DigiCert + QuoVadis have been certified in the Netherlands and Belgium to provide remote Qualified Electronic Signatures for customers using its cloud-based Digital Signing Service (DSS) platform. QuoVadis, acquired by DigiCert in January 2019, is an accredited Qualified Trust Service Provider (QTSP) in the Netherlands and Belgium under the EU eIDAS regulation 910/2014 and is able to offer EU trust services to all member states, as well as in Switzerland under ZertES. eIDAS Qualified Electroni...
Fugue, the company delivering autonomous cloud infrastructure security and compliance, has announced the release of the Fugue Best Practices Framework to help cloud engineering and security teams identify and remediate dangerous cloud resource misconfigurations that aren’t addressed by common compliance frameworks. Users can deploy the Fugue Best Practices Framework within minutes to improve the security posture of their Amazon Web Service (AWS) cloud environments. Cloud misconfiguration...
Gallagher Security, a division of Gallagher Group, a privately-owned New Zealand company, is a global presence in integrated access control, intruder alarm and perimeter security solutions. Gallagher entered the global security industry in the 1990s with the purchase of security access control business Cardax. In the last several decades, the company has leveraged its experience in electric fence technology to develop a variety of innovative solutions used to protect some of the world's most h...
Crossword Cybersecurity Plc the technology commercialisation company focused solely on cyber security and risk, is pleased to announce that it has signed a Memorandum of Understanding (MoU) with Leonardo MW Ltd, a global high-tech Aerospace Defence and Security company. Crossword is rapidly becoming a pioneer player in the provision of risk assurance systems. Rizikon Assurance allows organisations to assess, assure, visualise and, ultimately, control third party risk. Risk assessment and manag...
Johnson Controls is introducing the Ethos line of multi-tech contactless access readers from WaveLynx Technologies. Ethos readers are equipped with a choice of credential technologies, enabling customers to choose migration paths to deploy secure credentials. WaveLynx Ethos multi-tech contactless access readers feature a modern aesthetic and state-of-the-art feature set. All Ethos readers are capable of reading legacy Proximity credentials, MIFARE DESFire® smart card credentials, LEAF enabl...
Beyond Visual Line of Sight (BVLOS) drone operations are key for future commercial unmanned aerial vehicles (UAV) use cases, including public safety, industrial inspection and urban air mobility. Frequentis has partnered with mobile network connectivity specialist and start-up, Dimetor, to enable network connectivity for command and control (C2) and payload data links to ensure reliable and consistent data sharing. Dynamic and reliable telecommunication data The initial introduction of UAV&rsq...
Panorays, a rapidly growing provider of automated third-party security lifecycle management, unveiled a security intelligence solution known as Dark Web Insights. The new feature enhances Panorays’ award-winning third-party security management solution and serves as an additional layer of cyber security protection. Using Panorays’ Dark Web Insights, companies can now become proactive about knowing in advance of in-the-wild threats to their supply chain. The evaluator company automatically receives a notification when there is abnormal activity on the Dark Web regarding the third party. The new Dark Web feature checks mentions of a company’s third party on hacker forums and other nefarious marketplaces. It provides the ability to monitor potentially malicious hacker chatter about opportunities to target the third party, sell databases of personal information or take advantage of system weaknesses for financial benefit. “With the latest rash of misconfigured servers and data leaks, many companies have discovered too late that a significant breach has occurred,” said Noam Maman, VP Product of Panorays. “Many third-party security solutions assess the attack surface of vendors, but do not venture into the Dark Web. With Panorays, companies receive further necessary visibility into the security posture of their third parties.”
The appointment of Ritesh Deokar is a strategically important move for the company, adding valuable experience and expertise which complement Milestone Systems’ ambitious expansion plans in the region. Ritesh joins the company from a senior management position at Larsen & Toubro Infotech (LTI), where he was responsible for Global Alliances. Prior to that, he was employed as National Alliance manager at Wipro Limited, and has extensive experience working within the ICT sector in India. His diverse background in both technology and security will be of significance to Milestone Systems’ growth in the region. Converged security and technology skillset Jordan Cullis, Director for APAC at Milestone Systems, said of the appointment: “The fact that Ritesh brings a converged security and technology skillset to the company fits perfectly with our needs.” Video management has evolved far past the point where it exists purely as a standalone technology" “Video management has evolved far past the point where it exists purely as a standalone technology, and to fully harness the power of an open VMS platform like Milestone Systems, our leaders need to understand and work with the myriad of technologies that integrate with our solutions.” Ritesh received his MBA from Nagpur University, and is fluent in four languages: Hindi, English, Kannada and Marathi. He will be based in Bengaluru. Video management and surveillance industry Milestone Systems has committed to an ambitious growth strategy in the region, backed by a global plan to increase their innovation capacity by 45 percent. “I am very excited to come to a leading global company like Milestone Systems, at a time when there is so much happening in the video management and surveillance industry in India.” “There is enormous potential for Milestone Systems’ open platform VMS solution and my extensive contacts across the IT and security markets here will certainly give us some great scope to forge new alliances, build new solutions and really take the company forward across the region,” said Ritesh Deokar.
Highfield Qualifications has been approved to deliver end-point assessment (EPA) for the Security First Line Manager apprenticeship standard. It brings the total number of standards the organisation is approved to deliver EPA for to 34, with 3 standards in the Protective Services suite. Delivering apprenticeship assessments under its Highfield Assessment brand, the organisation is promising employers a full range of assessment services, support and advice to help them make the most of their apprenticeship levy contributions or funding, while supporting their apprentices to achieve their goals. Careers in security management The Security First Line Manager apprenticeship standard provides apprentices with the skills and knowledge to manage people working specifically in security environments such as the private security industry, MOD, event security, in-house security and transport and border security. It also offers a vocational route into careers in security management (excluding close protection). Most employers are now aware of the opportunities available through the changes to apprenticeships" Jason Sprenger, Highfield Chief Executive, said, “Most employers are now aware of the opportunities available through the changes to apprenticeships. However, while the security sector is one of the biggest adopters of vocational qualifications, especially where they are licence-linked, it has sometimes been difficult in the past to apply the traditional approach to apprenticeships.” Full range of consultancy He added, “We’d urge the security sector not to miss out. Highfield’s approach has been to do the hard work, so employers don’t have to.” “As the leading awarding organisation in the security sector and one of the most experienced end-point assessment organisations, we are well placed to offer a full range of consultancy and advice to organisations making sense of the changes, whether that is to take on take on apprentices for the first time, have their existing in-house training recognised, or to find services to ensure they claim their full share of funding entitlement.”
