Page 121 - Security Today, April 2018

failing, due to one of the aforementioned issues, is potentially fatal to both life safety and business continuity. Incidents can occur with no useable video or proper alerting to notify security until after the event has transpired. Physical and logical security response teams are robbed of their opportunity to intervene on behalf of the corporate charter to ensure safety and operations.
One evening in September 2017, a man was assaulted in downtown Petaluma, Calif., in a pedestrian walkway and later died of his wounds. There were surveillance cameras where the attack occurred, however, the cameras were not working.1 Many campuses have had security incidents transpire in areas technically covered by video cameras that were assumed to be recording. Through construction damage, uncoor- dinated network changes, unmaintained equipment or blatantly mali- cious alteration, video footage can be missing when called on—causing not only unnecessary delays in investigations, but embarrassment for security departments spending considerable amounts on equipment budgets.
On a purely logical surface, private data is at risk through unman- aged peripherals on any network. Current internet hacking threats to IoT devices often begin by simply trying the default name and pass- word on devices such as cameras and recorders.2 Other exploits are based on operating systems and known exploits are posted clearly on the internet for malicious actors to leverage.3 Numerous physical secu- rity devices have been deployed on campus networks over previous decades; many of which never made it onto the IT watch lists and maintenance plans.
Customers today are aggressively scanning their networks for rogue devices to ensure legitimate items are properly updated and main- tained while unneeded devices are removed. These processes are time intensive, especially when thousands of devices require constant mon- itoring and prompt security fix updates. Automated update and moni- toring dashboard tools are essential. These tools with fully developed filters for specific security products are uniquely powerful.
STRATEGIC PLANNING
Short-term planning for campuses should entail identifying what is on the network. Security partners should be on hand to ferret out all devices and provide an inventory report with IP addresses to IT and security leadership. Once items have been identified, they should be categorized for action plans: old systems should be updated or hard- ened to meet standards and newer technologies should be registered in Active Directory, LDAP, SIEMs and other primary IT governance plat- forms. The ongoing maintenance plan should be scripted for the differ- ent device categories and implemented. These plans and documenta- tion will help IT survive their next audit and make physical security a true team player.
Long-term strategies should take advantage of the recent trend in hybrid physical & logical security product platforms. Physical Identity and Access Management (PIAM) engines as well as Service Assurance products help tighten software and firmware updates and logical access control to security devices, allowing a single dashboard to report on and alert key stakeholders within the campus.
References
1 http://www.pressdemocrat.com/news/7408582- 181/petaluma-police-seeking-downtown- surveillance?artslide=2
2 https://www.grahamcluley.com/mirai-botnet-password/
3 https://www.wired.com/story/devils-ivy-iot-vulnerability/
Intelligence (BI) environment. With possibly terabytes of information available from various systems around the campus, it is possible to art- fully piece together significant discoveries about how the business operates and how to improve not only security, but the overall cus- tomer experience.
Reporting. Articulate reporting is a make or break facet of system planning. Filtering out and ensuring the right message gets to the expert at the right time is the goal. Most systems, unfortunately, are deployed with a data glacier—a massive wall of raw information that is unusable to most colleagues. This often-overlooked aspect of security architecture frequently fails to engage stakeholder interest from the various departments who would otherwise become champions for the program. Safety data, certification and compliance dashboards, as well as facility utilization reports are of immediate value to other depart- ments across the campus.
Policies. IT internal controls define how the overall business should run to ensure who can go where and when on the network. Security systems should natively bridge with IT platforms to allow these net- work control policies to naturally inherit within the physical security systems. Many systems today are an honor system spread sheet process rife with errancy and costly delays in shutting down security privileg- es. These should be automated and transparently documented to the central reporting dashboards.
IoT. Broad patching functionality is required for today’s IoT man- agement strategy. Where IT typically has a comfort level in patching all Windows computers on the campus, most IoT devices do not have a Windows operating system and may require a unique tool to ensure firmware is updated to address new vulnerabilities. Service Assurance platforms do just this; they connect hundreds or thousands of devices and monitor firmware and password settings to ensure alerts arise when a newer version is available or changes are recommended. This is as well automated in a best-case scenario.
Command Center. Command Center design is an art form. Just as popular cable television providers organize content intuitively for con- sumers, the aggregated information head end should be easily under- stood as well, and draw the stakeholders in for deeper discoveries and readily processed actionable updates. Raw data is present in most sys- tems. Data science makes it possible to process these massive stores of information. A truly powerful security partner will help the campus departments discover how to leverage these platforms and insights.
Such strategic conversations are critical when validating budgets and operational policies to ensure our campuses remain the preferred centers of learning and healing. The intangible result of the right secu- rity program and systems are the genuine fruit of the overall strategy: a trusted environment for opportunity, prolific collaboration and busi- ness efficacy. Security plays a significant role in strengthening today’s businesses, now more than ever.
Lance Holloway is the director of vertical technology at STANLEY Security.
When selecting newer converged governance platforms, a few overrid- ing considerations should help narrow down the many options available. API. The product’s Application Product Interface (API) should be current and best in class. The overall library of connecting products should already be a strong mix of existing integrations to avoid exper- imental products (mature product with committed developer updates). Data Security. Data management is crucial in today’s Business
A SPECIAL SECTION TO SECURITY TODAY AND THE JOURNAL
APRIL 2018 | WWW.CAMPUSLIFESECURITY.COM CS37
CAMPUS SECURITY & LIFE SAFETY