PAC Access Controllers

With the coming of a New Year, we know these things to be certain: death, taxes, and… security breaches. No doubt, some of you are making personal resolutions to improve your physical and financial health. But what about your organisation’s web and mobile application security? Any set of New Year’s resolutions is incomplete without plans for protecting some of the most important customer touch points you have — web and mobile apps. Every year, data breaches grow in scope and impact. Security professionals have largely accepted the inevitability of a breach and are shifting their defense-in-depth strategy by including a goal to reduce their time-to-detect and time-to-respond to an attack. Despite these efforts, we haven’t seen the end of headline-grabbing data breaches like recent ones affecting brands such as Marriott, Air Canada, British Airways and Ticketmaster. App-level threats The apps that control or drive these new innovations have become today’s endpoint The truth of the matter is that the complexity of an organisation’s IT environment is dynamic and growing. As new technologies and products go from production into the real world, there will invariably be some areas that are less protected than others. The apps that control or drive these new innovations have become today’s endpoint — they are the first customer touch point for many organisations. Bad actors have realised that apps contain a treasure trove of information, and because they are often left unprotected, offer attackers easier access to data directly from the app or via attacks directed at back office systems. That’s why it’s imperative that security organisations protect their apps and ensure they are capable of detecting and responding to app-level threats as quickly as they arise. It’s imperative that security organisations protect their apps and ensure they are capable of detecting and responding to app-level threats as quickly as they arise In-progress attack detection Unfortunately, the capability to detect in-progress attacks at the app level is an area that IT and security teams have yet to address. This became painfully obvious in light of the recent Magecart attacks leveraged against British Airways and Ticketmaster, among others. Thanks to research by RiskIQ and Volexity, we know that the Magecart attacks target the web app client-side. During a Magecart attack, the transaction processes are otherwise undisturbed Attackers gained write access to app code, either by compromising or using stolen credentials, and then inserted a digital card skimmer into the web app. When customers visited the infected web sites and completed a payment form, the digital card skimmer was activated where it intercepted payment card data and transmitted it to the attacker(s). Data exfiltration detection During a Magecart attack, the transaction processes are otherwise undisturbed. The target companies receive payment, and customers receive the services or goods they purchased. As a result, no one is wise to a breach — until some 380,000 customers are impacted, as in the case of the attack against British Airways. The target companies’ web application firewalls and data loss prevention systems didn’t detect the data exfiltration because those controls don’t monitor or protect front-end code. Instead, they watch traffic going to and from servers. In the case of the Magecart attacks, the organisation was compromised and data was stolen before it even got to the network or servers. Today’s proven obfuscation techniques can help prevent application reverse engineering, deter tampering, and protect personal identifiable information and API communications Best practice resolutions The Magecart attacks highlight the need to apply the same vigilance and best practices to web and mobile application source code that organisations apply to their networks—which brings us to this year’s New Year’s resolutions for protecting your app source code in 2019: Alert The key to success is quickly understanding when and how an app is being attacked First, organisations must obtain real-time visibility into their application threat landscape given they are operating in a zero-trust environment. Similar to how your organisation monitors the network and the systems connected to it, you must be able to monitor your apps. This will allow you to see what users are doing with your code so that you can customise protection to counter attacks your app faces. Throughout the app’s lifecycle, you can respond to malicious behavior early, quarantine suspicious accounts, and make continuous code modifications to stay a step ahead of new attacks. Protect Next, informed by threat analytics, adapt your application source code protection. Deter attackers from analysing or reverse engineering application code through obfuscation. Today’s proven obfuscation techniques can help prevent application reverse engineering, deter tampering, and protect personal identifiable information and API communications. If an attacker tries to understand app operation though the use of a debugger or in the unlikely event an attacker manages to get past obfuscation, threat analytics will alert you to the malicious activity while your app begins to self-repair attacked source code or disable portions of the affected web app. The key to success is quickly understanding when and how an app is being attacked and taking rapid action to limit the risk of data theft and exfiltration. Protecting encryption keys is often overlooked but should be considered a best practice as you forge into the new year with a renewed commitment to app security to ensure your organisation’s health and well-being in 2019 Encrypt Finally, access to local digital content and data, as well as communications with back office systems, should be protected by encryption as a second line of defense, after implementing app protection to guard against piracy and theft. However, the single point of failure remains the instance at which the decryption key is used. Effective encryption requires a sophisticated implementation of White-Box Cryptography This point is easily identifiable through signature patterns and cryptographic routines. Once found, an attacker can easily navigate to where the keys are constructed in memory and exploit them. Effective encryption requires a sophisticated implementation of White-Box Cryptography. One that combines a mathematical algorithm with data and code obfuscation techniques transforming cryptographic keys and related operations into indecipherable text strings. Protecting encryption keys is often overlooked but should be considered a best practice as you forge into the new year with a renewed commitment to app security to ensure your organisation’s health and well-being in 2019. Protecting applications against data breach According to the most recent Cost of a Data Breach Study by the Ponemon Institute, a single breach costs an average of $3.86 million, not to mention the disruption to productivity across the organisation. In 2019, we can count on seeing more breaches and ever-escalating costs. It seems that setting—and fulfilling—New Year’s resolutions to protect your applications has the potential to impact more than just your risk of a data breach. It can protect your company’s financial and corporate health as well. So, what are you waiting for?

