The merger of physical security and IT is known as convergence
Examining the road to convergence
The use of Internet Protocol (IP) in the security industry is increasing but little is known about the relationship between end users and the merger of traditional physical security and IT otherwise referred to as convergence in the security trade press. Markus Lahtinen of the LUSAX project examines the growth of convergence in the security industry and discusses complexities of this relationship.

The LUSAX project at Lund University in Sweden started in 2006 as a strategic research partnership together with ASSA ABLOY, AXIS Communications and Niscayah, to understand the industrial impact and end user consequences following the increased use of the IP to connect security equipment and transmit security data. The swift use of convergence can be confusing, but three main types of convergence are discerned:

  • Technological convergence: increased use of IP-enabled security equipment and technical integration of physical security systems like access control and video surveillance, as well as potential integration with other operational enterprise systems (for example staff and payroll databases)
  • Organisational convergence: the process of coordinating and integrating internal IT security, logical security and physical security for both efficiency reasons (to lower costs) and effectiveness reasons (for example, to address new organisational risks and threats that require coordination between IT and security)
  • Industry convergence: meaning the suggested merging - or even absorption - of the IT industry with the security industry

At the beginning of the research project, there was a sense of urgency in the security industry to ‘catch up' on the knowledge and efficiency associated with the IT industry. Following the terminology from above, industry convergence would push for both technical and organisational convergence. However, the diffusion pattern has not played out as fast as projected back in 2006. The verdict stands clear that technological convergence ishappening, but at an undetermined and slower pace.

The verdict stands clear that technological convergence is happening, but at an undetermined and slower pace

Despite the industry buzz on convergence, little is known and systematically documented on how security end users actually reason and act in relation to technological change. In order to understand the increased use and diffusion of advanced security technology, it is necessary to survey the preferences held by the end users to the value propositions associated with this new technology.  Yet of equal importance are questions on how security departments organise themselves internally and how they act and behave in relation to their immediate internal and external environments.  In summary, convergence cannot be meaningfully separated from the organisational position held by the security department.

Security directors and the security industry: the relationship myth

Based on survey data and interviews with top-tier security directors, several organisational concerns not previously documented have now been identified. One such organisational finding concerns the relationship between the security director and the security industry with regards to what sources are used to keep informed about industry developments.

The answers suggest that peers, colleagues and internal expert(s) matter more than trade shows, trade press, systems integrators and security consultants in keeping informed about industry development. Further statistical analysis suggests particular importance is given to internal expert(s), suggesting  that the internal expert plays a pivotal role in filtering industry noise and that peers and colleagues play an evaluative role to industry impulses filtered by these internal experts. Also, the internal expert usually collaborates with a security consultant in case of major system upgrades. This means that detailed decisions about security equipment rarely ends up at the security directors' table. This finding contradicts the commonly held view that top-tier security directors interact directly with the security industry.

Security directors recognise the value propositions of IP-based security

A second finding is the overall agreement seen by security directors in relation to the value propositions associated with new technology. Value propositions are understood as what contribution IP-based security may have to the security operations in terms of improved efficiency or increased security effectiveness. One example is scalability, meaning that adding an additional surveillance camera, for instance, does not require any costly back-end upgrades. Also, having security equipment running on the same network enables for integration beyond security purposes - for example real-time connection with the global employee database.

Understanding the organisational tree is key in understanding convergence
Knowing the place of security departments in the organisational tree is important in understanding convergence

Taken together, security directors see the value of security technology and also recognise the associated value propositions, but IP as such is not the primary item for top-tier security directors.

Standing of security departments in the organisational tree

Third and finally, the relationship between the security department and the immediate organisational environment is one sometimes described as being conflicting in the sense that physical security is portrayed only as being a cost-entry without any clear profit contribution. We believe this has mainly been used as industry-driven rhetoric to suggest a scenario of diminishing the importance of the physical security director, further bolstering the sense of urgency around the corner.

Quite the opposite, the collected data suggest physical security to be a well-established business process; and often even externally recognised as being a strategic one at that.

Consequently, the initial view describing the security department as being in an isolated position and a ‘necessary evil' is not shared by security directors. This might partially be attributed to self-preserving views held by the respondents, but too much attention has been directed into this form of simplifying security operations, unfortunately at the expense of understanding the underlying premises under which physical security operates.