Crossword Cybersecurity plc has announced the availability of Rizikon Assurance 2.0, an online solution to the problem of third-party risk. The new version allows organisations to visualise all risks for each third-party through fully customisable 360-degree supplier scorecards. The new Third-party Assurance Framework Dashboard – an industry first – gives Supplier Management teams, Chief Risk Officers and senior executives a complete understanding of third-party risks across their supply chain, helping identify problem areas and prioritise remedial action. Every day there is a new report of a third-party (often a supplier) causing financial, reputational or regulatory harm to a company – this could be a data breach, an issue with child labour, a missed delivery date, or a safety problem. Rizikon Assurance helps companies address the pressure from Regulators, Auditors, Compliance professionals and customers to improve third-party assurance & risk management. It supports the Rizikon Supplier Assurance Framework, an optional, technology independent, methodology for organising, managing and measuring third-party risks. Controlling third-party risk with assessments Rizikon Assurance 2.0 is now fully integrated with data sources from Companies House and credit ratings via CreditsafeRizikon Assurance helps organisations take control of third-party risk with secure online assessments in their own branded portal, automated assessment scoring and workflows. Both standard and customised assessments are securely sent to third parties; once submitted online they are automatically scored, and can be manually rescored by ‘Assessors’, who can flag answers and return them for more detail or improved responses. Procurement and Supplier managers and executives can then instantly use data to understand the risks associated with that supplier, a specific risk area, or across the whole business. Rizikon Assurance 2.0 is now fully integrated with data sources from Companies House and credit ratings via Creditsafe. This means that Suppliers can be verified against registered information, and limits financial exposure by giving finance and procurement teams instant access to the financial risk data for all suppliers in the Creditsafe database of over 320 million companies. Credit risk can now be viewed alongside all other areas of Supplier risk (Cyber, GDPR, Continuity, etc.) on a single scorecard. 360-degree view of third-party risk Scorecards give an at-a-glance 360-degree view of third-party risk in a context defined by the customerNew Rizikon Assurance Scorecards allow customers to see all risks for each third-party with combined risk information from the Assessments they have completed on multiple topics, as well as data from Companies House and credit-scoring from Creditsafe. Scorecards give an at-a-glance 360-degree view of third-party risk in a context defined by the customer, as each scorecard segment and weighted risk calculation is customisable. The industry-first Assurance Framework Dashboard gives executives and risk professionals a top-level view of all risks across all third parties, organised by ‘Impact levels’. It allows them to quickly focus on high ‘criticality’ third parties needing the most attention and drill-down into those risks. The dashboard also highlights where assurance information gaps exist, which may leave a company exposed. SaaS platform with two-factor authentication Rizikon Assurance comes with a growing library of standard assessments that organisations can use to support third-party assurance covering areas including Cyber Security, Modern Slavery, Anti Bribery & Corruption, GDPR and Minimum Wage legislation. These can be combined with customised assessments based on a customer’s own tried and tested question sets. Security features include two-factor authentication and 256-bit end-to-end encryptionDelivered as a SaaS platform, the installation and hosting, maintenance, support and security of Rizikon Assurance is taken care of by the Crossword Cybersecurity team, reducing both risk and total cost of ownership. Security features include two-factor authentication and 256-bit end-to-end encryption. All data is hosted in the UK across multiple data centres. Third-party assurance and risk management Jake Holloway, Director responsible for Rizikon Assurance, commented: “Despite third-party risks being one of the top enterprise risks for any large company or organisation, third-party risk assurance is often under resourced and simply not visible at board level in the same way as other areas, such as global trade policy or cyber security. “The Rizikon Supplier Assurance Framework and Rizikon Assurance 2.0 give companies a methodology and software platform that improves third-party assurance and risk management through efficiency, automation and better visibility of risk areas and individual suppliers. Finally, boardrooms can answer the question ‘How much third-party risk do we have and exactly where is it?’”
AlgoSec, the provider of business-driven network security management solutions, has introduced extended support for Cisco ACI SDN deployments, and enhanced application visibility and network auto-discovery features in the new version of its core Network Security Management Suite. The new AlgoSec A30 release delivers new automation capabilities that enable seamless, zero-touch security management across SDN, cloud and on-premise networks. This gives enterprises the most comprehensive visibility and control over security across their entire hybrid environment. AlgoSec security management features Key new features in AlgoSec security management suite version A30 include: Extended support for Cisco ACI AlgoSec security management A30 delivers full end-to-end automation of security change management processes for Cisco ACI environments – from planning, risk and compliance checks, to deployment directly onto the device – with zero touch, in a fully automated and secured workflow. Security and IT teams can create new contracts and filters directly on Cisco APIC. Enhanced business-driven application visibility and network auto-discovery AlgoSec security management A30 features the new AppViz add-on, which enhances application visibility and network auto-discovery to dramatically accelerate identification and mapping of the network attributes and rules that support business-critical applications. This speeds up organisations’ ability to make changes to their applications across any heterogeneous on-premise and cloud platform, and to troubleshoot network and change management issues across the entire enterprise environment – ensuring continuous security and compliance. Automatically push network-wide policy changes with AppChange AlgoSec’s new AppChange add-on is available in A30, which automatically updates network security policy changes on all relevant devices across the entire hybrid enterprise network, realising significant time savings for IT and security teams and eliminating manual errors. Security zone enhancements AlgoSec security management A30 enables teams to easily visualise network security zones, and to select risk profiles for each zone to support decision-making for both application owners and security managers. This makes application provisioning and deployment easier, and accelerates planning and implementing network micro-segmentation strategies to enhance security network-wide. SDN and cloud environment “Organisations need to be able to make changes to their core applications quickly to stay competitive, and security teams have to deliver those changes at the speed of business, without impacting security or compliance. This is especially critical as companies implement digital transformation initiatives and migrate their business applications to SDN and cloud environments,” said Eran Shiff, AlgoSec VP Product. “The new features in AlgoSec A30 version make it even easier for security and IT teams to quickly plan, assess and automatically make changes across their entire environment, to maximise business agility, while ensuring security and compliance is never compromised.” The AlgoSec Security Management Suite version A30 is generally available.
Radiflow, a provider of industrial cybersecurity solutions for industrial automation networks, and Industrial Technology Systems (ITS), a specialist independent systems integrator, jointly announced that ITS is adding new OT cybersecurity services for preventing business interruption for its process manufacturing customers based on Radiflow’s portfolio of industrial cybersecurity technologies. ITS is a specialist, independent system integration firm in the UK focusing on process control and management information system solutions for regulated industries. The company has extensive experience working on engineering projects with industrial enterprises in the chemical, pharmaceutical, medical device, nuclear and other heavily regulated industries. Offering OT cybersecurity services ITS will be using Radiflow’s iSID Industrial Threat Detection System to map the industrial assets of its customersRecently, ITS has experienced an increased demand for engineering projects involving the integration of the IT and OT networks of its manufacturing customers. While these IT-OT merger projects deliver customers numerous benefits in terms of operational productivity, these customers are now exposed to a new set of cybersecurity risks that threaten to interrupt the newly integrated business and manufacturing processes in their OT environments. To protect against the new vulnerabilities resulting from these IT-OT merger projects, ITS has identified an attractive market opportunity to offer OT cybersecurity services. To capitalise on this market opportunity, ITS has partnered with Radiflow and will offer these new services based on the company’s portfolio of industrial cybersecurity technologies. In particular, ITS will be using Radiflow’s iSID Industrial Threat Detection System to map the industrial assets of its customers, monitor the network for anomalies and detect and respond to security breach alerts. Real-time detection of anomalies “Radiflow’s portfolio of game-changing industrial cybersecurity technologies empowers us to offer a new set of valuable services for our customers to maintain complete visibility and control of their OT and IT networks,” explained Mark Taylor, Director of Business Development at ITS. ITS anticipates that these new OT cybersecurity services will create jobs involving the assessment process “The Radiflow technologies give us the essential tools to detect anomalies in real-time to the operations of a network and implement the appropriate measures to protect the facilities of customers from any cybersecurity weaknesses or vulnerabilities that could be exploited by malicious third parties.” ITS anticipates that these new OT cybersecurity services will create jobs involving the assessment process, implementation of remedial work and continuous monitoring and improvement of customer systems. Addressing the risks of business interruption “As we ramp up our presence in the process manufacturing space, we are seeing more and more system integrators, MSSPs and end users looking for OT cybersecurity solutions to address the risks of business interruption in operational environments,” said David Moss, Vice President of Sales at Radiflow. “We have strong expectations for building a long term relationship with ITS and playing a significant role in helping the company better serve its customers.”
