Access control readers - Expert commentary

Insider threats are on the rise – even in the virtual workplace
Insider threats are on the rise – even in the virtual workplace

More than a year and a half after the COVID-19 pandemic began, countless workers are still doing their jobs remotely rather than from their offices. While there are many positives to working from home, there can also be some negatives at play like nefarious actors taking advantage of the tools and connections that employees use in work from home environments. Insider threats, a security risk that comes from within the organisation, are posing a major security problem for businesses. This is partially due to the widespread use of social media, encrypted communication platforms, and other tools. Now more than ever insider threats need to be identified, thwarted, and prevented. Social distancing policies When social distancing policies and mandates began keeping people apart, many turned to social media to stay connected. While social networking tools have provided a positive outlet and a way for people to feel more connected, these platforms have also become a hotspot for insider targeting because they provide a way to propagate disinformation and target individuals likely to be receptive to it. The ideal mark for an insider threat is someone who is active on social media Even more so, they have provided a means to develop relationships with organisational insiders and socialise with them. The ideal mark for an insider threat is someone who is active on social media, has sufficient access to sensitive information, lacks supervision in their day-to-day work, and works remotely. As the relationship develops, through the process of grooming, an employee can become more likely to disregard company policies and commitments. Disregarding company policies One reason insiders might act against their own organisation involves monetary gain. The pressures of the pandemic have led to record levels of unemployment and financial strain for millions of Americans. Financial issues can include struggling to pay for childcare, supporting family obligations, paying rent and more. Those who find themselves in a financial bind might not just act against their own company but could also more easily fall victim to a threat. Another reason that insiders act is that they may be disgruntled. Insiders may hold a grudge because they were passed over for promotion, were given an unsatisfactory performance rating, or they may be facing termination. While just one of these factors may not be a trigger to involve the company’s security team, any combination of these factors along with a change in the employee’s demeanour or behaviour should serve as a red flag to pay closer attention to the situation. Potentially malicious insiders Sending confidential information to an unsecured location in the cloud exposes the organisation to risk Another challenge employers face directly relates to the somewhat limited supervision of employees who work remotely. In this situation, identifying potentially malicious insiders is more difficult, largely because face-to-face interactions are limited. When the pandemic began, many companies shifted their primary areas of focus to keeping the business viable, which is understandable. However, with this shift of focus, less attention may have been paid to security issues. The proactive company will have ensured their employees are aware of the following: Steps they should take to ensure their devices -- both company-issued and personal -- are secured at all times. Sending confidential information to an unsecured location in the cloud exposes the organisation to risk. Breaking security policies to simplify tasks is prohibited. Ensuring their devices are updated with the latest security patches. A failure in any of these areas can produce an environment ripe for malicious insider activity. Cyber security teams This multidisciplinary group can lead the initiatives that are paramount to keeping the company secure The insider threat is an organisational threat and so it is most effectively addressed from a holistic perspective. Stakeholders from different parts of the organisation need to be at the table to understand and address such threats. An effective team includes personnel from the legal, human resources, communications, and physical and cyber security teams. This multidisciplinary group can lead the initiatives that are paramount to keeping the company and its employees secure. Conduct a risk assessment of the company’s security processes or a threat assessment to the company’s people or assets. No organisation is without some level of vulnerability, so identify the most critical assets, information, and systems; identify those who have access to these critical assets; and build controls around them to provide extra security. Delivering refresher training Build a training program to help employees and management identify concerning behaviours. Educate staff about insider threat indicators and provide instructions for how to report concerns. Require employees to complete training and deliver refresher training and updates throughout the year. Training on this matter is not a one-and-done situation. Ensure there is an impartial and confidential process in place for employees to report possible insider threats. Employees need to trust that if they report concerns about behaviours or actions on the part of a fellow employee, their information will be handled discreetly and if warranted, acted upon. Write a communications strategy clearly defining the process for relaying insider threat incidents. An effective plan lays out what information and when this information should be shared with specific individuals and to the broader community, who has authority to communicate sensitive information, and how the information should be disseminated. Remote working challenges Establish a check-in process for managers and their direct reports to enable a means for employees to share concerns and for managers to identify challenges or opportunities to assist employees working in the virtual environment. Make an EAP (employee assistance program) readily available to employees. Ensure they understand how to access their EAP and assure them that contacting the EAP will not have a negative impact on their career or growth potential. Providing venues for employees to share their concerns and talk with trained staff can greatly help organisations navigate insider threats and general remote working challenges. Security risk environment The virtual workplace has created a serious security risk environment for companies in which employees who would not normally engage in insider threats become more vulnerable to them. Through new technologies and possibly due to new financial hardships, those looking to harm an organisation are out there, searching for opportunities to strike. It is leadership’s responsibility to take proactive action to ensure their employees are aware of the possibility of insider threats, the seriousness with which management views them, and the resources available should someone fall victim. It is everyone’s responsibility to remain vigilant.

