Highfield Qualifications has been approved to deliver end-point assessment (EPA) for the Security First Line Manager apprenticeship standard. It brings the total number of standards the organisation is approved to deliver EPA for to 34, with 3 standards in the Protective Services suite. Delivering apprenticeship assessments under its Highfield Assessment brand, the organisation is promising employers a full range of assessment services, support and advice to help them make the most of their app...
Fire and security systems are two elements of the same mission: To keep buildings and their occupants safe. However, the two systems often operate independently and may not be integrated. Should there be more integration and what are the pitfalls? We asked this week’s Expert Panel Roundtable: What are the challenges and opportunities of integrating security and fire systems?
Crossword Cybersecurity plc has announced the availability of Rizikon Assurance 2.0, an online solution to the problem of third-party risk. The new version allows organisations to visualise all risks for each third-party through fully customisable 360-degree supplier scorecards. The new Third-party Assurance Framework Dashboard – an industry first – gives Supplier Management teams, Chief Risk Officers and senior executives a complete understanding of third-party risks across their su...
AlgoSec, the provider of business-driven network security management solutions, has introduced extended support for Cisco ACI SDN deployments, and enhanced application visibility and network auto-discovery features in the new version of its core Network Security Management Suite. The new AlgoSec A30 release delivers new automation capabilities that enable seamless, zero-touch security management across SDN, cloud and on-premise networks. This gives enterprises the most comprehensive visibility...
Radiflow, a provider of industrial cybersecurity solutions for industrial automation networks, and Industrial Technology Systems (ITS), a specialist independent systems integrator, jointly announced that ITS is adding new OT cybersecurity services for preventing business interruption for its process manufacturing customers based on Radiflow’s portfolio of industrial cybersecurity technologies. ITS is a specialist, independent system integration firm in the UK focusing on process control a...
Genetec Inc., a technology provider of unified security, public safety, operations, and business intelligence, announced Genetec ClearID™, a self-service physical identity and access management (PIAM) system that standardises and enforces security policies to help make organisations more efficient, compliant and secure. Available in North America in September 2019, and globally in early 2020, ClearID will be showcased at the Global Security Exchange (GSX) in Chicago, in booth #1533. From...
Aqua Security, the platform provider for securing container-based, serverless, and cloud native applications, announces that the company’s flagship platform, Aqua CSP, is available on VMware Cloud Marketplace™. VMware Cloud Marketplace enables customers to discover and deploy validated, third-party solutions for VMware-based platforms – across public, private and hybrid cloud environments. Once validated, partners can easily publish their solutions for VMware customers across platforms. Customers will be able to access these third-party partner solutions directly from their cloud environments, while also being able to experience the convenience of features such as notifications, reporting, and analytics. Software development lifecycle As a VMware PKS Partner, Aqua CSP was architected specifically to address the challenges of visibility, control, and isolation in container environments, while remaining transparent and non-intrusive to DevOps, allowing organisations to reap the business benefits of containers while improving their security posture. Using Aqua CSP on VMware and Pivotal PKS provides enterprise users with an end-to-end security solution, including: Aqua Security is very excited to be a part of the VMware Cloud Marketplace"Image scanning for known vulnerabilities, malicious code detection, and enforcement of image integrity throughout the software development lifecycle Vulnerability shielding, using a form of virtual patching to detect and prevent attempts to exploit known vulnerabilities Assessment of the security posture of Kubernetes clusters against the hundreds of tests of the CIS Benchmark for Kubernetes Penetration testing of Kubernetes against dozens of attack vectors Runtime controls to monitor container activity in real time, based on custom policies and machine-learned behavioural profiles, to alert on or block suspicious activities and processes Enterprise grade software “Aqua Security is very excited to be a part of the VMware Cloud Marketplace,” said Upesh Patel, VP of Business Development for Aqua Security. “We believe that this marketplace will make it easy for VMware customers to deploy enterprise grade software in a complex computing environment.” Patel goes on to note that, “customers can build mission critical applications on Pivotal or VMware PKS and will be able to secure their entire application lifecycle in a scalable way, while automating DevSecOps processes.” “We are pleased to see Aqua Security CSP available on VMware Cloud Marketplace,” said Milin Desai, GM, Cloud Services, VMware. “Validated technologies, such as Aqua CSP, enable IT teams to reduce cost, increase efficiency, and create operational consistency across cloud environments. We’re excited to work with partners such as Aqua Security to empower customers to fully leverage their cloud investments.”
