Mobile access is probably the largest emerging trend in the security marketplace, but it is only one of several that are changing the face of the access control market. Another factor showing potential to change the market is the emergence of location systems and positioning systems, as reflected by HID Global’s recent acquisition of Bluvision, a provider of real-time location tracking system for assets and employees, and building information modeling (BIM) is impacting how consultants do their jobs. We gathered together several consultants, and a representative of HID Global, to discuss these topics.

Participants were Chris Grniet of Guidepost Solutions, Brandon Frazier of Elert & Associates, Terry Harless of Burns & McDonnell, and Harm Radstaak, HID Global’s Vice President and Managing Director, Physical Access Control.

Future of mobile access technology

SourceSecurity.com: How is mobility affecting end-user implementations and the way you consult? How has Mobile Access technology affected the way you approach projects? 

Chris Grniet: I don’t think I am designing a single project now where we are not using a mobile credential. But the industry has been transitioning slowly to frictionless access. We looked at it 20 to 30 years ago, when we started looking at asset tracking with RFID and antennas around doors, and all of that. We are starting to see new products emerge from HID and others for personnel tracking. I think our society has progressed, and we understand that the electronic component of our lives is attached to us – not embedded yet, but attached. Everybody has that electronic device, and it’s making it a lot easier. We have implemented products for mobile credentialing for large corporations. We are really looking forward to the visitor management component of that. It will make visitor management so much easier. We need to keep it affordable. But it’s going to be there. I am designing projects now with 20 to 30 turnstile entrances to a headquarters building. We are putting in visitor management kiosks. I don’t want a single visitor to have to use those at the end of the day. I want to push the credentials out. Unless they weren’t registered, they should be able to walk through the door because they are a trusted individual. We’re moving toward frictionless access, and that’s a big component of it.  

Terry Harless: Personally, I haven’t had any projects that use any mobile applications as of yet. I have tried to design them on a couple of projects as an alternate, mainly at tech-heavy firms where they understand technology. For the most part, it has always been value-engineered out because of the price, and also because some of these are smaller companies. Some of the mobile applications have larger licence packs, for a hundred or more licences. That’s my experience.

"I think we have yet to see the advantages; people are still imagining what the full potential is of location services"

Brandon Frazier: One of my biggest verticals is higher education. I really see mobile credentials being big in that space. I see students, and they have their phones and a little holder in the back for credit cards, and that’s it. That’s all they have. I think the idea of carrying another student ID won’t fit in the phone. I really see very specific verticals having great benefits from mobile. In terms of master planning, I have seen the cost of entry as being very expensive: the cost of replacing readers, the cost of replacing downstream devices. But if I’m doing large projects, I am always spec’ing in at least the mobile infrastructure, so they can add the credentials later. 

Harm Radstaak: It’s fair to say we have learned a lot as HID in the mobile access space. As a supplier, our operational model behind the scenes has completely shifted from producing a card, encoding a card, shipping a card. Now we are issuing over the air, revoking over the air. Our IT infrastructure and the way we serve end users though our IT infrastructure has had substantial investments. Moving into the mobile access space, the requirements are higher. Is it residing in the cloud? How are we going about compliancy, privacy, security? More important, if it’s residing on your phone, questions are being asked by end users. How trusted is this? All these areas are important for HID. That’s on the operational model. The other challenge we have is the variety of phones across the world. There are development challenges to support a substantial portion of the phones worldwide, and all the diverse operating systems.

Challenges and benefits of location services

SourceSecurity.com: What are your thoughts on location services / indoor positioning services?

Grniet: Indoor positioning services should be integrated into a security platform that is pre-existing in an environment or will be deployed in an environment. There are plenty of location type services out there, whether in hospitals or factories. The signals have to be right, what we’re using as a tracking device has to be right, etc. I see some of the legacy systems laying to waste because it’s an extra set of management tools. So you need integration into the pre-existing or future systems to be deployed. We need to get everything fully integrated in a unified fashion, so we are operating on a single platform without an extraneous management platform. I think we have yet to see the advantages; people are still imagining what the full potential is of location services. It’s going to play into facility usage, area usage, safety, security, mustering; all of those things are going to be very important.