The EU called for a ban on police use of facial recognition but not commercial use. Why?
The EU called for a ban on police use of facial recognition but not commercial use. Why?

Recently, the European Parliament called for a ban on police use of facial recognition. In the US, too, some cities have restricted police use of facial recognition. The first question that comes to mind is - why ban police from using technology that is allowed to private companies? Point of difference The key difference between the way police use facial recognition and the way commercial facial recognition products work is that: The police get a picture of a suspect from a crime scene and want to find out: "Who is the person in the picture?" That requires as wide a database as possible. Optimally - photos and identities of all the people in the world. Commercial facial recognition products such as those used by supermarkets, football stadiums, or casinos answer different questions: "Is the person in the picture on the employees' list? Is the person in the picture on a watch-list of known shoplifters?" To answer these questions doesn't require a broad database but rather a defined list of employees or a watch-list of specific people against whom there is an arrest warrant or a restraining order. Use of facial recognition AnyVision helps organisations leverage facial recognition ethically to identify known persons of interest "Facial Recognition Apps Should Be Provided to the Police with an Empty Database". This is exactly the subject of the open letter sent by AnyVision, to the British Biometrics and Surveillance Camera Commissioner, Prof. Fraser Sampson, titled: "Facial Recognition Apps Should Be Provided to the Police with an Empty Database". AnyVision recently raised $235M from Softbank and another leading VCs is a visual AI platform company that helps organisations across the globe leverage facial recognition ethically to identify known persons of interest, including shoplifters, felons, and security threats. Ethical use of facial recognition AnyVision CEO Avi Golan wrote, "The ethical use of facial recognition is a thorny one and requires a nuanced discussion. Part of that discussion has to explain how facial recognition works, but, just as important, the discussion must also involve how the technology is used by police departments and what checks and balances are built into their processes.” “We recommend building their watchlists from the ground up based on known felons, persons of interest, and missing persons. Some facial recognition solution providers have scrapped billions of photos and identities of people from social networks, usually without their consent." "Unfortunately, this method of facial recognition has justifiably angered privacy groups and data protection agencies around the globe and damaged the public trust in accuracy and reliability of facial recognition systems.” Preventing invasion of citizen’s privacy We believe an unjustified invasion of citizens' privacy can be prevented, false arrests can be reduced" “We believe that lists of suspects should be limited and justified. In this way, unjustified invasion of citizens' privacy can be prevented, false arrests can be reduced and public confidence in technology can be increased.” Golan added: "AnyVision is willing to share its industry insights and best practices from our vast research experience with leading global players, including name-brand retailers, global hospitality and entertainment companies, and law enforcement agencies from around the world.” Balancing public order and crime prevention “If the regulations set forth by Surveillance Camera Code of Practice are committed to the principles outlined above, then law enforcement agencies can strike the right balance between the need to maintain public order and prevent crime with the rights of every person to privacy and non-discrimination before the law." Recently Clearview AI CEO told Wired; the company has scraped 10 billion photos from the web - 3 times more than was previously known.

Access the right areas - Making a smart home genius with biometrics
Access the right areas - Making a smart home genius with biometrics

