The merger of physical security and IT is known as convergence
Examining the road to convergence
The use of Internet Protocol (IP) in the security industry is increasing but little is known about the relationship between end users and the merger of traditional physical security and IT otherwise referred to as convergence in the security trade press. Markus Lahtinen of the LUSAX project examines the growth of convergence in the security industry and discusses complexities of this relationship.

The LUSAX project at Lund University in Sweden started in 2006 as a strategic research partnership together with ASSA ABLOY, AXIS Communications and Niscayah, to understand the industrial impact and end user consequences following the increased use of the IP to connect security equipment and transmit security data. The swift use of convergence can be confusing, but three main types of convergence are discerned:

  • Technological convergence: increased use of IP-enabled security equipment and technical integration of physical security systems like access control and video surveillance, as well as potential integration with other operational enterprise systems (for example staff and payroll databases)
  • Organisational convergence: the process of coordinating and integrating internal IT security, logical security and physical security for both efficiency reasons (to lower costs) and effectiveness reasons (for example, to address new organisational risks and threats that require coordination between IT and security)
  • Industry convergence: meaning the suggested merging - or even absorption - of the IT industry with the security industry

At the beginning of the research project, there was a sense of urgency in the security industry to ‘catch up' on the knowledge and efficiency associated with the IT industry. Following the terminology from above, industry convergence would push for both technical and organisational convergence. However, the diffusion pattern has not played out as fast as projected back in 2006. The verdict stands clear that technological convergence ishappening, but at an undetermined and slower pace.

The verdict stands clear that technological convergence is happening, but at an undetermined and slower pace

Despite the industry buzz on convergence, little is known and systematically documented on how security end users actually reason and act in relation to technological change. In order to understand the increased use and diffusion of advanced security technology, it is necessary to survey the preferences held by the end users to the value propositions associated with this new technology.  Yet of equal importance are questions on how security departments organise themselves internally and how they act and behave in relation to their immediate internal and external environments.  In summary, convergence cannot be meaningfully separated from the organisational position held by the security department.

Security directors and the security industry: the relationship myth

Based on survey data and interviews with top-tier security directors, several organisational concerns not previously documented have now been identified. One such organisational finding concerns the relationship between the security director and the security industry with regards to what sources are used to keep informed about industry developments.

The answers suggest that peers, colleagues and internal expert(s) matter more than trade shows, trade press, systems integrators and security consultants in keeping informed about industry development. Further statistical analysis suggests particular importance is given to internal expert(s), suggesting  that the internal expert plays a pivotal role in filtering industry noise and that peers and colleagues play an evaluative role to industry impulses filtered by these internal experts. Also, the internal expert usually collaborates with a security consultant in case of major system upgrades. This means that detailed decisions about security equipment rarely ends up at the security directors' table. This finding contradicts the commonly held view that top-tier security directors interact directly with the security industry.

Security directors recognise the value propositions of IP-based security

A second finding is the overall agreement seen by security directors in relation to the value propositions associated with new technology. Value propositions are understood as what contribution IP-based security may have to the security operations in terms of improved efficiency or increased security effectiveness. One example is scalability, meaning that adding an additional surveillance camera, for instance, does not require any costly back-end upgrades. Also, having security equipment running on the same network enables for integration beyond security purposes - for example real-time connection with the global employee database.

Understanding the organisational tree is key in understanding convergence
Knowing the place of security departments in the organisational tree is important in understanding convergence

Taken together, security directors see the value of security technology and also recognise the associated value propositions, but IP as such is not the primary item for top-tier security directors.

Standing of security departments in the organisational tree

Third and finally, the relationship between the security department and the immediate organisational environment is one sometimes described as being conflicting in the sense that physical security is portrayed only as being a cost-entry without any clear profit contribution. We believe this has mainly been used as industry-driven rhetoric to suggest a scenario of diminishing the importance of the physical security director, further bolstering the sense of urgency around the corner.

Quite the opposite, the collected data suggest physical security to be a well-established business process; and often even externally recognised as being a strategic one at that.

Consequently, the initial view describing the security department as being in an isolated position and a ‘necessary evil' is not shared by security directors. This might partially be attributed to self-preserving views held by the respondents, but too much attention has been directed into this form of simplifying security operations, unfortunately at the expense of understanding the underlying premises under which physical security operates.

Implications of convergence in the security industry

A security operation by its very nature is defensive, risk-averse and reluctant to simplify while strategic business logic often rewards risk-taking with a need to simplify complex market conditions. This implies an inherent and fundamental conflict between security decision logic and general market-oriented business logic that is not to be understood as being problematic, but in the best of cases being mutually rewarding. Management of successful security operations strike a balance between these logics.

The process of convergence will not follow a straight path
The path of convergence will follow a non-linear path

All in all, complex organisational conditions have direct impact on the diffusion speed of new security technology like converged systems. Industry-driven ‘copy and paste' deployment recipes for new technology are less likely to be adopted by advanced end users the same way it happened with the diffusion of core business-supporting software, for example software managing invoicing, inventory, and word processing software; relying only on logical components on standardised input/output hardware. Security systems rely to a greater extent on a combination of logical and less standardised physical hardware. This requires a more advanced input of system integration skills, be it skills for installing low-voltage analogue systems or network and IT skills for networked security systems.