Frazier: I see a lot of potential in specific verticals and employee groups. Let’s use guards as an example: The real-time ability to locate a guard, associate that with nearby assets, using analytics, tying data together, aggregating it, putting that to a body and being able to provide a faster response time. I see that coming, but I think the cost of entry will be too high. I used to do a lot of work in healthcare as well, and the cost of entry is extremely high in tracking services. So we need to find a better way to do it. GPS is great; I don’t know if you can get that in buildings. Adding sensors every 20 feet, triangulation, it’s just not the best solution.

Grniet: With GPS we still have the height issue, especially in tall commercial buildings. So I can tell where you are on the X and Y coordinates, but not on the Z axis. That’s a big challenge. So having that built into a facility, then we can talk about asset security and asset tracking. That will be the fundamental component of how we sell it to the security side of the business.

Radstaak: I think it’s fair to say HID is very excited about location services. It’s one reason we went out to acquire a company like Bluvision. It’s not GPS, but Bluetooth Low Energy (BLE)-enabled location services. This ties into a couple of things we discussed before. You can look at it from a space utilisation perspective or workplace optimisation, or sustainability, for cost savings in a large corporation. We have had discussions in the pre-acquisition phase about how it would fit with our portfolio and our offerings. HID can provide additional physical and security services. For us, it’s a natural extension.

Harless: My experience is in the correctional field, where we have been using [indoor positioning] for 10 to 15 years, either for officer safety or tracking inmates. It hasn’t necessarily been very accurate. You know when a guy walks into a room because you have a detector above the door. The more expensive ones were triangulated, but they were very pricey and unaffordable unless you had some sort of funding. It has been around, and I am glad they are working it into some of the commercial spaces now. It could be very useful.

The industry has been transitioning slowly to frictionless access
Indoor positioning services should be integrated into a security platform that is pre-existing in an environment or will be deployed in an environment

BIM applications and trends

SourceSecurity.com: What are your thoughts on building information modeling (BIM) processes and how important are they for consultants?

Radstaak: As a supplier, we see it as an increasing request and requirement in the consultant space – some regions lead more than others. In the United Kingdom, all critical mass infrastructure projects have to be specified based on the BIM model. So HID and Assa Abloy have invested quite substantially over the last few years in making our products compatible with BIM modeling. We support it with tools such as Assa Abloy Openings Studio. As a supplier, we see it as an important trend and a way we can support the consultant market. 

Harless: For a consultant, it helps tremendously in a couple of ways. First of all, we can pull our building materials straight out of the model. Another thing is, a lot of architects and owners like to walk through buildings and look what’s on the ceilings, on the walls. When you are showing them where the cameras and card readers are going to be (in a BIM model), it’ll give the architects a good idea of what they are going to see when the building actually gets built. They can tell us where to move stuff. 

Grniet: To that end, the inception of BIM wasn’t about 3D modelling in CAD, it was about tracking of assets, and understanding everything that was on the ground. It has taken us into: Where are the intersections on construction, so we don’t have pipes running where ducts should be, and is my security equipment going where glass is? If you couldn’t read the plans, we have a BIM model to show you. You talk about seeing what a building will be like, but clients have a hard time envisioning that, seeing beyond the paper, because they are focused on another business – that’s not what they do. So we are utilising some of the tools being provided out there by firms like HID to put the toolkit for BIM modeling in there. We’re also using it for camera focusing. It helps me get a better idea of what I’m going to see in my final product and then show the client. This is why we are focusing a camera in this area. It goes back to sustainability, asset tracking, maintenance, all those things we have talked about under other product categories. 

"The future will be security of your software, security of your credentials and your card readers"

Frazier:  When BIM is properly implemented, it has made our workflow very efficient. We have found it has been very helpful in our personal design, as Chris said. When we are trying to model a camera, we can see the space. But as a project team architect, if it is not properly implemented or misunderstood, it has created a lot of extraneous tasks for us. And has made us very inefficient. Some people are very good at it, and the process goes really well. Other times we find people concentrate too much on collisions and it doesn’t end up like that in the field, or we design it one way and it ends up another way. It’s very helpful to us in our personal design, but as a project team, it can cause difficulties.  