Implications of convergence in the security industry

A security operation by its very nature is defensive, risk-averse and reluctant to simplify while strategic business logic often rewards risk-taking with a need to simplify complex market conditions. This implies an inherent and fundamental conflict between security decision logic and general market-oriented business logic that is not to be understood as being problematic, but in the best of cases being mutually rewarding. Management of successful security operations strike a balance between these logics.

The process of convergence will not follow a straight path
The path of convergence will follow a non-linear path

All in all, complex organisational conditions have direct impact on the diffusion speed of new security technology like converged systems. Industry-driven ‘copy and paste' deployment recipes for new technology are less likely to be adopted by advanced end users the same way it happened with the diffusion of core business-supporting software, for example software managing invoicing, inventory, and word processing software; relying only on logical components on standardised input/output hardware. Security systems rely to a greater extent on a combination of logical and less standardised physical hardware. This requires a more advanced input of system integration skills, be it skills for installing low-voltage analogue systems or network and IT skills for networked security systems.

Also, the diffusion pattern depends on the type of end user industry. Retail, for example, has a clear performance metric in the form of shrinkage that ties in directly with deliberate thefts. This enables the security operation to match accrued costs and investments to clear measures on losses. Banking and finance, a sector more regulated than most others, requires advanced security systems, where several subsystems need to be tied together to offer functionality that supports security effectiveness. Hence, procurement and major systems revisions in this sector follow a complex chain of decisions involving resellers, security consultants, architects (in the case of sustainable constructions) and internal security staff such as internal experts.

Having described a selection of organisational considerations affecting the convergence, it stands clear that this process will follow a non-linear path, more so for advanced multi-national end users focused on functionality and security effectiveness than the underlying technology providing for security services. For the same reasons, traditional security suppliers are kept insulated and are still in a position to harness their existing relations with end users. However, as a response to increased demand for converged systems, proactive security suppliers may in the long run increase their know-how and leverage their market position by following an incremental approach by engaging into end user projects requiring hybrid or full IP-based security systems.

Markus Lahtinen Markus Lahtinen
LUSAX project
Lund University
Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version

In case you missed it

What are the security challenges of protecting utilities?
What are the security challenges of protecting utilities?

Utilities are an important element of critical infrastructure and, as such, must be protected to ensure that the daily lives of millions of people continue without disruption. Protecting utilities presents a unique range of challenges, whether one considers the electrical grid or telecommunications networks, the local water supply or oil and gas lines. Security technologies contribute to protecting these diverse components, but it’s not an easy job. We asked this week’s Expert Panel Roundtable: What are the security challenges of protecting utilities?

Q&A: how the ‘secret service of Hollywood’ protects celebrities
Q&A: how the ‘secret service of Hollywood’ protects celebrities