Also, the diffusion pattern depends on the type of end user industry. Retail, for example, has a clear performance metric in the form of shrinkage that ties in directly with deliberate thefts. This enables the security operation to match accrued costs and investments to clear measures on losses. Banking and finance, a sector more regulated than most others, requires advanced security systems, where several subsystems need to be tied together to offer functionality that supports security effectiveness. Hence, procurement and major systems revisions in this sector follow a complex chain of decisions involving resellers, security consultants, architects (in the case of sustainable constructions) and internal security staff such as internal experts.

Having described a selection of organisational considerations affecting the convergence, it stands clear that this process will follow a non-linear path, more so for advanced multi-national end users focused on functionality and security effectiveness than the underlying technology providing for security services. For the same reasons, traditional security suppliers are kept insulated and are still in a position to harness their existing relations with end users. However, as a response to increased demand for converged systems, proactive security suppliers may in the long run increase their know-how and leverage their market position by following an incremental approach by engaging into end user projects requiring hybrid or full IP-based security systems.

Markus Lahtinen Markus Lahtinen
LUSAX project
Lund University
Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version Download PDF version

In case you missed it

Physical security and the cloud: why one can’t work without the other
Physical security and the cloud: why one can’t work without the other

Human beings have a long-standing relationship with privacy and security. For centuries, we’ve locked our doors, held close our most precious possessions, and been wary of the threats posed by thieves. As time has gone on, our relationship with security has become more complicated as we’ve now got much more to be protective of. As technological advancements in security have got smarter and stronger, so have those looking to compromise it. Cybersecurity Cybersecurity, however, is still incredibly new to humans when we look at the long relationship that we have with security in general. As much as we understand the basics, such as keeping our passwords secure and storing data in safe places, our understanding of cybersecurity as a whole is complicated and so is our understanding of the threats that it protects against. However, the relationship between physical security and cybersecurity is often interlinked. Business leaders may find themselves weighing up the different risks to the physical security of their business. As a result, they implement CCTV into the office space, and alarms are placed on doors to help repel intruders. Importance of cybersecurity But what happens when the data that is collected from such security devices is also at risk of being stolen, and you don’t have to break through the front door of an office to get it? The answer is that your physical security can lose its power to keep your business safe if your cybersecurity is weak. As a result, cybersecurity is incredibly important to empower your physical security. We’ve seen the risks posed by cybersecurity hacks in recent news. Video security company Verkada recently suffered a security breach as malicious attackers obtained access to the contents of many of its live camera feeds, and a recent report by the UK government says two in five UK firms experienced cyberattacks in 2020. Cloud computing – The solution Cloud stores information in data centres located anywhere in the world, and is maintained by a third party Cloud computing offers a solution. The cloud stores your information in data centres located anywhere in the world and is maintained by a third party, such as Claranet. As the data sits on hosted servers, it’s easily accessible while not being at risk of being stolen through your physical device. Here’s why cloud computing can help to ensure that your physical security and the data it holds aren’t compromised. Cloud anxiety It’s completely normal to speculate whether your data is safe when it’s stored within a cloud infrastructure. As we are effectively outsourcing our security by storing our important files on servers we have no control over - and, in some cases, limited understanding of - it’s natural to worry about how vulnerable this is to cyber-attacks. The reality is, the data that you save on the cloud is likely to be a lot safer than that which you store on your device. Cyber hackers can try and trick you into clicking on links that deploy malware or pose as a help desk trying to fix your machine. As a result, they can access your device and if this is where you’re storing important security data, then it is vulnerable. Cloud service providers Cloud service providers offer security that is a lot stronger than the software in the personal computer Cloud service providers offer security that is a lot stronger than the software that is likely in place on your personal computer. Hyperscalers such as Microsoft and Amazon Web Service (AWS) are able to hire countless more security experts than any individual company - save the corporate behemoth - could afford. These major platform owners have culpability for thousands of customers on their cloud and are constantly working to enhance the security of their platforms. The security provided by cloud service providers such as Claranet is an extension of these capabilities. Cloud resistance Cloud servers are located in remote locations that workers don’t have access to. They are also encrypted, which is the process of converting information or data into code to prevent unauthorised access. Additionally, cloud infrastructure providers like ourselves look to regularly update your security to protect against viruses and malware, leaving you free to get on with your work without any niggling worries about your data being at risk from hackers. Data centres Cloud providers provide sophisticated security measures and solutions in the form of firewalls and AI Additionally, cloud providers are also able to provide sophisticated security measures and solutions in the form of firewalls and artificial intelligence, as well as data redundancy, where the same piece of data is held within several separate data centres. This is effectively super-strong backup and recovery, meaning that if a server goes down, you can access your files from a backup server. Empowering physical security with cybersecurity By storing the data gathered by your physical security in the cloud, you're not just significantly reducing the risk of cyber-attacks, but also protecting it from physical threats such as damage in the event of a fire or flood. Rather than viewing your physical and cybersecurity as two different entities, treat them as part of one system: if one is compromised, the other is also at risk. They should work in tandem to keep your whole organisation secure.