Grniet: Just to add on to that point: We are still having trouble making the companies that manufacture BIM systems understand security’s role in the overall process. It’s easy for an architect to say I have strikes and hardware sets in my BIM model, but it’s under the architectural model. Security lies in this middle ground. We’re electronics, we’re low-voltage. The intersections, the toolkits, everybody’s got a great Revit model of their product, but it’s not in any of the toolkits. We have to build our own. The industry as a whole has a challenge to find the right place to be. Some people are using the MEP (mechanical, engineering and plumbing) model for Revit, some people are using the architectural model. But we have to build our own toolkits, so it’s still a challenge. 

Harless: At Burns and McDonnell we have it a little easier because we work with our internal architects. So we do have those tools actually built in-house. When we go to an outside or a third-party architect, to MEP firms, we have the same issues. Sometimes they will delete ceilings or walls instead of moving them, and then we have stuff all over the place.

Future trends for physical access and identity technology

SourceSecurity.com: What do you think the identity technology industry as a whole should pay attention to over the next one to three years?  What is your vision for the future in physical access or the office space of the future?

Grniet: It’s about convergence of multiple areas of business, security of that convergence, the identification and the operability, and unified platforms to allow single vision, reduced resources and fully effective control and management of security, life safety, building management, you name it.

Frazier: To sum it up: Cybersecurity and unification will drive migration basically. We need a more cybersecure solution, which will drive migration to other solutions, and that’s when conversations about global, logical security, what else can I do with this? Single sign-on. The big picture will drive a lot of this.

Radstaak: The consolidation of technology from different industries will be substantial. It could come from the IT infrastructure, it might come from identity providers who are not currently operating in the security space. I think we currently don’t see yet the substance and the impact of the data analytics and how we can use that in security and broader applications. The services component will be substantial.

Harless: The future will be security of your software, security of your credentials and your card readers. And integration, integration, integration.

Grniet: And let’s not forget frictionless access.

Read part 3 of our Consultants' Forum series here

Download PDF version

Author profile

Larry Anderson Editor, SecurityInformed.com & SourceSecurity.com

An experienced journalist and long-time presence in the US security industry, Larry is SourceSecurity.com's eyes and ears in the fast-changing security marketplace, attending industry and corporate events, interviewing security leaders and contributing original editorial content to the site. He leads SourceSecurity.com's team of dedicated editorial and content professionals, guiding the "editorial roadmap" to ensure the site provides the most relevant content for security professionals.

In case you missed it

Adapting servers for IP video surveillance systems: Why manufacturers struggle
Adapting servers for IP video surveillance systems: Why manufacturers struggle