Household adoption of smart home systems currently sits at 12.1% and is set to grow to 21.4% by 2025, expanding the market from US$ 78.3 billion to US$ 135 billion, in the same period. Although closely linked to the growth of connectivity technologies, including 5G, tech-savvy consumers are also recognising the benefits of next-generation security systems, to protect and secure their domestic lives. Biometric technologies are already commonplace in our smartphones, PCs and payment cards, enhancing security without compromising convenience. Consequently, manufacturers and developers are taking note of biometric solutions, as a way of levelling-up their smart home solutions. Biometrics offer enhanced security As with any home, security starts at the front door and the first opportunity for biometrics to make a smart home genius lies within the smart lock. Why? Relying on inconvenient unsecure PINs and codes takes the ‘smart’ out of smart locks. As the number of connected systems in our homes increase, we cannot expect consumers to create, remember and use an ever-expanding list of unique passwords and PINs. Indeed, 60% of consumers feel they have too many to remember and the number can be as high as 85 for all personal and private accounts. Biometric solutions strengthen home access control Biometric solutions have a real opportunity to strengthen the security and convenience of home access control Doing this risks consumers becoming apathetic with security, as 41% of consumers admit to re-using the same password or introducing simple minor variations, increasing the risk of hacks and breaches from weak or stolen passwords. Furthermore, continually updating and refreshing passwords, and PINs is unappealing and inconvenient. Consequently, biometric solutions have a real opportunity to strengthen the security and convenience of home access control. Positives of on-device biometric storage Biometric authentication, such as fingerprint recognition uses personally identifiable information, which is stored securely on-device. By using on-device biometric storage, manufacturers are supporting the 38% of consumers, who are worried about privacy and biometrics, and potentially winning over the 17% of people, who don’t use smart home devices for this very reason. Compared to conventional security, such as passwords, PINs or even keys, which can be spoofed, stolen, forgotten or lost, biometrics is difficult to hack and near impossible to spoof. Consequently, homes secured with biometric smart locks are made safer in a significantly more seamless and convenient way for the user. Biometric smart locks Physical access in our domestic lives doesn’t end at the front door with smart locks. Biometrics has endless opportunities to ease our daily lives, replacing passwords and PINs in all devices. Biometric smart locks provide personalised access control to sensitive and hazardous areas, such as medicine cabinets, kitchen drawers, safes, kitchen appliances and bike locks. They offer effective security with a touch or glance. Multi-tenanted sites, such as apartment blocks and student halls, can also become smarter and more secure. With hundreds of people occupying the same building, maintaining high levels of security is the responsibility for every individual occupant. Biometric smart locks limit entry to authorised tenants and eliminate the impact of lost or stolen keys, and passcodes. Furthermore, there’s no need for costly lock replacements and when people leave the building permanently, their data is easily removed from the device. Authorised building access Like biometric smart locks in general, the benefits extend beyond the front door Like biometric smart locks in general, the benefits extend beyond the front door, but also throughout the entire building, such as washing rooms, mail rooms, bike rooms and community spaces, such as gyms. Different people might have different levels of access to these areas, depending on their contracts, creating an access control headache. But, by having biometric smart locks, security teams can ensure that only authorised people have access to the right combination of rooms and areas. Convenience of biometric access cards Additionally, if building owners have options. The biometric sensors can be integrated into the doors themselves, thereby allowing users to touch the sensor, to unlock the door and enter. Furthermore, the latest technology allows biometric access cards to be used. This embeds the sensor into a contactless keycard, allowing the user to place their thumb on the sensor and tap the card to unlock the door. This may be preferable in circumstances where contactless keycards are already in use and can be upgraded. Smarter and seamless security In tandem with the growth of the smart home ecosystem, biometrics has real potential to enhance our daily lives, by delivering smarter, seamless and more convenient security. Significant innovation has made biometrics access control faster, more accurate and secure. Furthermore, today’s sensors are durable and energy efficient. With the capacity for over 10 million touches and ultra-low power consumption, smart home system developers no longer have to worry about added power demands. As consumers continue to invest in their homes and explore new ways to secure and access them, biometrics offers a golden opportunity for market players, to differentiate and make smart homes even smarter.

Latest PCSC news

PCSC and Coolfire Solutions collaborate to deliver top-level capabilities for access and security
PCSC and Coolfire Solutions collaborate to deliver top-level capabilities for access and security