Rodrigue Zbinden, CEO at Morphean, discusses the business benefits from merging video surveillance and access control technologies as demand for ACaaS grows. The big question facing businesses today is how they will use the data that they possess to unlock new forms of value using emerging technologies such as the cloud, predictive analytics and artificial intelligence. Some data is better utilised than others: financial services were quick to recognise the competitive advantages in exploiting technology to improve customer service, detect fraud and improve risk assessment. In the world of physical security, however, we’re only just beginning to understand the potential of the data that our systems gather as a part of their core function. Benefits of ‘Integrated access control’ The first thing to look for is how multiple sources of data can be used to improve physical security functionsWhat many businesses have yet to realise is that many emerging technologies come into their own when used across multiple sources of data. In physical security, for example, we’re moving from discussions about access control and CCTV as siloed functions, to platforms that combine information for analysis from any source, and applying machine learning algorithms to deliver intelligent insights back to the business. ‘Integrated access control’ then looks not just to images or building management, but to images, building management, HR databases and calendar information, all at the same time. And some of the benefits are only now starting to become clear. The first thing to look for, of course, is how multiple sources of data can be used to improve physical security functions. For example, by combining traditional access control data, such as when a swipe card is used, with a video processing platform capable of facial recognition, a second factor of authentication is provided without the need to install separate biometric sensors. CCTV cameras are already deployed in most sensitive areas, so if a card doesn’t match the user based on HR records, staff can be quickly alerted. Making the tools cost-effective In a similar vein, if an access card is used by an employee, who is supposed to be on holiday according to the HR record, then video data can be used to ensure the individual’s identity and that the card has not been stolen – all before a human operator becomes involved. This is driving growth in ‘access control as a service’ (ACaaS), and the end-to-end digitalisation of a vital business functionThese capabilities are not new. What is, however, is the way in which cloud-based computing platforms for security analytics, which absorb information from IP-connected cameras, make the tools much more cost effective, accessible and easier to manage than traditional on-site server applications. In turn, this is driving growth in ‘access control as a service’ (ACaaS), and the end-to-end digitalisation of a vital business function. With this system set up, only access control hardware systems are deployed on premise while the software and access control data are shifted to a remote location and provided as a service to users on a recurring monthly subscription. The benefits of such an arrangement are numerous but include avoiding large capital investments, greater flexibility to scale up and down, and shifting the onus of cybersecurity and firmware updates to the vendor. Simple installation and removal of endpoints What’s more, because modern video and access control systems transmit data via the IP network, installation and removal of endpoints are simple, requiring nothing more than PoE and Wi-Fi. Of all the advantages of the ‘as a service’ model, it’s the rich data acquired from ACaaS that makes it so valuable, and capable of delivering business benefits beyond physical security. Managers are constantly looking for better quality of information to inform decision making, and integrated access control systems know more about operations than you might think. Integrating lighting systems with video feeds and access control creates the ability to control the lightsRight now, many firms are experimenting with ways to find efficiencies and reduce costs. For example, lights that automatically turn off to save energy are common in offices today, but can be a distraction if employees have to constantly move around to trigger motion detectors. Integrating lighting systems with video feeds and access control creates the ability to control the lights depending on exactly who is in the room and where they are sitting. Tracking the movement of employees Camera data has been used in retail to track the movement of customers in stores, helping managers to optimise displays and position stocks. The same technology can be used to map out how employees move around a workspace, finding out where productivity gains can be made by moving furniture around or how many desks should be provisioned. Other potential uses of the same data could be to look for correlations between staff movement – say to a store room – and sales spikes, to better predict stock ordering. What makes ACaaS truly exciting is it is still a very new field, and we’re only just scratching the surface of the number of ways that it can be used to create new sources of value. As smart buildings and smart city technology evolves, more and more open systems will become available, offering more ways to combine, analyse and draw insights from data. Within a few years, it will become the rule, rather than the exception, and only grow in utility as it does.
The Security Industry Association (SIA) looks forward to 2019, and it is apparent that physical security is moving into its most formative years. Changes presented by emerging technology, open systems and growing connectivity among devices and sensors will make a big difference for manufacturers, systems integrators/dealers and end users. With a more open, connected environment come cyber risk and data privacy concerns – which is why, in SIA’s 2019 Security Megatrends, cybersecurity’s impact on the physical security industry ranks number one on the list. Cybersecurity is affecting all areas of the industry landscape, from security implementation to attracting top talent to the workforce. Digital transformation The digital transformation we are experiencing impacts many other parts of the security industry as well, bringing opportunities like evolving identity management and collecting and delivering big data to customers. At this critical point in the industry’s development, it is important to embrace change, leverage disruptive technology in ways that give companies a competitive advantage. To determine this year’s Megatrends, SIA surveyed hundreds of executives from member companies To determine this year’s Megatrends, SIA surveyed hundreds of executives from member companies, along with current and recent Securing New Ground speakers and attendees, to identify which previous trends were still relevant, which trends were no longer as impactful and which broad trends should be added to our report. This year’s Security Megatrends 1. Cybersecurity’s Impact on Physical Security: It is important to prioritise cybersecurity for your business, your customers’ business and the vendors with which you work. This trend calls for continual process improvement and investment. 2. Internet of Things (IoT) and the Big Data Effect: The security industry makes use of IoT, analytics, artificial intelligence (AI), robotics and more, and data is coming from everywhere. The industry now faces the challenge of effectively managing and segmenting this information to be pertinent to the user. 3. Cloud Computing: Cloud platforms and applications are becoming prevalent across security solutions. This technology helps security integrators provide managed services and the advantages of off-site systems and services to customers. 4. Workforce Development: With historically low unemployment, finding skilled employees is a challenge to the whole security industry. Security stakeholders need talent with IT, cybersecurity, AI and even privacy expertise, presenting a need to grow students’ interest in the industry. 5. AI: Research firm Gartner predicts a new “democratisation of AI” that will impact more organisations than ever before. Companies are now testing this technology before offering it to customers and exploring how AI data can be used to improve security threat assessment and response. 6. Emphasis on Data Privacy: Growing connectivity brings new concerns over data privacy. Finding the balance between security and convenience is a dilemma the industry must now address. 7. Move to Service Models: The newest home security technologies are strongly impacting installing companies. Systems integrators must find ways to focus on services customers want and need and move to managed service models to make up revenues. 8. Security Integrated in Smart Environments: As everything becomes connected, smart environments will begin to proliferate. Buildings and cities are becoming more conscious, with connected systems now able to automatically respond to and even anticipate the needs of facility users and citizens. We must continue to find ways to make these environments smarter and safer. 9. Identity of the Future: With facial and voice recognition and biometrics growing in popularity and appeal, how will we enter buildings and access networks tomorrow? The industry will anticipate and adapt to constant technological change in identity and visitor management. 10. Impact of Consumer Electronics Companies: The influx of consumer electronics companies and DIY systems means changing rules and players in the security industry. This disruption presents both challenges and opportunities for security companies.
