IP-enabled equipment (such as cameras) or
devices owned by employees themselves.
Calls for greater convergence have naturally
met with internal and organisational obstacles,
as the setting out of such a massive project
entails considerable resources and involves
numerous departments. A study on Cyber
Security and the Internet of Things published
by EY in 2015 indicated that only 6% of all
surveyed organisations claimed to have a
robust incident response programme in place
that includes third parties and that’s integrated
with broader threat and vulnerability
management functions.
Even if successful in appearance,
convergence at the structural level doesn’t
necessarily solve underlying gaps and tensions
within an organisation. A survey conducted by
The Ponemon Institute in 2015 highlighted
significant rifts in cyber security knowledge
between decision-makers and IT security
professionals. It revealed that cyber security
has only begun to have an impact on the
agenda of decision-makers in recent years, and
that most IT professionals think their Board of
Directors isn’t properly informed about every
threat the organisation is facing.
Hybrid environment
Threat actors operate in a hybrid environment
where the boundaries between virtual and
physical threats are blurred. It’s now more
important than ever for public and private
sector organisations to implement holistic
security strategies that address additional
challenges stemming from convergence itself.
As long as the physical and cyber domains are
treated as segregated, there’s very little hope of
securing either of them.
Convergence isn’t only about form, but also
about function. Organisations should
encourage internal co-operation, co-ordination
and training, not only by ‘changing the
organisation chart’ and creating overarching
risk management structures, but also by
bridging gaps between security practitioners, IT
22
www.risk-uk.com