Security integrators are often tasked with a multitude of responsibilities which could include a variety of installation, integration or design tasks made up of sprinkler systems, fire alarms, access control, HVAC, video surveillance systems and networks; and then pile on maintenance, training and analytics. Traditionally, most security integrators have installation backgrounds but are now expected to be IT savvy, too. Even the most proficient IT professionals may not fully grasp the complexity of adapting computer servers for use with video systems. It’s not the area of expertise of security integrators as the complexities between IT data and video data are significant. Therefore, security integrators depend on system builders to provide solutions to meet the needs of video systems expertly and with few hassles. It’s a simple enough ask, but not so easy to deliver. Tom Larson, Chief Technology Officer, BCDVideo, lists some of the challenges: The gap between reality and customer expectations End users should expect a security integrator to provide services and a wide product line to ensure the right equipment for any size job Sometimes there is a gap between what a security integrator expects from a video surveillance solution (in terms of validation testing, dependability, technical support) and the performance of available choices, especially in the case of low-cost or generic equipment. Extra service and support are needed to bridge the gap. Unfortunately, some manufacturers entering the market have failed to deliver, and integrators (and their end user customers) have paid a price. The network is often overlooked Security integrators should pay special attention to engineering the network and calculating the bandwidth and storage needed for video projects, especially given how technology evolves so quickly. Security is an appliance-driven business, and integrators who just want to add another server to expand storage or functionality without configuring the network run the risk of i/o bottlenecks and other system failures. End users should expect a security integrator to provide services and a wide product line to ensure the right equipment for any size job. Unfortunately, traditional IT resellers are often married to a singular solution limiting their knowledge of a good fit for the job. Buying a video server based on a low price aggravates the problem, as “Frankensteined” or generic servers tend to generate additional costs over time Servers are mistakenly considered a one-time expense One mistake purchasing agents make and security integrators have a hard time quantifying is viewing video storage as a capital expense (as one more component of a security system) rather than considering ongoing operating expenses. Buying a video server based on a low price aggravates the problem. “Frankensteined” or generic servers tend to generate additional costs over time, such as firmware or supply chain issues, and some systems builders have failed to provide support to offset those costs. In fact, the high costs over time of supporting inexpensive servers have been unsustainable for some system builders, who have left integrators and end users holding the bag, and in some cases, the liability. Adapting to sustainable strategies “Systems builders to the video surveillance market must adapt and invest to meet the demands of security integrators’ expectations, and they need a business model that enables them to provide a substantial level of support and commitment,” says Larson. “Working with high-quality manufacturers and providing tried-and-tested, certified equipment upfront ensures manageable costs over the life of the system. Products that are fully tested and contain no firmware bugs ensure smoother installations. By providing adequate technical support to the security integrator and managing IT variables over the life of the system, the systems builder makes it possible for a security integrator to specify and install a video server as easily as any other system component.” Keeping IT professionals on staff to deal with server issues is cost-prohibitive for security integrators Taking a longer-term view and considering total cost of ownership is a more sustainable strategy for integrators, says Larson. Investing upfront in a higher-quality server is rewarded by dependability and lower service costs over the life of the system. And the lower costs of supporting a higher-quality server create a more sustainable business model for the integrator, thus ensuring the integrator and end user will have ongoing support. Adapting server technology to video applications Security integrators deliver a different skill set than IT integrators, who tend to be more hands-on in terms of updating firmware and providing maintenance. Keeping IT professionals on staff to deal with server issues is cost-prohibitive for security integrators, who therefore depend on systems builders to provide that expertise. They develop a long-term relationship with a systems builder they can depend on to meet their needs for each job. Larson says the best scenario for a security integrator is a combination of a high-quality server systems builder that understands the specific needs of the security integrator market. Adapting server technology to video applications requires knowledge of both disciplines. Dependable technology adapted to the needs of the video channel ensures successful installations and happy, long-term customers.

New Year’s Resolutions to counter web and mobile application security breaches in 2019
New Year’s Resolutions to counter web and mobile application security breaches in 2019