Edward Snowden’s name entered the cultural lexicon in 2013, after he leaked thousands of classified National Security Agency documents to journalists. He’s been variously called a traitor, a patriot, a revolutionary, a dissident and a whistleblower, but however you personally feel about him, there’s one way to categorise him that no one can dispute: He’s a thief. There’s no doubt about it: Snowden’s information didn’t belong to him, and the scary truth is that he is neither the first nor the last employee to attempt to smuggle secrets out of a building – and we need to learn from his success to try to prevent it from happening again. Since the dawn of the digital age, we’ve fought cyber pirates with tools like firewalls, encryption, strong passwords, antivirus software and white-hat hackers. But with so much attention on protecting against cyber risks, we sometimes forget about the other side of the coin: the risk that data will be physically removed from the building. Douglas Miorandi, director of federal programs, counter-terrorism and physical data security for Metrasens, recently discussed the major risks to physical data security with SourceSecurity.com. Q: What do you believe are the main physical threats to data? The biggest threats I have seen in the physical data security space have varied over the years, but there are four specific risks that remain the same across the board for any organisation, which are: Every organisation is at risk of having data walk out the building with that employee The Insider Threat The Outsider Threat The Seemingly Innocent Personal Item Poor or Nonexistent Screening To beginning with, every company or government agency has at least one disgruntled employee working for them, whether they know it or not, and that means every organisation is at risk of having data walk out the building with that employee. That is what security experts call the insider threat. Q: What do you think influences employees to steal data from their own organisation? People steal data from their workplaces because they see some means to an end, whether it’s to expose something embarrassing or damaging due to a personal vendetta, or because they can sell it to a competitor or the media and benefit financially – meaning they don’t even need to be disgruntled; they might just want a quick way to make a buck. Financial data, too, is attractive, both for insider trading and selling to the competition. People steal data from their workplaces because they see some means to an end, whether it’s to expose something embarrassing or damaging due to a personal vendetta, or because they can sell it to a competitor or the media and benefit financially This can happen to both private companies as well as government agencies. Take Natalie Mayflower Sours Edwards for example, a Treasury Department employee who was caught in the act just last month, when she disclosed sensitive government information about figures connected to the Russia investigation to a reporter. She didn’t hack the system, she simply used a flash drive. And let’s not forget that Snowden was a contractor working for the NSA. Q: Many of us think of security threats coming from an outsider, do companies still face these type of threats? Yes. Unfortunately, organisations do not only need to worry about their own employees – companies and government agencies need to be wary of threats from outsiders. COTS devices include SD cards, external hard drives, audio recorders and even smart phones They can come in the form of the corporate spy – someone specifically hired to pose as a legitimate employee or private contractor in order to extract information – or the opportunistic thief – a contractor hired to work on a server or in sensitive areas who sees an opening and seizes it. Either one is equally damaging to sensitive data because of the physical access they have. Q: Whether it be an insider threat or an outsider threat, what are ways these individuals can steal sensitive data? There are two types of personal items that can be used to steal data: the commercially available off-the-shelf (COTS) variety, and the intentionally disguised variety. This is considered risk number three – the seemingly innocent personal item. COTS devices include SD cards, external hard drives, audio recorders and even smart phones, any of which can be used to transport audio, video and computer data in and out of a building. Intentionally disguised devices are straight out of the spy novel; they could be a recording device that looks like a car key fob, or a coffee mug with a USB drive hidden in a false bottom. Intentionally disguised devices are straight out of the spy novel; they could be a recording device that looks like a car key fob, or a coffee mug with a USB drive hidden in a false bottom Q: What is the difference between COTS and disguised devices? The difference between COTS and disguised devices is that if someone gets caught with a COTS device, security will know what it is and can confiscate it. The disguised device looks like a security-approved item anyone could be carrying into the workplace, making it especially devious. Sometimes these devices don’t just function to bring information out of a building; they are used to damage a server or hard drive once it’s plugged in to a computer or the network. Some are both – a recording device that extracts data and then destroys the hard drive. Companies with airtight cyber security protocols can sometimes fall down when it comes to physically screening peopleQ: With these types of discrete items, can security personnel still catch individuals in the act? For example, through security screenings? Poor or nonexistent screening is the most substantial security threat to any organisation when it comes to sensitive data. Whether it’s an employee, an outside contractor or a device, the physical security risks are real, and everyone and everything entering and leaving a building needs to be screened. Unfortunately, screening often isn’t occurring at all, or is ineffective or inconsistent when it does occur. Even companies with airtight cyber security protocols can sometimes fall down when it comes to physically screening people and stopping them from stealing data through recording devices. Q: It’s surprising that so many organisations would neglect physical security when protecting their data. It’s a huge mistake, and the consequences can be dire. They range from loss of customer trust, exorbitant lawsuits and tanking stock prices in the private sector; and risks to national security in the public sector. Costs and resource allocation increase as well during efforts to reactively fix or mitigate the effects of physically stolen data. For both the private and public sectors, the risk for data to be physically removed from a building has never been greater. Years ago, it was much harder for the average Joe to figure out where they could sell stolen data. Now, with the Deep Web, anyone with Tor can access forums requesting specific information from competing spy agencies, with instructions on how to deliver it, greatly reducing the risk of getting caught – and increasing the likelihood people will try it. Although it’s getting easier to sell data, the good news is that all of these threats are avoidable with the right measures. Physical data security and cybersecurity must be considered the yin and yang of an airtight policy that effectively protects sensitive or confidential assets from a malicious attack Q: So how can an organisation protect against these risks? There are a number of ways – and the first one requires a change of mindset. Not long ago, the building/physical security department and the IT/cybersecurity department were considered two different entities within an organisation, with little overlap or communication. Organisations now are realising that, because of the level of risk they face from both internal and external threats, they must take a holistic approach to data security. Physical data security and cybersecurity must be considered the yin and yang of an airtight policy that effectively protects sensitive or confidential assets from a malicious attack. Q: How can companies and government agencies combine both physical data security and cybersecurity initiatives? Physical security managers can advise cybersecurity managers on ways to reinforce their protocols – perhaps by implementing the newest surveillance cameras in sensitive areas, or removing ports on servers so that external drives cannot be used. Organisations need to create an effective program and ensure it stays effective so people know it’s not worth the hassle to try In turn, the cybersecurity team can let the physical security team know that they have outside contractors coming in to work on the server, and the physical security team can escort the contractors in and stand guard as they work. Constant communication and a symbiotic relationship between the two departments are crucial to creating an effective holistic security protocol and, once you’ve got the momentum going, don’t let it slow down. Sometimes efforts start off strong and then peter out if priorities change. When guards are down, it’s an excellent time for a malicious actor to strike. Organisations need to create an effective program and ensure it stays effective so people know it’s not worth the hassle to try. It’s not just about the mentality, though. Using the right technology is just as important. Q: What type of technology can you use to protect physical data? Many problems can be avoided by simply using the right technology to detect devices that bring threats in and carry proprietary information out. Electronics such as hard drives, cell phones, smart watches, SD cards and recording devices have a magnetic signature because of the ferrous metals inside them. Using a ferromagnetic detection system (FMDS) as people enter and exit a building or restricted area means that anything down to a small microSD card triggers an alert, allowing confiscation or further action as needed. Electronics such as hard drives, cell phones, smart watches, SD cards and recording devices have a magnetic signature because of the ferrous metals inside them Q: How does FMDS work? In the most basic terms, FMDS uses passive sensors that evaluate disturbances in the earth’s magnetic field made by something magnetic moving through its detection zone. Nothing can be used to shield the threat, because FMDS doesn’t detect metallic mass; it detects the magnetic signature, down to a millionth of the earth’s magnetic field. FMDS is the most reliable method of finding small electronics items and should be part of the “trust, but verify” model Although it is a passive technology, it is more effective and reliable than using hand wands or the walk-through metal detectors typically seen in an airport, which cannot detect very small ferrous metal objects. FMDS can see through body tissue and liquids, so items cannot be concealed anywhere on a person or with their belongings. Whether or not the items are turned on doesn’t matter; FMDS doesn’t work by detecting a signal, but rather by spotting the magnetic signature that electronics contain. This is ideal, because most recording devices do not emit any signal whatsoever. In my experience, FMDS is the most reliable method of finding small electronics items (as well as other ferrous metal objects, like weapons), and should be part of the “trust, but verify” model, in which companies assume the best of their employees and anyone else entering the building, but still take necessary precautions. Q: What are the key takeaways for organisations looking to enhance data security? The toughest challenge in the security sector – whether it’s cyber or physical – is remembering that the bad guys are constantly looking for ways to slip in through the cracks, and security departments need to stay one step ahead to ward off both internal and external threats. Recognising the existing threats, putting together a holistic security strategy, and using the right technology to detect illicit devices comprises an effective three-pronged approach to protecting an organisation’s data. Organisations cannot afford to be passive about security and assume employees won’t steal data and spies won’t sneak in. Strong countermeasures are necessary because data loss can come from both inside and outside, in both private and public sectors, from places not everyone thinks of – and with technology like FMDS acting as a backup to the human element, organisations can lock down their data and keep the wolves in sheep’s clothing from getting through the door.