At a major music festival, a fan in the crowd aggressively leapt over a barricade to approach a famous artist. Personnel from Force Protection Agency immediately implemented extrication protocol to shield the artist from physical harm, quickly reversed course and calmly led the client away from the threat. Force Protection Agency (FPA) personnel intentionally did not engage the threatening fan in any way, as local venue security personnel were present and tasked with apprehending the rogue fan. FPA’s efforts were directed expressly toward the protection of the client, avoiding unnecessary escalation or complications and minimising physical, visual, and legal exposure. Dedicated to the safety of clients Force Protection Agency is a unique, elite-level agency inspired by a vision for excellence and innovation Specialising in protecting celebrities and high-net-worth individuals, Force Protection Agency is a unique, elite-level agency inspired by a vision for excellence and innovation, and dedicated to the safety and success of clients. The agency was formed in 2017 by Russell Stuart, a California State Guard officer and security and entertainment industry veteran. The agency is the culmination of 20 years of experience in the fields of security, military, emergency management, logistics and technology, media and entertainment, and celebrity management. We interviewed Russell Stuart, Founder and CEO of Force Protection Agency (FPA), which has been called “the Secret Service of Hollywood,” for his insights into providing security for celebrities. Q: What unique need in the marketplace do you seek to serve, and how are you qualified to serve it? Stuart: The needs of celebrity and high-net-worth clients are complex and constantly changing. When dealing with a high-profile individual, discretion is paramount, extensive communication is required, and adaptation is ongoing. A critical objective is anticipating and planning for all types of potential negative scenarios and preventing them from even starting, all while not disrupting the normal course of operation of the client's day or their business. Force Protection Agency is poised to serve these needs by innovating and intelligently managing the planning, procedures, and personnel used in every facet of protecting the client’s interests and achieving their objectives. Q: What is the typical level of "professionalism" among bodyguards and security professionals that protect celebrities? Why does professionalism matter, and how do you differentiate yourself on this point? Stuart: Professionalism is an overall way of approaching everything to do with the business, from recruiting, to training, to making sure the right agent is with the right client. Nothing matters more; polish and precision are not only critical to mission success, but also support the comprehensive best interest of the client while preventing costly collateral damage and additional negative consequences. True “professional protective services" is intelligent strength and proper execution, not emotional or reactionary violence. Unfortunately, the latter is frequent among many celebrity bodyguards, and often incurs extremely expensive and even dangerous repercussions. Q: Your company has been described as "the Secret Service of Hollywood." How true is that comparison, and how does your work differ from (e.g.) protecting the President? Force Protection Agency prides itself on providing its services with discretion, precision, and poise Stuart: Totally true, and for this reason: the keys to success in protection are prioritization, and planning. Most people fail to even recognise the first, negating any level of effort given to the second. Establishing the true needs and the correct priority of objectives for each individual client and situation, and firmly committing to these without deviation, are what distinguishes both government secret services and Force Protection Agency from the vast majority of general security firms. Also, the term “secret service” implies an inconspicuous yet professional approach, and Force Protection Agency prides itself on providing its services with discretion, precision, and poise. Q: What is the biggest challenge of protecting celebrities? Stuart: The very nature of celebrity is visibility and access, which always increases risk. The challenge of protecting a high-profile individual is facilitating that accessibility in a strategic and controlled manner while mitigating risk factors. A client’s personal desires and preferences can often conflict with a lowest risk scenario, so careful consideration and thorough preparation are essential, along with continual communication. Q: How does the approach to protection change from one celebrity (client) to another? What variables impact how you do your job? Stuart: The approach is largely determined by the client’s specific needs, requests and objectives. The circumstances of a client's activities, location, and other associated entities can vastly disrupt operation activities. A client may prefer a more or less obvious security presence, which can impact the quantity and proximity of personnel. Force Protection Agency coordinates extensively with numerous federal, state, and municipal government agencies, which also have a variety of influence depending on the particular locations involved and the specific client activities being engaged in.  Q: Are all your clients celebrities or what other types of "executives" do you protect – and, if so, how are those jobs different? Stuart: Force Protection Agency provides protective services for a wide range of clients, from the world’s most notable superstars to corporate executives and government representatives. We also provide private investigation services for a vast variety of clientele. Force Protection Agency creates customised solutions that surpass each individual client’s needs and circumstances. The differences between protecting a major celebrity or top business executive can be quite different or exactly the same. Although potentially not as well known in popular culture, some top CEOs have a net worth well above many famous celebrities and their security needs must reflect their success. Q: What is the role of technology in protecting famous people (including drones)? Technology is crucial to the success of security operations Stuart: Technology is crucial to the success of security operations and brings a tremendous advantage to those equipped with the best technological resources and the skills required to maximise their capabilities. It affects equipment such as communication and surveillance devices like drones, cameras, radios, detection/tracking devices, GPS, defensive weapons, protective equipment, and more. Technology also brings immense capabilities to strategic planning and logistical operations through the power of data management and is another aspect of Force Protection Agency operation that sets us apart from the competition. Q: What additional technology tools would be helpful in your work (i.e., a “technology wish list”)? Stuart: The rapidly growing and evolving realm of social media is a massive digital battlefield littered with current and potential future threats and adversaries. Most mass shooters as of late have left a trail of disturbing posts and comments across social media platforms and chat rooms that telegraphed their disturbing mindset and future attacks. A tool that could manage an intelligent search for such threats and generate additional intel through a continuous scan of all available relevant data from social media sources would be extremely useful and could potentially save many lives. Q: Anything you wish to add? Stuart: Delivering consistent excellence in protection and security is both a vital need and a tremendous responsibility. Force Protection Agency is proud of their unwavering commitment to “Defend, Enforce, Assist” and stands ready to secure and satisfy each and every client, and to preserve the life and liberty of our nation and the world.