Honeywell, a global pioneer in smart building technology and services, introduced the next generation of Enterprise Building Integration (EBI), Command and Control Suite (CCS), and Digital Video Manager (DVM), a suite of solutions enabled by the Honeywell Forge for Buildings platform, that help drive facility efficiency and oversight, streamline complex functions, and deliver savings across an enterprise. A key component to making this all work is keeping facilities and occupants safe. Along with EBI, CCS and DVM, Honeywell is launching a portfolio of enhanced cybersecurity solutions to help companies protect against the rising risk of unexpected attacks on data, network systems and building infrastructure. Keeping people safe and secure Our building operation teams help customers address building use and critical infrastructure challenges"“For buildings to be smarter, more efficient and effective, an operating system must be in place that works to constantly improve resource management,” said Mark Verheyden, president, Honeywell Building Solutions. “These systems help keep people safe and secure, enhance the building experience, and protect the data and processes that drive operations. The overall health of the building ecosystem can impact business success – just like great talent and experience. Our building operation teams help customers address building use and critical infrastructure challenges.” Transforming inputs into actionable outcomes These technologies leverage IoT connectivity, interoperable systems and data sharing, and adaptive workflows to help transform inputs and information into actionable outcomes. Key enhancements include: EBI R600 – The Honeywell building management system that helps connect, monitor and manage core building functions, from comfort to security to safety, and can help reduce upfront capital costs. The open IoT platform integrates with numerous third-party systems and equipment as well as cloud and mobile applications. With more than 23 years of market implementation, EBI has more than 150 million IoT connections in buildings worldwide. DVM R700 – An enhanced digital surveillance system that delivers a detailed view of operations and enterprise-wide integrated protection. Improved camera servers enhance views and reduce storage needs and hardware costs. CCS R300 – Facility visualisation application with intuitive interface that brings performance data to building personnel through enhanced map navigation and editing capabilities. Honeywell Forge for Buildings Honeywell Forge for Buildings is an integrated platform that connects operational data from assets, processesEBI600, DVM700 and CCS300 integrate with Honeywell Forge for Buildings, an enhanced category of software developed by Honeywell called Enterprise Performance Management. Honeywell Forge for Buildings is an integrated platform that connects operational data from assets, processes, third-party applications and people with machine learning to help customers improve their building performance and enhance performance and productivity with actionable insights. “Commercial building and critical infrastructure customers are often driving toward similar facility outcomes: streamlined operations, reduced costs, improved safety and security,” Verheyden said. “Efforts to reach these goals are markedly different for a hospital or an airport, for example. Within our enhanced integrated platform of offerings, operations teams can tailor services to help meet specific needs through new multi-windows and interactive options that are just a fingertip away.” Information Technology (IT) often receives the most attention when it comes to safeguarding the integrity of data and assets. Operational Technology (OT) – systems that monitor, control and protect processes, equipment and operational environments – can be another entry point, and often needs similar or more care in today’s ever-connected technology landscape. Honeywell Forge Cybersecurity solutions Honeywell is extending its cybersecurity services and products for the buildings OT environment to enable customers to better protect their assets and people. The Honeywell Forge Cybersecurity solutions include: Cybersecurity Assessment – A professional review of buildings OT systems using industry best practices to identify potential vulnerabilities or gaps. A detailed report is developed to establish a cyber-status baseline and a prioritised action list. Secure Design and Configuration – Design or modify existing OT infrastructure to enhance the physical, network and application layers and help reduce risk and mitigate unexpected costs. Cybersecurity Appliances and Software – The installation and maintenance of cybersecurity hardware and software including firewalls, Secure Media Exchange (SMX), advanced end-point security, and backup/restore appliances, to help monitor and protect OT systems, Cybersecurity Monitoring and Remote Management – Enables monitoring of OT systems and push alerts regarding performance or security issues. This can be extended to include Remote Management services, as well as Honeywell’s 24/7 Security Operation Centre (SoC) monitoring. Incident Readiness and Advisory – Establishes incident response processes that enable more efficient containment, triage and resolution to regain normal business operations in the event of an incident. “Increasing connectivity to OT systems typically enhances security, promoting visibility, and allowing previously unidentified security issues to be more efficiently realised. It is a more proactive approach to monitoring and maintaining the systems to be undertaken – the days of leaving OT systems unmanaged, unpatched and unmonitored are over,” said David Trice, vice president and general manager, Honeywell Connected Enterprise, Buildings.