The ban on U.S. government usage of Chinese-made video surveillance products was signed into law last year and was scheduled to take effect a year later – on August 13, 2019. With that deadline looming, there are questions about whether government agencies and departments will comply in time. A year ago, the U.S. Congress passed, and the President signed, a ban on government uses of video surveillance equipment produced by two of the world’s top manufacturers – Hikvision and Dahua. The provision was buried in the National Defense Authorization Act (NDAA) for fiscal year 2019, which the President signed into law on August 13, 2018. The ban, which takes effect ‘not later than one year after … enactment’, applies not only to future uses of Dahua and Hikvision equipment but also to legacy installations. Tracking software to detect banned products Forescout Technologies, San Jose, California, provides software to track various banned devicesThe bill calls for an assessment of the current presence of the banned technologies and development of a ‘phase-out plan’ to eliminate the equipment from government uses. One problem is identifying where the surveillance equipment is being used, which involves either a tedious manual process to search out the equipment or the installation of tracking software to identify it on the network. A federal Department of Homeland Security program called ‘Continuous Diagnostics and Mitigation’ requires use of a detection tool to find any banned products on a network. Forescout Technologies, San Jose, California, provides software to track various banned devices, but not all required agencies have complied with a mandate to secure their networks by tracking every connected device (only 35% had complied as of 2018.) “Without an automated, real-time tool that can detect all of the IT devices – computer or ‘other’ – on your network, there is simply no way to be 100 percent certain that you are compliant with these product bans,” says Katherine Gronberg, Forescout’s Vice President, Government Affairs. Difficult to determine device’s manufacturer Not all equipment is marked to identify its manufacturer; some has been rebrandedAnother problem is the existence of OEM agreements and other supply chain complications that can make it difficult to determine the manufacturer of any given device. A report by Bloomberg says: “A complex web of supply chain logistics and licensing agreements makes it almost impossible to know whether a security camera is actually made in China or contains components that would violate U.S. rules.” Not all equipment is marked to identify its manufacturer; some has been rebranded. “There are all kinds of shadowy licensing agreements that prevent us from knowing the true scope of China’s foothold in this market,” said Peter Kusnic, a technology writer at business research firm The Freedonia Group. “I’m not sure it will even be possible to ever fully identify all of these cameras, let alone remove them. The sheer number is insurmountable.” Companies banned under NDAA The NDAA ban covers “public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.” It bans “video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, [and] Dahua Technology Company (or any subsidiary or affiliate of such entities).” Hytera Communications is a Chinese digital mobile radio manufacturer. Huawei Technologies Co. equipment has also been banned, including the HiSilicon chips widely used in video cameras. In addition to banning the Chinese equipment in government installations, the NDAA also includes a ‘blacklist’ provision [paragraph (a)(1)(B)], which could be interpreted to extend the ban to companies that use Chinese-made products in other, non-government applications. Rulemaking on that aspect is still under way, including a public hearing in July.
Unmanned aerial vehicles (UAVs), or drones, present a range of threats, from the careless and clueless to the criminal. While many incidents may seem harmless, the threat to any location at any time depends on a range of factors. Drones are inexpensive for criminals to buy or make, and there are continuously improving battery, airspeed, and payload capabilities. UAVs can also fly without an RF signal to jam or hack. Fortunately, sensor technologies including radar are available for security agencies and personnel to protect assets and the public. Radio-wave signals Radar works as a deterrent by sending out a radio-wave signal using a transmitter antenna, and a small portion of that signal reflects off objects in its path and returns to a receiver antenna. The highest performing radars use an antenna technology called Active Electronically Scanning Array (AESA), which enables all-electronic reconfiguration of the antennas. When an AESA radar detects an object, it can ‘focus’ its antennas to track the object, in much the same way as the zoom on a camera does. Multiple objects can be tracked while continuing to scan. Kirkland, Washington-based Echodyne offers a radar product that brings these ESA capabilities to non-military security applications at commercial price points. Combining proprietary hardware with intelligent software, Echodyne produces a compact, solid-state, electronically scanning array Echodyne’s ESA radar Echodyne says they are reinventing radar price-performance for security applications in the ground (people, vehicles) or air (counter-UAS) domains. Combining proprietary hardware with intelligent software, Echodyne produces a compact, solid-state, electronically scanning array (ESA) radar that is affordable for commercial, law enforcement, and governmental customers. The company is backed by high profile investors, including Bill Gates, Madrona Venture Group, Vulcan Capital, NEA, and Lux Capital. “Radar is a sensor,” says Leo McCloskey, Echodyne VP Marketing. “It is most applicable when security professionals can both understand its capabilities and define risk assessment and deployment requirements that call for those capabilities. Our customers are primarily security system integrators and consultancies, which integrate the performance of radar into a sensor array that meets mission requirements.” Radar technology for border surveillance Echodyne was selected by the Science and Technology Directorate of the Department of Homeland Security (DHS) for its Silicon Valley Innovation Program (SVIP) to demonstrate the performance of its radar technology for border surveillance applications. The radar was deployed both in fixed remote surveillance towers and as a lightweight rapid deployment kit for field agents. Able to surveil ground and air domains, the radar combines versatility and commercial price with surveillance capabilities. “We set out to build the world’s best compact, solid-state ESA radar sensor, and we are demonstrating that we’ve reached that objective,” says McCloskey. “We’re excited to introduce these capabilities for other security applications.” Able to surveil ground and air domains, the radar combines versatility and commercial price with surveillance capabilities MESA technology Echodyne’s proprietary technology provides a small true electronically scanning array (ESA) radar. Unlike expensive Active ESA (AESA) phased array radars, MESA requires no physical phase shifters, thus reducing the cost, size, weight, and power by several orders of magnitude while maintaining all the benefits of fast ESA radar. Echodyne combines its MESA technology with an intelligent software suite, Acuity, to produce a configurable, software-defined radar for commercial, law enforcement, and governmental security applications. The capability is also useful for temporary events such as rallies and marathons, and many other market applications “Technology seems to make everything more available to more people over time,” says McCloskey. “What is a retail product today will be a purchased self-assembly kit tomorrow and an improvised self-made drone the following day. The Federal Aviation Administration (FAA) is diligently at work on creating rules for safe UAV operation, though any final rules remain some distance off. As drone volumes increase, delineating friend from foe in the airspace requires clear legal and regulatory frameworks, which are nascent but would help distinguish the threat of nuisance flyers from illegal overflight.” Radar sensor for security applications “Detecting and tracking airspace objects of interest is imperative for airports, chemical plants, oil and gas installations, refineries, water and energy utilities, stadiums and other public spaces”, says McCloskey. The capability is also useful for temporary events such as rallies and marathons, and many other market applications. “As with any product, our applicability will depend on variables like location, terrain, risk assessment, and existing security technologies,” says McCloskey. “Our mission is to deliver the very best radar sensor for security applications.”
