NC Nov-Dec 2023

SECURITY UPDATE
approach is required that considers all
possible threat vectors. It is expected that
those businesses that need to comply with NIS
2 will have to carry out a greater level of due
diligence on their technology partners. As part
of this evaluation process and a vendor risk
assessment, it is highly likely that policies and
processes will play a much greater role.
Securing a network, its devices, and the
services it supports requires active
participation by the entire vendor supply
chain, as well as the end-user organisation.
For the physical security industry, working
closely with customers and other stakeholders
will help to ensure a joined-up approach that
everyone can agree on. Dedicated tools,
documentation and training will help mitigate
risks and keep products and services up-todate
and protected.
Equally, end-users will now be seeking to
work with those suppliers and / or vendors
who follow appropriate policies and
processes, as well as holding third-party
certifications. It's therefore imperative that
physical security businesses can
demonstrate, for example, that they adhere
to a Vulnerability Management Policy, hold
certification for ISO/IEC 27001 for
Information Security Management Systems
(ISMS), and Cyber Essentials Plus
accreditation.
DEVICE AND SYSTEM CONTROLS
AND HARDENING
Product integrity controls and features help to
ensure that both hardware and firmware are
protected from unauthorised change or
manipulation. Signing a firmware image with
a private key prevents firmware from being
installed or upgraded without presentation of
the appropriate credentials. Additionally,
secure boot, based on the use of signed
firmware, consists of an unbroken chain of
cryptographically validated software, starting
in immutable memory, that ensures a device
can boot only with authorised firmware. A
move to the use of signed video ensures that
video evidence can be verified as
untampered, making it possible to trace the
video back to the camera from which it
originated and verify that the video has not
been modified or edited.
The use of system hardening processes aims
to protect and secure devices and systems
against cyberattacks by reducing the attack
surface - essentially protecting all possible
points of entry that could be used by an
attacker. Creating strong passwords,
removing or disabling all superfluous drivers,
services, and software, and setting system
updates to install automatically are all
recommended approaches. The likelihood of
unauthorised or unauthenticated user access
is further reduced by applying a Zero Trust
policy, in line with the National Institute of
Standards and Technology's (NIST) risk
management framework which promotes a
never trust and always verify approach to any
request for systems access.
While it is very unlikely that physical security
systems will be classed as a critical asset as
far as the scope of the NIS 2 Directive is
concerned, it is important that organisations
consider a holistic approach during the
scoping of such technology. Physical
security businesses, working closely in
partnership with supply chains and
customers, can deliver a system that is
secure from both a physical and
cybersecurity perspective, while
helping to meet NIS 2 requirements.
Stringent security measures, backed
by policies and processes, tools,
documentation and training, will
help reduce risk and keep customers
protected.
The NIS 2 Directive - Axis briefing
paper to support cybersecurity
compliance: https://www.emeacomms.axis.com/nis-2-directivebriefing
ABOUT STEVEN KENNY
Steven Kenny has spent 18 years in the
security sector in roles that have seen him
take responsibility for key elements of
mission critical, high-profile projects across
a number of different vertical markets. His
current role sees him lead a team of
Architect and Engineering managers across
the EMEA region whilst supporting various
industry associations and standards
organisations. He currently sits on the EMEA
Advisor Council as the emerging technology
lead for TiNYg (Global Terrorism
Information Network), and on various
standards committees to support IoT
security, as well as the BSI Private Security
Management and Services. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards NOVEMBER/DECEMBER 2023 NETWORKcomputing 17