PCSC, a designer and manufacturer of access control solutions and Coolfire Solutions, a St. Louis based software company known for creating Military-Grade situational awareness platforms, collaborate to deliver top-level capabilities for access and security. Coolfire Solutions created its innovative Ronin Platform to deliver software that sits on top of existing systems and infrastructure to transform data into actionable intelligence. Originally developed for the U.S. military, the Ronin Platform is being widely adopted by industry leaders and organisations who recognise the importance of placing the right data, in the right hands, in real-time, so that intelligent decisions can be made. LiNC-NXG PSIM system Stacking the Ronin Platform on top of the data provided by PCSC’s LiNC-NXG PSIM system provides a robust, real-time common operational pictureStacking the Ronin Platform on top of the data provided by PCSC’s LiNC-NXG physical security information management system provides a robust, real-time common operational picture, visually representing physical security events, and enabling a coordinated security response. For instance, urgent security related event details are pushed to mobile devices of nearby security officials for immediate action. An additional benefit, in the case of an on-premises environment, the underlying access management system is not exposed, only the top-level data is managed. Extend the capabilities of access solutions “An extremely impressive GUI for our industry and an actionable set of features extend the capabilities of PCSC’s access solutions for real-time response,” said Mas Kosaka, President and CEO of PCSC. “The expansion possibilities are virtually limitless too. We’re excited to debut the capabilities of Ronin to our Business Partners during the PCSC Symposium in conjunction with ISC West, the largest security industry trade show in the U.S.” Coolfire Solutions and PCSC have the experience and capabilities to transform the way security professionals do their job every day" “Coolfire Solutions and PCSC have the experience and capabilities to transform the way security professionals do their job every day. We can maximise the value of existing technology investments by combining data from any source and making it actionable," said Don Sharp, CEO at Coolfire Solutions. "Security professionals have an incredibly challenging job and it’s only getting tougher. By bringing all of their critical data onto a single pane of glass we can increase the level of security while driving significant operational efficiencies.”

Suprema to globally provide and support BioConnect Identity Platform
Suprema to globally provide and support BioConnect Identity Platform

The BioConnect Identity Platform provides an integration of Suprema's biometric solutions with the majority of leading access control systems BioConnect and Suprema have announced Suprema's launch of the BioConnect Identity Platform. Developed by BioConnect, Suprema's long-standing strategic partner in North America, the BioConnect Identity Platform provides an integration of Suprema's biometric solutions with majority of the leading access control systems in the global security market. Under the appointment, Suprema will provide and support the BioConnect Identity Platform globally from June 1st, 2016 onward. Powerful integration featuresWith the BioConnect Identity Platform's powerful integration features and BioConnect's and Suprema's partner eco-systems, enterprises benefit from the ability to take advantage of deploying biometrics with their existing (or their choice of) access control vendor, standards, devices and way of operating. The BioConnect Identity Platform enables the seamless integration of Suprema's biometric terminals with access control systems, ERP and time and attendance systems, supporting biometric and multi-factor authentication, biometric enrollments and user ID management. One central system The solution enables greater security, identity assurance and convenience from one central system and has ultimately changed the way that the physical access control market can consume biometrics as an authentication strategy. No other manufacturer around the world has been able to offer this level and quality of integrations - with the BioConnect Identity Platform boasting over 20. "With the BioConnect Identity Platform, BioConnect complements our goal of providing industry-leading biometric security solutions to the global market. The product is a ready-made bridge solution that provides easier integration of cutting-edge Suprema biometric technology together with a customer's choice of leading access control systems," said Young Moon, VP of Suprema. "We are looking forward to providing the BioConnect Identity Platform to a more global security market and are excited to offer our customers a seamless and cost-effective way of adopting Suprema's biometric security solutions," Moon added. Innovative technologies From the perspective of the access control provider, the BioConnect Identity Platform opens up the option to provide a Suprema biometric solution and continue to benefit from the complete product line as Suprema brings new and innovative technologies to market. "As a Suprema partner we have experienced a lot of growth in the North American and UK markets due to its leadership and continued emphasis on producing biometric products of superior quality, versatility and range," said Steve Greb, Strategic Director of Business Development at BioConnect. "We're very excited to draw on Suprema's impressive partner network and continue to build out our Quest for Rightful Identity on a global scale." Integration with leading systems The BioConnect Identity Platform integrates the following leading access control systems with the Suprema biometric terminals; ACT ACTManage, AMAG Symmetry, Axis A1001, Brivo OnAir/OnSite, Genetec Security Center, IMRON IS2000, Lenel OnGuard, Open Options dnaFusion, Paxton Net2, Honeywell ProWatch, Honeywell WINPAK, RS2 AccessIT!, S2 Netbox, Software House CCURE 9000, Stanley SecureNET, Gallagher Command Centre and now PCSC LiNC-PLUS. Suprema and BioConnect will team together to showcase the BioConnect Identity Platform at IFSEC 2016 in London on June 21st-23rd at Stand E1400.