There are many new technologies at ISC West this year. There are also some tried-and-true solutions on display. More mature products have the benefit of being fully vetted and battle-tested, which may make them a more comfortable choice for security customers. I had a couple of discussions on Day 2 of the show about the advantages, and possible drawbacks, of new products. “To a security director, when you say ‘new,’ he translates that into ‘risk,’” says Bill Spence, VP of Sales, U.S., Canada and Western Europe for HID Global’s Lumidigm biometrics brand. “Anytime you say new, there is a probability of risk. The key is to educate. Education quantifies risk, and an educated customer can make an intelligent decision about risk versus reward.” “We have to take customers from where they are to help them understand new technologies,” says Spence. “We must give them a bridge to that understanding, and education is the bridge.” Lumidigm biometrics integrations An app provides graphics that take installers step-by-step through the installation process HID Global is incorporating Lumidigm biometrics into the new iClass SE RB25F fingerprint reader being highlighted at the show. Two-factor authentication can use either a card or mobile credential along with biometrics; there is no latency; and templates can be stored on a card. Another new offering at the HID Global booth is an augmented reality tool to simplify installation of newer systems that incorporate the more secure OSDP protocol. An app provides graphics that take installers step-by-step through the installation process. Also highlighted at the HID Global booth — and at the booths of turnstile manufacturers throughout the show — are embedded readers that provide tested and certified mobile access control for turnstiles. IClass SE technology is embedded in the iRox-T Turnstile Reader from Essex Electronics. Innovative security technologies There’s a delicate balance at any trade show between creating excitement about new products and educating customers to be comfortable with new technologies. There is some of both at ISC West 2019. In the future, hardware will be a delivery device, not the core of systems “We are on the cusp of change in the industry, and it’s closer than ever,” says Jennifer Doctor, Johnson Controls’ Senior Director, Project Management - Intrusion. “We will see the impact of promised technologies that will come from other industries, such as artificial intelligence. The very definition of security is changing. We are an industry that needs to be risk-averse, and we need to prove out the technology. There is innovation, but we just need to make sure technologies are what the market wants and expects.” “In the future, hardware will be a delivery device, not the core of systems, which will come from intelligence in the software and from services,” she adds. “The products we deliver will enable that.” Have 30 percent of service companies in the U.S. security market jumped into the cloud? PowerSeries Pro intrusion portfolio Johnson Controls is highlighting the commercial PowerSeries Pro intrusion portfolio, which features PowerG encrypted technology that enables wireless systems that are cyber-secure. The cloud is coming on strong, and one company finding success in cloud systems is Eagle Eye Networks, which has seen 93% compounded annual growth over the past three years. Economies of scale have enabled them to lower subscription prices by 35%, with an extra 10% decrease for customers that pay annually. Ken Francis, President of Eagle Eye Networks, says they are signing up 50 new dealers a month for the cloud video offering. Francis estimates that 30 percent of service companies in the U.S. security market have jumped into the cloud “It’s really heating up,” says Francis. “The general cloud is driving increases in the surveillance cloud.” Jumping to cloud Embracing the cloud and recurring monthly revenue (RMR) requires that dealers transform their businesses to ensure success. Francis says dealers should dedicate sales resources to cloud offerings rather than expect everyone to sell the cloud, and there should be a base commission plan on RMR services in lieu of upfront project fees. March Networks is also showing integration of video with the Shopify cloud-based point-of-sale (POS) system “Talk to professionals about your cash flow and understand how to capitalise on financing partners to ensure cash flow while investing in the RMR stream,” he adds. “And look for ways to reduce your costs to serve the customer base as your RMR increases.” For example, use of remote site diagnostics, configuration and support can avoid the need for expensive “truck rolls” that can undermine profitability. Francis estimates that 30 percent of service companies in the U.S. security market have jumped into the cloud. Alarm companies, which are accustomed to the RMR model, are generally ahead of the curve, while traditional security integrators are lagging. “It’s a requirement to change or die,” he notes. Insight hosted managed service Also, in the area of managed services, March Networks is highlighting its Insight hosted managed service that can provide instant information on video systems located at remote sites, including visibility into firmware versions, camera warranty information, and cybersecurity status of systems. The ability to dive deeply into system status empowers a new recurring revenue stream for integrators. Color-coded icons summarise system status and show pending issues and clicking on the icons provides detailed workflow information. The system can also be offered for smaller systems such as those at convenience stores and quick-serve restaurants. March Networks is also showing integration of video with the Shopify cloud-based point-of-sale (POS) system. The integration enables managers to evaluate POS information, especially anomalies, to determine possible employee theft and other shrinkage issues.
Pulse Secure, the provider of software-defined Secure Access solutions, has announced the successful delivery of a project to help Hogarth Worldwide refresh its secure access platform as part of a Zero Trust approach to security. Hogarth Worldwide is a creative production business, providing marketing production and adaptation services for some of the world’s most recognisable brands and global multinationals. Security is a critical part of this service and Hogarth manages its own multi-layered secure access platform. Having grown rapidly over the last decade, the company had reached capacity on its legacy Juniper VPN solution that was also heading towards end of support. With the need to upgrade fast approaching, Hogarth decided to both refresh its secure access platforms to meet greater demand and gain access to more advanced capabilities. Requirement of VPN and NAC platform Hogarth contacted ANSecurity, a trusted cyber security advisor that it had worked with previously on several projectsPeter Smith, Global Network Architect at Hogarth, said, “We initially created a shortlist of vendors from the Gartner Magic Quadrant and started examining a few options. Our key criteria was a VPN and NAC platform that was easy to deploy and manage, with strong compatibility across a wide range of devices, plus the ability to adapt.” Hogarth contacted ANSecurity, a trusted cyber security advisor that it had worked with previously on several projects. The team at ANSecurity provided guidance to help scope the project and design a technical implementation. “We looked at a number of options, but we felt that Pulse Secure offered the best combination of features and compatibility along with the flexibility we needed to meet our current requirements and future needs,” said Smith. Pulse Connect Secure (PCS) virtual appliances Based on these requirements, Hogarth selected Pulse Connect Secure (PCS) virtual appliances deployed within its main data centres in London and several branch offices across the world to provide VPN access. This is supported by Pulse Policy Secure (PPS), a next-generation NAC appliance that enables Hogarth to gain deeper visibility and understanding of its security posture. The combined solution is deployed as part of a Zero Trust approach to security allowing Hogarth to ensure its distributed workforce is authenticated, authorised and secure when accessing applications and resources across its own data centre and cloud-based resources. The data from all these systems is passed to a SIEM to allow the IT department to quickly detect any issues The solution is integrated into its Ruckus based Wi-Fi network, Radius authentication server and multi-factor authentication which runs in Azure. The data from all these systems is passed to a SIEM to allow the IT department to quickly detect any issues and automate threat response to mitigate malware, rogue devices, unauthorised access and data leakage risks. Meeting the requirements of TISAX “The virtual appliance offered better performance than our legacy solution and the Pulse Secure VPN and NAC appliances were easy to deploy with a low management overhead,” commented Smith. “We have a high availability configuration and the built-in licence server makes it easy to add more users or devices as needed.” The new solution has also helped Hogarth to meet the requirements of TISAX (Trusted Information Security Assessment Exchange) that enables mutual acceptance of Information Security Assessments which was a key requirement for several of its clients within the automotive industry. “The upgrade to Pulse Secure has gone very smoothly, we have had no issues and the solution has delivered as expected with the potential to adapt as our security needs evolve,” Smith concluded.
