How secure is your security system when it comes to cyber?
Cyber security is a hot topic, consistently ranked as one of the biggest risks affecting New Zealand businesses and flagged as an ever-increasing threat worldwide. Cyber-attacks can cost money, disrupt business continuity, and destroy trust, so protecting against them is understandably top of the agenda for many companies.
This article was originally posted by Andrew Scothern, Chief Software Architect at Gallagher.
Less talked about is the potential for cyber to disrupt physical security systems. Security solutions are part of the digital revolution, with powerful software controlling intelligent access control, perimeter and building management systems. A cyber breach now has the potential to open anyone’s door, expose data, or leap-frog to gain access to corporate systems. It’s a worrying scenario, and one that raises an important question: how susceptible is your security system to cyber-attack?
At the risk of answering a question with more questions, there are five factors you can consider when determining the resilience of your security system to cyber-attack.
Do you have access to experts to help you better understand the risks?
There’s a whole subset of specialist industry knowledge around different access card types, communication protocols, third-party integrations and even the electrical wiring of security systems, each of which can introduce vulnerabilities that could be exploited. Leverage off the knowledge of the experts around you: your IT department, vendors and third-party consultants if you need them. They will help you understand the risks and what you need to do to protect against them.
How often is your system updated?
Cyber security is a never-ending battle, with new attacks and vulnerabilities discovered daily. As cyber threats evolve, so must your security platform. Does your vendor tell you about vulnerabilities and update against them? How often do they release software updates? This can be an important indicator of whether they are actively reviewing, testing and improving their product. You should also consider whether the updates are easy to implement from a central point across the whole system, and (just as importantly) whether your team carry out the updates every time.
Does your security vendor conduct and publish any details about third party penetration testing?
Cyber security is a specialist field and even large access control and alarms companies with security teams benefit from engaging third party testing to identify vulnerabilities. This is especially valuable if they are given access to the code for review, as opposed to what is known as ‘black box’ testing.
How does your system mitigate internal threat actors?
Internal threats come in many forms: malicious individuals, social manipulation breaches and through unintentional misconfiguration, but the result is the same. Robust training and auditing processes help mitigate internal threat actors, while implementing the principle of least privilege (PoLP) – as opposed to giving people a super user account because it’s easier – helps address malicious threats.
Do you have a culture of security?
I could write an entire article just in this topic, but in basic terms this means taking a holistic view of your security system, including the environment in which you deploy your solution. You need to address security at every level.
- Ensure you procure a quality product.
- Deploy it in a secure environment.
- Create a culture where everyone cares about security.
- Regularly audit your system and technology.
- Taking a proactive approach to cyber risk is essential, not only for your security system but generally across your organisation. By asking the right questions you can limit your exposure to cyber threats and be better placed to react if they were to happen, reducing risk for your business.