With the coming of a New Year, we know these things to be certain: death, taxes, and… security breaches. No doubt, some of you are making personal resolutions to improve your physical and financial health. But what about your organisation’s web and mobile application security? Any set of New Year’s resolutions is incomplete without plans for protecting some of the most important customer touch points you have — web and mobile apps. Every year, data breaches grow in scope and impact. Security professionals have largely accepted the inevitability of a breach and are shifting their defense-in-depth strategy by including a goal to reduce their time-to-detect and time-to-respond to an attack. Despite these efforts, we haven’t seen the end of headline-grabbing data breaches like recent ones affecting brands such as Marriott, Air Canada, British Airways and Ticketmaster. App-level threats The apps that control or drive these new innovations have become today’s endpoint The truth of the matter is that the complexity of an organisation’s IT environment is dynamic and growing. As new technologies and products go from production into the real world, there will invariably be some areas that are less protected than others. The apps that control or drive these new innovations have become today’s endpoint — they are the first customer touch point for many organisations. Bad actors have realised that apps contain a treasure trove of information, and because they are often left unprotected, offer attackers easier access to data directly from the app or via attacks directed at back office systems. That’s why it’s imperative that security organisations protect their apps and ensure they are capable of detecting and responding to app-level threats as quickly as they arise. It’s imperative that security organisations protect their apps and ensure they are capable of detecting and responding to app-level threats as quickly as they arise In-progress attack detection Unfortunately, the capability to detect in-progress attacks at the app level is an area that IT and security teams have yet to address. This became painfully obvious in light of the recent Magecart attacks leveraged against British Airways and Ticketmaster, among others. Thanks to research by RiskIQ and Volexity, we know that the Magecart attacks target the web app client-side. During a Magecart attack, the transaction processes are otherwise undisturbed Attackers gained write access to app code, either by compromising or using stolen credentials, and then inserted a digital card skimmer into the web app. When customers visited the infected web sites and completed a payment form, the digital card skimmer was activated where it intercepted payment card data and transmitted it to the attacker(s). Data exfiltration detection During a Magecart attack, the transaction processes are otherwise undisturbed. The target companies receive payment, and customers receive the services or goods they purchased. As a result, no one is wise to a breach — until some 380,000 customers are impacted, as in the case of the attack against British Airways. The target companies’ web application firewalls and data loss prevention systems didn’t detect the data exfiltration because those controls don’t monitor or protect front-end code. Instead, they watch traffic going to and from servers. In the case of the Magecart attacks, the organisation was compromised and data was stolen before it even got to the network or servers. Today’s proven obfuscation techniques can help prevent application reverse engineering, deter tampering, and protect personal identifiable information and API communications Best practice resolutions The Magecart attacks highlight the need to apply the same vigilance and best practices to web and mobile application source code that organisations apply to their networks—which brings us to this year’s New Year’s resolutions for protecting your app source code in 2019: Alert The key to success is quickly understanding when and how an app is being attacked First, organisations must obtain real-time visibility into their application threat landscape given they are operating in a zero-trust environment. Similar to how your organisation monitors the network and the systems connected to it, you must be able to monitor your apps. This will allow you to see what users are doing with your code so that you can customise protection to counter attacks your app faces. Throughout the app’s lifecycle, you can respond to malicious behavior early, quarantine suspicious accounts, and make continuous code modifications to stay a step ahead of new attacks. Protect Next, informed by threat analytics, adapt your application source code protection. Deter attackers from analysing or reverse engineering application code through obfuscation. Today’s proven obfuscation techniques can help prevent application reverse engineering, deter tampering, and protect personal identifiable information and API communications. If an attacker tries to understand app operation though the use of a debugger or in the unlikely event an attacker manages to get past obfuscation, threat analytics will alert you to the malicious activity while your app begins to self-repair attacked source code or disable portions of the affected web app. The key to success is quickly understanding when and how an app is being attacked and taking rapid action to limit the risk of data theft and exfiltration. Protecting encryption keys is often overlooked but should be considered a best practice as you forge into the new year with a renewed commitment to app security to ensure your organisation’s health and well-being in 2019 Encrypt Finally, access to local digital content and data, as well as communications with back office systems, should be protected by encryption as a second line of defense, after implementing app protection to guard against piracy and theft. However, the single point of failure remains the instance at which the decryption key is used. Effective encryption requires a sophisticated implementation of White-Box Cryptography This point is easily identifiable through signature patterns and cryptographic routines. Once found, an attacker can easily navigate to where the keys are constructed in memory and exploit them. Effective encryption requires a sophisticated implementation of White-Box Cryptography. One that combines a mathematical algorithm with data and code obfuscation techniques transforming cryptographic keys and related operations into indecipherable text strings. Protecting encryption keys is often overlooked but should be considered a best practice as you forge into the new year with a renewed commitment to app security to ensure your organisation’s health and well-being in 2019. Protecting applications against data breach According to the most recent Cost of a Data Breach Study by the Ponemon Institute, a single breach costs an average of $3.86 million, not to mention the disruption to productivity across the organisation. In 2019, we can count on seeing more breaches and ever-escalating costs. It seems that setting—and fulfilling—New Year’s resolutions to protect your applications has the potential to impact more than just your risk of a data breach. It can protect your company’s financial and corporate health as well. So, what are you waiting for?

How organisations can secure user credentials from data breaches and password hacks
How organisations can secure user credentials from data breaches and password hacks