There is a saying that ‘Everything is Bigger in Texas’, and the Dallas, Texas police department is no exception. The city of Dallas is ranked in the top 10 cities in the U.S. in terms of population, at 1.2 million people. The Dallas Police Department is the ninth largest municipal police force in the U.S., based on 3,012 sworn officers. It is led by Chief of Police, U. Reneé Hall. The department is located in the Jack Evans Police Headquarters building, which was built in 2003. It is 358,000 square feet, has six floors, is spread over a three-acre site, has a separate 1,200 car parking garage and a two-acre, open parking lot for additional visitor parking. Prior to 2003, the department was housed in the circa 1914 former City Hall Building. Preventing terrorist attack and hazards Police officials worked with a Police Design Consultant to help design the building to resist terrorist attacksThe Jack Evans Police Headquarters building was under construction when 9/11 terrorists flew airplanes into the World Trade Buildings in New York. That event was preceded by the Oklahoma City Murrah Federal Building bombing in April 1995. Therefore, security was a concern in its design. Police officials worked with a Police Design Consultant – McClaren, Wilson, and Lawrie Architects of Phoenix – to help design the building to resist a terrorist attack and isolate potential hazards. The building also needed to control visitor traffic and access. On an average month, there are 5,000 public visitors to the Jack Evans building. In addition, shots fired at police buildings nationally are not uncommon, says Paul M. Schuster, Senior Corporal/Facilities Management for the Dallas Police Department. Ready to anticipate dangerous crimes “For the most part they are random, single shot drive-by shootings. Often, the officers are unaware that the building has been shot at, until they find a bullet hole in the brick or glass. Increasingly, police tend to be a symbol of government and some citizens see that as a visible target to lash out at. Police officers are trained to expect the routine types of calls, such as domestic violence, traffic accidents, and other crimes. Yet they must be flexible to anticipate the non-routine that can be dangerous and change in a heartbeat.” On June 13, 2015, after midnight, a 35-year-old male placed a duffle bag with a remote-controlled bomb to detonate later between cars in the parking lot of the headquarters building. The suspect then began shooting continuously at the lobby windows. Officers responded to the scene, a vehicle chase began, and the incident ended outside the city. Luckily officers in the lobby took cover and were not injured. Conducting building security assessment The assessment included testing various construction materials for bullet resistance to various types of weaponsFollowing that incident, the Dallas Police Department conducted a security assessment of the building and also at seven patrol stations throughout the city. The assessment included testing various construction materials for bullet resistance to various types of weapons. Gensler Architects and Guidepost Solutions, LLC developed the solutions and plans. “Yesterday we were concerned about handguns, today we are worried about rifles, and the idea of terrorism is always present with outright attack or bombs,” Schuster notes. “The police officers and police staff only want a place that is safe and where they can do their good work.” Funding of $1.3 million was approved to upgrade the lobbies of the seven patrol stations to withstand rifle rounds, and $1.9 million to improve headquarters lobby security, and to upgrade an aging security system. Turner Construction Company and Convergint Technologies, LLC conducted the renovations and security technology integration. Challenges in upgrading lobby security Visitors were allowed free entry into the lobby and were only screened in an open area to the side if going to other floorsThe headquarters’ lobby was initially designed as a two-storey glass-walled structure, with an information desk and public records service windows. Visitors were allowed free entry into the lobby and were only screened in an open area to the side if going to other floors. “The challenge in upgrading lobby security was the two-storey lobby entrance glass. The glass was not bullet rated, due to budget constraints. Changing the front of the building to support ballistic rifle-rated glass would have caused extensive time, exposed the inside of the lobby to weather, and would not have solved all of the security issues,” Schuster says. “In addition, there were concerns about keeping an ‘open’ and friendly service concept in mind and ensuring that the lobby would not resemble a ‘fortress’,” Schuster notes. Bullet-rated glass and bullet resistant wall The solution was to keep the existing exterior unchanged and focus on adding a layer of security once a person enters the lobby. Visitors now enter the headquarters and immediately proceed to a side room where security screening is conducted. Once inside the screening room, the visitor has belongings x-rayed, and they walk through a metal detector A new secondary wall with bullet-rated glass and solid bullet resistant wall materials was constructed inside the lobby to channel visitors to the room. Once inside the screening room, which also has bullet resistant walls, the visitor has belongings x-rayed, and they walk through a metal detector. In the event that anyone was to produce a gun and begin shooting, the incident could be contained inside that room. Tourlock 180+90 security revolving door Once a visitor has been cleared, they proceed into the main lobby via a Boon Edam Tourlock 180+90 security revolving door. This automatic, four-wing door is the most advanced, security revolving door in the Boon Edam product range that offers maximum throughput, allowing users to enter and leave the building simultaneously. In the event that a large number of persons try to force their way into the facility, the Tourlock 180+90 will determine that more than one person is trying to enter and will reject the person and lock out any others from entering. Once a visitor is ready to leave the lobby and exit the building, they pass through another Boon Edam Tourlock 180+90 that leads to a vestibule with exterior swinging doors. In the event that someone tries to go back into the lobby from the front vestibule area, without going through the security screening room, the Tourlock security revolving door will reject their entry. Preventing tailgating and piggybacking The Boon Edam security revolving doors accurately prevent both tailgating and piggybackingThe Jack Evans Headquarters security upgrades for the lobby improved security and still kept the best aspects of the lobby design, including the antique police car, and the overhead police helicopter. The Boon Edam security revolving doors accurately prevent both tailgating and piggybacking, and provide the department with maximum security while controlling traffic flow. “While it would be great to have a building totally open to the public and then add security as needed, such is not the world we live in anymore,” Schuster adds. Future security plans include exterior site security upgrades to the patrol stations and the headquarters to include security fencing with card access controls for fleet and employee vehicles at each of the sites.
Ports of Jersey operate the island’s busy harbours and airports, providing high-quality services and facilities to enrich the experiences and journeys of their customers, with Jersey Marinas offering 1,000 berths across three award-winning locations close to the vibrant waterfront at St Helier. At very busy times of the year, such as the annual Jersey Regatta, the sheer volume of visitor traffic arriving from both land and sea can present serious problems. With particular challenges arising from managing car parking, and the issuance of port entry digital keys for boats harbouring. Smart access control solution Ports of Jersey needed a smart access control solution capable of managing short-term parking at St Helier harbour Ports of Jersey needed a smart access control solution capable of managing short-term parking at St Helier harbour. The system needed to be intelligent enough to manage complex bookings for use by berth and mooring holders dropping off and loading gear onto boats, before parking elsewhere long-term. The existing solution was no longer cost effective, and was open to abuse by some users. In addition, Ports of Jersey also required an upgrade to the out of date Jersey Marinas security gate access control system. At peak times this system needed to be able to cope with rapid, high capacity issuance of smart cards to vessel owners and boat crews wishing to access the marina and marina hospitality faculties. Smart installation SALTO partner JMH Technology was asked to provide a new car park access control solution and resolve the looming problem of needing to issue 1,000 cards, at a cost of over £100,000. A replacement car park access control system was installed based on new technology smart cards and 2,000 cards issued. This project was highly cost-effective with installation and card issuance totalling less than just card issuance on the previous system. Future savings also assured thanks to a choice of more cost-effective cards. Abuse of short-term parking has been cut, and the experience for visitors is improved. JMH Technology is in the process of adding more reader-controlled doors To drive yet more efficiency and further reduce overheads the system has subsequently been updated at both St Helier and Albert Pier car park, with smart installation of the latest SALTO access control technology. The upgrade continues, and JMH Technology is in the process of adding more reader-controlled doors and smart handles across the facility. Security assessment A full security assessment was carried out at Jersey Marinas, and a decision taken to replace all of the expensive and temperamental mechanical code locks with a full online access control system. By engineering a bespoke solution that integrated a SALTO kiosk system with a touch screen unit interface, Jersey Marinas staff are now able to allocate more than 500 cards during the high-tide window. With extra capacity on tap when they need it to cope with high demand at peak times, and valuable cost savings made. The SALTO system provided is technically robust and cost-effective to expand. As a partitioned system Ports of Jersey now have a global overview, with each department able to see the section relevant to them. This enables micro management of cost savings across equipment and cards and allows staff to get permissioned access to all necessary parts of the Ports infrastructure without delay.
