Page 48 - Security Today, July/August 2024

Protecting the Customer By Craig Herman
In the world of IT, insider threats are on a steep upward tra- jectory. The cost of these threats - including negligent and malicious employees that may steal authorized users’ creden- tials, rose from $8.3 million in 2018 to $16.2 million in 2023. Insider threats towards physical infrastructures often bleed into the realm of cybersecurity; for instance, consider an unau- thorized user breaching a physical data center and plugging in a laptop to download and steal sensitive digital information.
In recent years, many security system dealers and integrators have put the majority of their enterprise customers’ IT securi- ty focus on cyber elements like routers and firewalls. This is of course beneficial, but integrators are realizing that they can no longer pursue this limited approach without placing equal em- phasis on physical areas.
As a security system dealer or integrator, how can you best advise your customers on what level of physical protection and hardening is necessary - for sensitive areas like server rooms, data centers, or any facility with stringent security clearances for that matter? What options are available and what makes the most sense?
MULTIFACTOR AUTHENTICATION
As most of us know, a physical access control system allows orga- nizations to manage who enters a physical space. In the IT realm, multifactor authentication (MFA) is widely used to protect both cyber (digital) and physical assets.
MFA works by requiring multiple protections, usually some- thing a person knows (like a username and password) or some- thing a person has (like a mobile device or email account). In this example, a person would enter a username and password, and then be sent a special code (via phone text or email) which would be required in order to authenticate.
MFA is a more rigorous process than passwords alone, but certain combinations like the common one described above are not impervious to threats, as usernames and passwords can still be stolen, and special codes intercepted by resourceful bad actors. Another drawback of using this type of combination for MFA is that it introduces an element of friction.
Imagine a scenario where an authorized sys admin needs im- mediate access to the data center to implement a fix for a mis- sion-critical server. In such a scenario, requiring more layers of authentication can make the process more complicated, time- consuming and frustrating.
FOBS AND KEYCARDS
Traditionally, physical access control systems have relied on fobs and keycards incorporated into electronic systems which then control doors and locks, allowing designated people to enter pro- tected areas at these specific access points.
However, fobs and keycards are not perfect, dupe-proof sys- tems, due to the fact that they are not bound to an individual. It is all too easy for someone to give or loan their fob or keycard to someone else, or for a fob or keycard to be stolen, allowing access to unauthorized individuals.
Harkening back to the issue of insider threats, it’s not hard to imagine one insider (an inadvertent employee) accidentally leav- ing out a fob or keycard, only to be snatched up by another in- sider (a malicious employee).
As a security system dealer or integrator, maybe you find that MFA or fobs and keycards are sufficient for your customers. But maybe you do not, as the risks they present are still too great given the sensitivity of their physical areas. And maybe the alternative like having live security guards on hand 24x7 is just too impracti- cal from a cost standpoint. Fortunately, biometric authentication is evolving as an alternative to these porous and costly approaches.
VERIFY AN INDIVIDUAL
Biometrics or, unique individual traits such as fingerprints, facial scans or speaker recognition that can be used to verify an indi- vidual’s identity - can be the key to overcoming these challenges and providing assurances for your customers.
Biometric authentication can ensure organizational security is effective or get your customers to the next level of physical access control by answering the question - is this really the authorized per- son? They’re also nearly impossible to subvert due to liveness capa- bilities, which can detect that a person presenting for authentication is a real, breathing person, and not an attempt at a dupe (someone presenting a photo of an authorized user’s face, for instance).
When it comes to identity verification, biometrics are as close to foolproof as you can get.
There is good news around biometrics today as well - the first is that biometric capabilities or workflows are now available in a cloud-based SaaS model. This means any size customer can now use biometrics as part of their physical access control offering - whether itis a small organization securing a single door, office or closet, or a global enterprise with multiple buildings with various security levels needed. Moreover, customers can quickly get up and running with minimal upfront investment of time and resources. So if you suggest biometrics to a customer, you’re not recommend- ing an expensive, time-consuming overhaul of their security infra- structure. In most cases, customers can leverage the equipment they already have along with the bring-your-own-device (BYOD) trend.
While we have relied heavily on physical access control in an IT sense (protecting server rooms and data centers, for example) to illustrate our point, your customers’ physical access control needs probably extend across a much wider range of use cases and scenarios, to other types of highly classified areas. Being the best steward of their comprehensive physical access control needs means being able to realistically advise on the drawbacks of cer- tain approaches and offering new techniques –
specifically those that fortify customers’ physi-
cal security more quickly and effectively than
ever before, while leveraging their existing in-
vestments.
Craig Herman is the chief revenue officer at Aware.
48
JULY/AUGUST 2024 | SECURITY TODAY
CYBERSECURITY