Do’s and Don’ts of managing legacy systems – Migration better than rip-and-replace for enhancing security control system functionality
Do’s and Don’ts of managing legacy systems – Migration better than rip-and-replace for enhancing security control system functionality

Systems may be reliable and performing as originally intended, but can also beoutdated in comparison to current technology offerings Let’s start by defining what a legacy system is in the context of a security control system. Legacy refers to an installed and operating security control system made up of numerous components, both hardware and software, that have been eclipsed by newer technologies. A shortage of parts and pieces may be creeping in, and it’s also likely the older stuff has a service tech scratching his head when faced with a configuration setting or data entry protocol. The newer technologies, however, may still be providing much of the desired functionality required by the legacy system user. Legacy in this context then is not necessarily a pejorative term. The system may be both reliable and performing as originally intended but is outdated in comparison to current technology offerings both from a communications standpoint and as it relates to applications and data mining. So what to do? For openers, as my dad would day, do a Ben Franklin list of do’s and don’ts. Naturally you’d love to move to a new, bigger or smaller, better and faster system. But, first, what does that list look like? I for one think is might begin to look like this: Things to do when managing legacy systems Do you have a handle on your current technology capabilities? Many legacy systems are underutilised and have features that are not used. Revisit your systems capabilities: You are likely to make some pleasant discoveries. Do you have a handle on your current technology capabilities? Many legacy systems are underutilised and have features that are not used Do you currently know how all of the pieces and parts in your system are currently communicating? A great start for planning the next steps is to understand the “plumbing.” Associated with that is the location of communication; specifically, how are things wired and where are they terminated, recorded and catalogued? What does your power distribution for the system components look like? Do you have backup and other means of maintaining operations during a loss of power, and where is that stuff? If not done recently, this step provides an opportunity to ensure you are ready for things that don’t happen and also to revisit codes. It’s always worthwhile if a maintenance provider is available to a system test in this area, or it can be self-conducted. What is the state of your record management, and when was the last time you did some basic housekeeping, such as backup and the like? If you don’t remember when you did it last, stop reading and go do some housekeeping — it’s clearly due now! What works for you and your organisation, and what have you developed a work-around for? If your “super users” have found ways to manage desired system outcomes by some clever workaround, are there other desired features?  Do you have a relationship with an authorised service provider or an on-staff trained first responder? Do you have attic stock (stuff you own) to support those older components? I like to think of it like making a road trip with a spare tire and basics in the trunk in case an extended unplanned stop on the side of the road interrupts your trip. Have you developed a plan for an eventual upgrade? What’s first, what does it cost and whom will I let provide pricing to do so?  Rip-and-replace isn't your only option. There are many products and servicesavailable to migrate from a legacy to next steps utilising embedded infrastructure Planning and management What are my/your basic functional requirements, and where are the gaps now you must fill for enterprise sustainability? That legacy system likely has paid its way and now needs to be retired; I’m not ready either. Do you have a business case for this refresh – applications, data mining, new and reporting and risk mitigation strategies? If not, you are missing this first step of legacy migration planning and management. Managing the age includes a system exit strategy. Getting C suite, namely your CFO’s, attention is key; sustainability of your enterprise is 101, so functionality as it relates to risk mitigation is essential to keeping your entity flourishing. So what are the DON’T’s? Don’t trivialise the migration or response to the Do’s or you’ll end up in a big To Do. Don’t minimise the relationship with existing integration resources you have worked with, old and new. Organisations evolve, some for the best, some not so. Refresh these relationships as well; resources are like bridges – you never know when a crossing is needed. Don’t rush into the latest and greatest; be wary of who’s definition you subscribe to. There’s a reason they call it the “cutting” edge. Don’t believe that rip-and-replace is your only option. There are many legacy systems in our industry, and many well-made and well-thought-out products and services are available to migrate from a legacy to next steps utilising embedded infrastructure. The bottom line: Define your parameters, select your partners and engage companies with a history of legacy migration and thought leadership. If your legacy includes some products with forward-thinking engineering thought leadership, you may be able to manage your needs with security control board-level replacements or the flashing of new firmware and upgrades to software. I‘m aware of several companies whose products elegantly move through time, adding new applications and functionality without wholesale rip-and-replace. These legacies carry on. The market has responded to you and others eager to know their options. There are many ingenious and clever ways to upgrade communications and transport of data, reliable mainstream products designed to meet this challenge head-on. There are solutions aimed at allowing you to use current IT and Internet of Things (IoT) apps and functionality. However, there are also quite a number of technology partners able help make the leap from analogue to digital using existing pathways. The bottom line: Define your parameters, select your partners and engage companies with a history of legacy migration and thought leadership. They are most likely to produce the best results and allow you to leave behind the legacy you want to be associated with.

Related white papers

10 top insights in access, cloud and more

Protecting dormitory residents and assets

Top 5 ways to ensure visitor safety and security