Retail banking combines a demand for high security with complex workflows. Staff need efficient access. Facility managers need the flexibility to design access permissions around individual needs, so not everyone can access every area whenever they choose. Nobody wants to carry or track large numbers of keys. These were the requirements, managers of Creval — a regional bank in Italy — faced when seeking an alternative to a mechanical master-key system. Creval needed new access control devices to become an integral part of a security system for assets and people with the highest level of protection. They sought locks to offer a durable, secure and flexible alternative to standard mechanical security. They found an easy, electronic way to administer a powerful, user-friendly system based on battery-powered physical keys and secure, advanced microelectronics. Flexible high-security locking Staff carry a single, battery-powered eCLIQ key, programmed with only the right preauthorised access permissionsCreval chose eCLIQ key-based wireless access control for its banking premises. Bank doors across the Lombardy region are guarded by more than 30 durable eCLIQ cylinders, putting Creval managers in complete control of entrance security. eCLIQ is a scalable electronic extension of the CLIQ access control system deployed in critical infrastructure sites across Europe. Cylinders are fully electronic, protected against manipulation and with 128-bit AES encryption built into both lock and key microelectronics. Staff carry a single, battery-powered eCLIQ key, programmed with only the right preauthorised access permissions. Time-limited access rights Creval’s security manager is now able to grant access based on scheduled times and specific doors, and right down to the level of the individual site user. It is also straightforward to set time-limited access rights for a user key, increasing security if a key is lost. Audit trails and event logs are collected to the same, fine-grained degree. Key management is easy with software operated from a local PC or securely on the web via a standard browser. In the unlikely event a key is misplaced, Creval administrators simply delete its validity from the system. “We are satisfied with the results of the new access control system,” says Claudio Brisia, Logical Security Manager at Creval headquarters in Sondrio.
The Security Industry Association (SIA) has expressed strong support for MI HB 5828 and HB5830, two bills designed to improve school security across the state of Michigan. Michigan Legislation In a letter to Michigan House of Representatives Committee on Appropriations Chairwoman Laura Cox and Vice-Chair Rob VerHeulen, SIA CEO Don Erickson praised the bills’ creation of a comprehensive school plan and fund to enable local districts to procure security solutions to protect students from malicious perpetrators and update building code requirements to include security measures. “Sadly, our nation’s schools have increasingly become a soft target for mass violence – at Sandy Hook Elementary, recently at Stoneman Douglas High School and in many other attacks,” said Erickson. “We support holistic approaches to improving school safety and security in response to these tragedies – recognising there is no single action that can be taken that will, by itself, make our schools safe.” SIA is a co-founder of the Partner Alliance for Safer Schools (PASS), a consortium of school security experts Improving school security SIA represents about 900 security and life safety solutions providers – companies that develop, manufacture and integrate technologies that help keep people and property safe from hazards. These industry leaders strive to introduce robust security solutions integrated into our nation’s K–12 public schools, private academic institutions, colleges and universities. In addition to serving member organisations working to improve security in schools and other environments, SIA is a co-founder of the Partner Alliance for Safer Schools (PASS), a consortium of school security experts that developed threat- and income-based guidelines for schools housing grades K–12 to implement appropriate, layered security measures. These guidelines are available to help guide school investments. Additionally, PASS provides integrators with risk assessments and white papers that can be used when working with schools to evaluate and establish the best security protections for their buildings. SIA believes state assistance like that in the Michigan legislation is a start to addressing key security gaps in schools and is especially critical to high-risk school districts or those with limited budgets.
A new Concierge and Physical Security Information Management (PSIM) solution from Intergrated Security Manufacturing (ISM) is protecting two tower blocks in Haringey, enabling authorised council employees to control door access and manage fire and security systems from anywhere within the council’s estate. Newbury House, Finsbury House, John Keats House and Thomas Hardy House in Wood Green, London, already feature four of ISM’s state-of-the-art Ultimate door entry systems as well as another two, third-party technology systems (Elizabeth Blackwell and George Lansbury) from Entrotec, utilising its Apex Dual path speech technology. Thanks to the Genesys PSIM from ISM, multiple technologies can be controlled, regardless of the manufacturer, providing enhanced security to residents in 510 flats across the six towers. This delivers greater flexibility and control, eliminates the potential disruption caused by installing new equipment, and protects the council’s legacy investment. It also means that further buildings with existing ISM or Entrotec systems can be added as required with only minimal additional investment. Integrated security system Genesys allows the integration not just of door entry systems, but also multiple systems from multiple manufacturers – all from one holistic integrated security system. Every electronic security or fire safety device from CCTV and intruder alarms to electronic locking and public address can be monitored and controlled from a single platform. Most importantly, it features Migrating 3+ technology, a patented automatic failover technology that adds higher levels of automatic configurable redundancy and power. Control is effectively distributed across multiple workstations. "To improve our efficiency and give faster responsesto our residents we neededto provide conciergeservices to all our estates" Len Fevrier at Homes for Haringey has been impressed with the system and how it has performed so far: “We have used the ISM Ultimate door entry products and its Genesys 2 control room software platform extensively in the Borough over many years and have enjoyed excellent product reliability and technical support. To improve our efficiency and give faster responses to our residents we needed to provide concierge services to all our estates,” he says. “The development of the Entrotec integration into the Genesys platform, allowed Haringey to combine technology, including CCTV and fire, without going to the expense of replacing legacy door entry equipment unnecessarily. This delivers a much-needed saving during these challenging economic times for local councils, and we plan to roll this system out across the rest of the Broadwater Farm Estate and potentially other sites in the borough.” Intuitive software Managing Director of ISM, Stephen Smith, says this project is a perfect example of the flexibility of Genesys and its door entry system range: “Genesys is a ‘true’ PSIM system built around intuitive software that combines a range of industry leading features and benefits including an enhanced graphical user experience and 3-D modeling and a comprehensive event management database. Events and alarms from any integrated security application are presented to the operator clearly as and when they happen.” The PSIM software operates as a standalone platform over LAN or WAN networks for remote and local sites with workstations that can be transferred to any operating security control room on the network. This offers the end user flexibility when closing down sites or buildings for off-peak or out of normal working hours or in the unlikely event of any system failures. Ultimate is a fully addressable digital telephone entry system that is robust in design and easy to install. Unlike other door entry systems on the market it has multi speech paths that allow numerous conversations to be had at one time Such was the complexity of the project, that from initial design of the system to completing the installation took around two years to complete. Fire alarms, access control and CCTV can all now be controlled from one computer from any of the Council’s network.
Round table discussion
Fire and security systems are two elements of the same mission: To keep buildings and their occupants safe. However, the two systems often operate independently and may not be integrated. Should there be more integration and what are the pitfalls? We asked this week’s Expert Panel Roundtable: What are the challenges and opportunities of integrating security and fire systems?