How custom solutions meet customer needs for access control
How custom solutions meet customer needs for access control

The software-based technology running today’s access control systems is ideal for creating custom solutions for very specific end-user needs. Those needs may vary from delaying bar patrons’ access to a shooting range to reducing the risk of diamond miners pocketing precious stones. The ability to tightly integrate with and control video, intrusion, and other equipment puts access control at the heart of enterprise security. Often, off-the-shelf access systems provide most of the features an end user requires, but due to their type of business, facility or location, some organisations still have unaddressed needs. That’s where a custom solution can fulfill an essential task. Custom solutions are frequently requested by end users or the reseller to expand access control to meet those needs. Here’s a look at some custom solutions designed for end users. Area & time-based access control The owners of a popular shooting range also operate an onsite, full-service bar, and the owners wanted to delay entry to the shooting range once a customer had consumed alcoholic beverages at the bar. The custom solution works with the access cards customers use to enter the range. When a patron orders an alcoholic beverage, the bartender presents the patron’s credential to a reader at the cash register.  With each drink, the access control system puts an automatic delay on the card being used to enter the shooting range. An area and time-based control solution was created An area and time-based control solution was created for a major pharmaceutical manufacturer concerned with potential contamination between laboratories testing viral material and others designing new vaccines. If an employee uses a badge to enter a room with viral material, that employee can be denied access to a different area (typically a clean room in this case), for a customised period of time. This reduces the potential of cross contamination between ‘dirty’ and ‘clean’ rooms. The software can be customised by room combinations and times. Random screening A mine operator wanted to prevent easily portable precious stones from being taken by miners. The custom solution uses the access control system integrated with time and attendance software. As the miners clock in, the system randomly and secretly flags a user-defined percentage of them to be searched as their shifts end. Security guards monitor displays and pull selected employees aside.  A nice feature of this solution is that the random screening can be overridden at a moment’s notice. For example, if the process causes excessive delays, guards can override the system to enable pre-selected miners to pass until the bottleneck is relieved. The solution has also been adopted by a computer manufacturer looking to control theft by employees and vendors. Scheduler The system automatically unlocks and locks doors A custom solutions team integrated a university’s class scheduling and access control software to lock doors to classrooms that are not in use. With the custom solution in place, the system automatically unlocks and locks doors 15 minutes prior to and after a class. The doors remain unlocked if the room will be used again within the next 30 minutes. Readers mounted at each door enable faculty to enter rooms early for class setup or to work in a lab knowing students or others won’t be able to walk in. Event management This solution simplifies the visitor check-in process, especially for larger events with multiple guests. Efficiently moving people in and out of events booked at a working intelligent office building and conference center required integrating the access control system with a web-based solution storing the names, email addresses, and phone numbers of invited guests. Before an event, guests receive an email invitation that includes a link to a downloadable smartphone mobile credential. Upon arrival, guests present that credential to Bluetooth readers at the building’s gated parking garage. The same credential enables smaller groups (up to 50 guests) to enter the building through turnstile-mounted readers – also used throughout the day by hundreds of building employees. To avoid long lines for larger groups of visitors, the turnstiles are kept open with security guards using handheld readers to authenticate credentials as guests enter the lobby. Additionally, a third-party emergency notification system was added to this custom solution. Guests receive instructions on their smartphones should there be a need to shelter in place or evacuate during an event. The credentials and notifications are disabled as guests leave the building through the turnstiles. This allows the hospital to maintain a secure environment while providing a simplified, efficient access solution Similar custom solutions have been deployed at hospitals searching for a way to provide secure access to patients only expected to be staying a short time for surgery.  Patients are emailed a mobile credential to access both the hospital’s parking structure and surgical reception area. They can also designate family members and other visitors to receive emailed mobile credentials.  This allows the hospital to maintain a secure environment while providing a simplified, efficient access solution for patients and visitors. Custom solutions are about problem solving. It’s finding answers to needs not specifically addressed by an access control system. The robust software of modern access control systems enables the design of custom solutions to efficiently enhance security, save time and reduce redundant tasks through automated processes.