In the age of massive data breaches, phishing attacks and password hacks, user credentials are increasingly unsafe. So how can organisations secure accounts without making life more difficult for users? Marc Vanmaele, CEO of TrustBuilder, explains. User credentials give us a sense of security. Users select their password, it's personal and memorable to them, and it's likely that it includes special characters and numbers for added security. Sadly, this sense is most likely false. If it's anything like the 5.4 billion user IDs on haveibeenpwned.com, their login has already been compromised. If it's not listed, it could be soon. Recent estimates state that 8 million more credentials are compromised every day. Ensuring safe access Data breaches, ransomware and phishing campaigns are increasingly easy to pull off. Cyber criminals can easily find the tools they need on Google with little to no technical knowledge. Breached passwords are readily available to cyber criminals on the internet. Those that haven’t been breached can also be guessed, phished or cracked using one of the many “brute-force” tools available on the internet. It's becoming clear that login credentials are no longer enough to secure your users' accounts. Meanwhile, organisations have a responsibility and an ever-stricter legal obligation to protect their users’ sensitive data. This makes ensuring safe access to the services they need challenging, particularly when trying to provide a user experience that won’t cause frustration – or worse, lose your customers’ interest. After GDPR was implemented across the European Union, organisations could face a fine of up to €20 million, or 4% annual global turnover Importance of data protection So how can businesses ensure their users can safely and simply access the services they need while keeping intruders out, and why is it so important to strike that balance? After GDPR was implemented across the European Union, organisations could face a fine of up to €20 million, or 4% annual global turnover – whichever is higher, should they seriously fail to comply with their data protection obligations. This alone was enough to prompt many organisations to get serious about their user’s security. Still, not every business followed suit. Cloud security risks Breaches were most commonly identified in organisations using cloud computing or where staff use personal devices According to a recent survey conducted at Infosecurity Europe, more than a quarter of organisations did not feel ready to comply with GDPR in August 2018 – three months after the compliance deadline. Meanwhile, according to the UK Government’s 2018 Cyber Security Breaches survey, 45% of businesses reported breaches or attacks in the last 12 months. According to the report, logins are less secure when accessing services in the cloud where they aren't protected by enterprise firewalls and security systems. Moreover, breaches were most commonly identified in organisations using cloud computing or where staff use personal devices (known as BYOD). According to the survey, 61% of UK organisations use cloud-based services. The figure is higher in banking and finance (74%), IT and communications (81%) and education (75%). Additionally, 45% of businesses have BYOD. This indicates a precarious situation. The majority of businesses hold personal data on users electronically and may be placing users at risk if their IT environments are not adequately protected. Hackers have developed a wide range of tools to crack passwords, and these are readily available within a couple of clicks on a search engine Hacking methodology In a recent exposé on LifeHacker, Internet standards expert John Pozadzides revealed multiple methods hackers use to bypass even the most secure passwords. According to John’s revelations, 20% of passwords are simple enough to guess using easily accessible information. But that doesn’t leave the remaining 80% safe. Hackers have developed a wide range of tools to crack passwords, and these are readily available within a couple of clicks on a search engine. Brute force attacks are one of the easiest methods, but criminals also use increasingly sophisticated phishing campaigns to fool users into handing over their passwords. Users expect organisations to protect their passwords and keep intruders out of their accounts Once a threat actor has access to one password, they can easily gain access to multiple accounts. This is because, according to Mashable, 87% of users aged 18-30 and 81% of users aged 31+ reuse the same passwords across multiple accounts. It’s becoming clear that passwords are no longer enough to keep online accounts secure. Securing data with simplicity Users expect organisations to protect their passwords and keep intruders out of their accounts. As a result of a data breach, companies will of course suffer financial losses through fines and remediation costs. Beyond the immediate financial repercussions, however, the reputational damage can be seriously costly. A recent Gemalto study showed that 44% of consumers would leave their bank in the event of a security breach, and 38% would switch to a competitor offering a better service. Simplicity is equally important, however. For example, if it’s not delivered in ecommerce, one in three customers will abandon their purchase – as a recent report by Magnetic North revealed. If a login process is confusing, staff may be tempted to help themselves access the information they need by slipping out of secure habits. They may write their passwords down, share them with other members of staff, and may be more susceptible to social engineering attacks. So how do organisations strike the right balance? For many, Identity and Access Management solutions help to deliver secure access across the entire estate. It’s important though that these enable simplicity for the organisation, as well as users. Organisations need an IAM solution that will adapt to both of these factors, providing them with the ability to apply tough access policies when and where they are needed and prioritising swift access where it’s safe to do so Flexible IAM While IAM is highly recommended, organisations should seek solutions that offer the flexibility to define their own balance between a seamless end-user journey and the need for a high level of identity assurance. Organisations’ identity management requirements will change over time. So too will their IT environments. Organisations need an IAM solution that will adapt to both of these factors, providing them with the ability to apply tough access policies when and where they are needed and prioritising swift access where it’s safe to do so. Importantly, the best solutions will be those that enable this flexibility without spending significant time and resource each time adaptations need to be made. Those that do will provide the best return on investment for organisations looking to keep intruders at bay, while enabling users to log in safely and simply.