Because video surveillance, access control, alarms, communications and more are increasingly dependent and connected to networks and IT infrastructure, they can be vulnerable to rising cyberattacks. For example, an attack originating from a camera or door controller can find its way through the network to block access to critical applications, lock files for ransom, and steal personal data.
The public sector needs to implement effective cybersecurity practices to reduce security risks associated with physical security devices.
Genetec, a technology provider, provides seven steps on how physical security and IT departments in the government sector can work together to develop a coordinated strategy for hardening systems:
- Ensure each device, as well as the servers used for storing data and hosting monitoring consoles, has the latest version of firmware and software recommended by the manufacturer.
- Changing default passwords and establishing a process to change them frequently is a critical practice.
- Improving network design to segment older devices can also help reduce the potential for crossover attacks.
- To determine the risk of physical security systems, organizations conduct a posture assessment, creating and maintaining an inventory of all network-connected devices and their connectivity, firmware version and configuration.
- As part of the assessment, they must identify models and manufacturers of concern, such as those listed by the U.S. Government under the National Defense Authorization Act (NDAA), presenting a high level of cyber risk. They should also document all users with knowledge of security devices and systems.
- Review devices and systems that should be replaced. When developing a replacement program, prioritize strategies that support modernization. One practical approach is to unify physical and cybersecurity devices and software on a single, open-architecture platform with centralized management tools and views.
- The U.S. Cybersecurity and Infrastructure Security Agency recommend joining IT and physical security into a single team to develop a comprehensive security program based on a shared understanding of risk, responsibilities, strategies, and practices.
In the U.S., Federal funding may help cover costs associated with replacement programs. The 2021 Investment and Jobs Act includes $1 billion earmarked to help state and local governments modernize their cybersecurity.