In my coverage of China Tariffs impacting the security industry over four recent articles, products on the tariff schedules routinely integrated into security solutions included burglar and fire alarm control and transmission panels, video surveillance lenses, HDTV cameras used for broadcast use cases and fiber optic media converters. The general ‘callout’ of ADP (Automatic Data Processing) devices and peripherals technically includes servers, workstations and microcomputers, all of which are commonly used to support security solutions. The underperformance, from June 15 to August 24, of U.S. stocks with high revenue-exposure to China, and that of Chinese stocks with high revenue-exposure to the United States was significant and almost identical at 3.2%, significant losses to some investors already involved in security industry M&A activity. Significant public safety Facial Recognition (FR) vendors leveraging AI expanded their market focus to retail and public safety While it was not apparent that practitioners’ security program budgets kept pace with the growth of the more popular solution providers like video surveillance and cyber security, the ICT industries supporting the security economy continued to expand, especially in wireless and wired infrastructure, including preparations for 5G wireless rollouts. These omnipresent technologies drove significant public safety, smart city and public venue projects in 2018. Facial Recognition (FR) vendors leveraging AI expanded their market focus to retail and public safety. In 2018, virtually every public presentation, webinar and published Q&A on social media monitoring and facial recognition technologies I worked on, involved significant pushback from privacy advocates, almost to the point of alarmism. Massive risk reduction Several solution providers in these areas have made significant strides on data protection, accuracy, powered by AI and documented crime reduction cases; however, this real news is quickly shadowed by privacy advocates, seemingly ignoring massive risk reduction, especially in the case of active assailants and gang-related crime. Will FR become mainstream? The cautious security industry may take a cue from the maverick retail industry, sports venue and VIP verification solution providers that grew in 2018. 2019 trends: presupposition or repudiation; winners and losers. Chinese tariffs have had a huge impact on the security industry, which can be seen from changes to U.S and Chinese stocks  Although technology adoption forecasting is inexact, there are definitive opportunities in the security industry born on necessity. With the widespread problem of false alarm transmission and inability for first responders to ‘be everywhere,’ developers of solutions that provide automated verification and alternative security incident detection are expected to become mainstream. Promising detection systems The use of AI, NLP, LiDAR, UAS (Unmanned Aerial Vehicles aka drones) with surveillance and thermal imaging will grow, mostly due to higher acceptance in other industries like autonomous vehicles, rail safety, terrain and post devastation mapping/rescue. However, legacy ‘listing’ or certification organisations will be forced to make an important decision for their own survival: work toward integrating these promising detection systems into acceptance by insurance, licensing and standards development organisations. 2019’s ‘true’ Industrial Philanthropists will be needed to fund early warning tech for firefighters and the presence of active assailants 2019’s ‘true’ industrial philanthropists will be needed to fund early warning tech for firefighters and the presence of active assailants. For these use cases, 5G infrastructure rollouts, FR acceptance, lower cost perimeter detection and long range object and fire recognition by LiDAR and Thermal imaging will all be watched closely by investors. Should public agencies and philanthropical solution providers in the security industry cross paths, we may just yet see a successful, lifesaving impact. Cyber risk profile The ‘Digital twin’ refers to a digital replica of physical assets (physical twin), processes, people, places, systems and devices that can be used for various purposes. Your ‘Security Digital Twin’ has a similar physical and cyber risk profile, either through common threats, similar assets or both. Good news: managing your risk, protecting assets and securing your facilities in 2019 will get easier as security digital twin profiles will grow in maturity, while keeping their data sources private. This will be accelerated by the maturity of AI-based, auto-generated visualisations and image recognition, that happens to also drive the FR solutions. The 5G wireless infrastructure market is emerging as far more of a quantum leap in connectivity, like ‘wireless fiber optics’ performance, than an upgrade to 4G LTE. The 5G infrastructure market will be worth $2.86 billion by 2020 and $33.72 billion by 2026, growing at a compound annual growth rate (CAGR) of 50.9%. Intelligent applications The explosion of ingested voice, video, and meta-data, the interconnectivity of devices, people and places, and the integration of intelligent applications into expanding ecosystems all require faster communications. To be more accurate, 5G rollouts will accelerate in 2019; however, current project funding will include and be impacted by future enterprise security connectivity: 5G and FWA (Fixed Wireless Access). 