Video surveillance is getting smarter and more connected
Video surveillance is getting smarter and more connected

The global pandemic has triggered considerable innovation and change in the video surveillance sector. Last year, organisations around the globe embraced video surveillance technologies to manage social distancing, monitor occupancy levels in internal and external settings, and enhance their return-to-work processes. Forced to reimagine nearly every facet of their operations for a new post-COVID reality, companies were quick to seize on the possibilities offered by today’s next-generation video surveillance systems. Whether that was utilising motion sensing technologies to automatically close doors or switch on lighting in near-deserted office facilities. Or checking if people were wearing masks and adhering to distancing rules. Or keeping a watchful eye on streets and public spaces during mandated curfew hours. Beyond surveillance and monitoring use cases, organisations also took advantage of a raft of new Artificial Intelligence (AI) applications to undertake a range of tasks. Everything from automating their building management and optimising warehouse operations, to increasing manufacturing output and undertaking predictive maintenance. Behind the scenes, three key trends all contributed to the growing ubiquity of video surveillance observed in a variety of government, healthcare, corporate, retail, and industry settings. Video surveillance takes to the Cloud Last year the shift to digital working led organisations to rapidly embrace cloud-enabled services, including cloud-hosted Video Surveillance As A Service (VSaaS) solutions that provide tremendous economies of scale and flexibility. Alongside significant cost savings, these solutions make it easier for organisations to enhance their disaster recovery and manage their video surveillance estate in new and highly effective ways. Surveillance cameras with audio recording were used more than 200% by customers between 2016 and 2020For example, in addition to enabling remote access and maintenance, today’s cloud-powered systems eliminate any need to invest in local storage technologies that all too often fail to keep pace with an organisation’s growing data storage requirements. Indeed, data from our worldwide customer base survey reveals how in 2020 an impressive 63% of organisations had abandoned using any on-premises storage option and were instead only storing all their video surveillance recordings and data in the Cloud. A deeper review of the global stats shows that the average cloud recording retention period for this stored data was 28.2 days, with organisations in Asia topping the global average at 38 days – 33% higher than was observed in any other region. Improvements in bandwidth and scalability engendered by the Cloud have also helped boost the growing utilisation of audio recordings in addition to visual image capture. Indeed, our research found the number of surveillance cameras with an audio recording facility used by customers jumped more than 200% between 2016 and 2020. Making sense of Big Data The enhanced ease of connectivity and scalable bandwidth made possible by the Cloud is stimulating more companies to connect a lot more video surveillance cameras to their networks. The top motivation for doing so is to generate live metrics and data that can be utilised to deliver enhanced business insights and operational intelligence. In recent years, a rich choice of video analytics solutions have been developed for a variety of industry verticals. The range of functionalities on offer is impressive and covers a variety of applications. Everything from making it easy to classify and track objects and behaviour patterns in real-time, to undertaking anomaly detection, or generating predictions based on past and present events/activities. Data collected via today’s cloud connected cameras can now also be used to feed deep learning training and AI analytics, utilising the unparalleled virtualised processing capacity of the Cloud to convert Big Data into usable information quickly. By integrating this information with data from other enterprise data capture systems, organisations are now able to gain a 360-degree view of their operations – in almost real-time. IT is now in the driving seat No longer the sole preserve of on-site security staff, the wider application and business use of video surveillance means that IT is increasingly taking the lead role where the management and control of these systems are concerned. IT is asked to integrate video surveillance into key enterprise platforms to generate the data that business leaders need Aside from the fact that IT has a vested interest in addressing the cybersecurity implications that come with attaching a growing range of IoT devices to the enterprise network, they’re also increasingly being asked to integrate video surveillance into key enterprise platforms to generate the data that business leaders need. As organisations expand their integration of video with other business applications, such as point of sale, access control, process control and manufacturing systems, this trend is only set to accelerate. Looking to the future Right now, the video surveillance industry is at a key tipping point, as video systems become increasingly strategic for enabling the enterprise to boost productivity, stay compliant, and fulfil its obligations to protect employees and customers. As the technology’s contribution to enhanced data-driven decision-making and problem solving continues to increase, expect the adoption of IP connected video cameras to burgeon as organisations look to capture more data from their day-to-day business operations.

How has Brexit affected the security industry?
How has Brexit affected the security industry?

When the United Kingdom voted to leave the European Union, a world of uncertainty unfolded for those doing business in the UK and the EU. The referendum was passed in July 2016. Including subsequent delays, the separation was completed after four years in January 2020, with a transition period ending December 2020. Even with the deadlines past, there are still pockets of uncertainty stemming from the separation. We asked this week’s Expert Panel Roundtable: How has Brexit affected the security industry?