5G rollouts will accelerate in 2019; however, current project funding will include and be impacted by future enterprise security connectivity Quite simply put, larger solution providers are gently coaxing practitioners into seemingly ‘open systems;’ the negative discovery during an M&A process, audit or integration with a smart city’s public/private partnerships will continue to be revealed, and related industries will force reform. Autonomous things will be enabled by AI and image recognition. With few affordable rollouts of security robots and outdoor unmanned ground vehicles (UGV) that leveraged platforms popular with research and even NASA, the autonomous security robot was mostly MIA from a security practitioner’s program in 2018. Perimeter intrusion detection One platform was even accused of intimidating homeless people in a public place, at a major city. Industries mutually beneficial are often unaware of each other; this will change gradually: one major domestic airport is currently evaluating a UGV platform performing perimeter intrusion detection, runway weather conditions and potential aircraft taxiing dangers. The platform is being used largely in transportation research, yet offers significant opportunities to the security industry. Research firm Gartner estimates that 70% of today’s technology products and services can be enhanced with ‘multi-experience’-based VR/AR/MR The ‘immersive experience’ of virtually any security or threat detection is a twist on virtual/augmented/mixed reality (VR/AR/MR) with additional sensory features. Although VR/AR/MR is well underway in other industries, there are several companies with solutions like VR-based active assailant training that could provide a fighting chance for practitioners, employees, visitors, faculty and children. Research firm Gartner estimates that 70% of today’s technology products and services can be enhanced with ‘multi-experience’-based VR/AR/MR. Security ecosystem members Not necessarily MIA, but of special mention is the need of security and safety practitioners to prioritise communications systems over ‘nice to have’ expansive video surveillance systems for mass casualty threats. This will eventually improve with 5G for Enterprise solution rollouts. At the past GSX and upcoming CES Technology trade shows, a new roundup of technologies is discovered: a wider diversity of protection promise to save ASIS members on their technical security program is realised. With each of the ‘winners,’ (5G, AI, NLP, LiDAR, UAS [Unmanned Aerial Vehicles aka drones], thermal imaging, digital security twins and smart-city-friendly technologies) it is both exciting and challenging work for both security practitioners and solution providers. All things equal and with the necessary technology acceptance testing processes, this is a truly great time for security ecosystem members.

IHS Markit projects that the market for physical electronic access control solutions has grown to over $5.2 billion in 2018. The market has experienced stable and predictable growth rates that have hovered around 6 percent over the past several years. Electronic locks remain both the largest and the fastest growing product type in access control, representing nearly 40% of the global market size for all access control equipment. Impact of technological developments While market growth rates have been consistent, technological developments have dramatically impacted the market in 2018. The most prominent trend involves mobile credentials, which are poised to revolutionise the longstanding business model for access control system sales. The mobile credentials market was still in its infancy in 2018, but many end-users are already anticipating a transition to these credentials by installing compatible readers in their systems. By 2020, over 10 percent of all new readers sold in the market will be compatible with mobile credentials. Access Control as a Service Other trends to watch in 2019 and beyond include Access Control as a Service (ACaaS), which allow end-users to avoid the need to invest in costly on-site IT infrastructures to support their access control equipment. ACaaS solutions will be particularly popular to support small and mid-sized projects that service less than fifty doors. In addition, Bluetooth Low Energy (BLE) beacons will support geopositioning in an increasing number of the world’s most advanced access control systems. Through geopositioning, the exact location of specific personnel can be identified at any site in real-time. The top fifteen access control vendors represent more than half of the total size of the global access control market, but there are pockets of opportunity for new vendors, particularly to accommodate small and mid-sized projects. The mobile credential and ACaaS markets will also be highly competitive in 2019 and should attract an influx of new market entrants.