A study from Exabeam, the Smarter SIEM™ company, revealed that more than one-third of security professionals' defensive blue teams fail to catch offensive red teams. The survey, conducted at Black Hat USA 2019, also showed that 68% find red team exercises more effective than blue team testing, and more companies are practising red over blue team testing. As cyberattacks become increasingly sophisticated and hack techniques become more highly targeted, organisations must learn how digital adversaries think to help identify gaps in their security programs. Organisations practicing red and blue exercises speak volumes about their dedication to fortifying their security posture Red teams consist of internal or hired external security professionals that emulate cybercriminals' behaviours and tactics and gauge the effectiveness of the company's current security technologies. Blue teams consist of the organisation's internal security personnel, tasked with stopping the simulated attacks. In these test scenarios, the blue team must react without preparation, to give the company the most realistic picture of its defensive capabilities. The study showed that 72% of respondent organisations conduct red team exercises, with 23% performing them monthly, 17% quarterly, 17% annually, and 15% bi-annually. Sixty-per cent conduct blue team exercises, with 24% performing them monthly, 12% quarterly, 13% annually, and 11% bi-annually. The fact that so many organisations practice these exercises monthly speaks volumes about their maturity and dedication to fortifying their security posture. Constantly evaluate security investments Not only do more organisations practice red team testing, but 35% of respondents claim that the blue team never or rarely catches the red team, while 62% say they are caught occasionally or often. Only 2% say they always stop the red team, emphasising that organisations must constantly evaluate and adjust their security investments to keep up with today's adversaries. Adversaries' offensive tactics evolve more rapidly than the majority of security technologies on the market today." Promisingly, the study found that 74% of IT security professionals have seen their companies increase security infrastructure investment as a result of red and blue team testing, with 18% calling the budget changes significant. Only 25% claimed that their company has never upped its security budget after performing these tests. The survey also identified communication and teamwork (27%) as the top skill blue teams need to work on, followed by knowledge of the attacks and tactics (23%), threat detection (20%), the incident response time (17%) and persistence (8%). Technical knowledge a foundation "Adversaries' offensive tactics evolve more rapidly than the majority of security technologies on the market today. It's abundantly clear that regular and relevant red/blue team testing helps companies develop their security capabilities," said Stephen Moore, chief security strategist, Exabeam. "The study also demonstrates that while having technical knowledge is a necessary foundation for all security professionals, interpersonal skills are highly sought after to promote more cohesive teams and better cooperation, especially during an incident or intrusion. We encourage companies to employ these types of testing exercises to find and fill security gaps, which, over time, become methods to evaluate the strengths and weaknesses of their cybersecurity defenders."
Digital Defense, Inc. announced the integration of their Frontline.Cloud™ vulnerability management and threat assessment platform with the Cherwell IT Service Management (ITSM) platform. The union of the two security technologies enables joint customers to automate the process of ticketing, enabling organisations to quickly and efficiently address security vulnerabilities and threats, improving their overall security posture. "Through the integration, organisations can leverage the benefits of Digital Defense's next-generation security assessment system and Cherwell's powerful ITSM solution for exceptionally accurate host identification and management," states Gordon MacKay, EVP/chief technology officer at Digital Defense. "Our Frontline.Cloud incorporates patented scan-to scan host correlation technology to ensure users can precisely track and correlate assets across assessments and over time simplifying the burden of manually tracking and managing network assets." Vulnerability and threat assessment solutions "For the most effective and efficient IT service desks, interoperability is key," said Michael Euperio, director, technology alliances at Cherwell. "With Cherwell's ITSM solution acting as the hub for managing all IT tickets, including security vulnerabilities and threats, the integration with Digital Defense is important progress for our common customers." Frontline.Cloud offers software security systems focused on hardening business-critical assets from being breached Founded in 1999, Digital Defense, Inc. is an industry-recognised provider of security assessment solutions. Digital Defense provides vulnerability and threat assessment Software-as-a-Service (SaaS) solutions and services purpose-built to operate in today's hybrid cloud enterprise environments. Digital Defense's proprietary platform, Frontline.Cloud, incorporates patented technologies and offers multiple software security systems focused on pro-actively hardening business-critical assets from being compromised and breached. Operating on-premise The Frontline. Cloud platform supports Frontline Vulnerability Manager™ (Frontline VM™), Frontline Web Application Scanning™ (Frontline WAS™), and Frontline Active Threat Sweep™ (Frontline ATS™) that provide agent-less discovery, vulnerability and threat assessment of dynamic assets, while eliminating manual processes and integrating with market-leading 3rd party security and IT offerings to eliminate gaps invisibility and enable faster remediation. Frontline.Cloud is the only solution in the market that is built to scale across any size organisation and operate on-premise, in the cloud or hybrid network-based implementations.
Global cybersecurity firm GRA Quantum announces the launch of its comprehensive offering, scalable security suite, providing solutions based on a combination of managed security services and professional services, tailored to the specific needs of each client. Scalable security suite was created to give small to mid-sized organisations a running start when it comes to security, providing the same standard of security controls as large enterprises. Providing security solution According to GRA Quantum's President Tom Boyden, “Small and medium-sized firms are prime targets for cybercrime, but many don’t have the necessary resources or guidance to properly strengthen their security stance. Our Scalable Security Suite is designed to help these organisations prioritise their greatest vulnerabilities and provide them a security solution that aligns with their business needs and evolves as these needs and the threat landscapes change.” Professional services can be added to Managed Security Services to overcome vulnerabilities Managed Security Services (MSS), launched in December 2018, is the foundation of Scalable Security Suite. Through comprehensive security assessments, GRA Quantum experts identify vulnerabilities and provide recommendations for a custom combination of professional service offerings to best address these vulnerabilities. Professional services can be added to Managed Security Services to overcome vulnerabilities and build a more comprehensive, proactive security program. Custom security solution Jen Greulich, GRA Quantum’s Director of Managed Security Services, has seen the need arise among current MSS clients for these supplemental services. “Oftentimes, it becomes clear in a scoping call that clients’ needs extend beyond what we offer through MSS. Our new flexible offering allows us to work with the clients to develop a custom security solution for them that compliments MSS — whether they need incident response or penetration testing services.” Aligned with GRA Quantum’s mission, Scalable Security Suite goes beyond the ordinary cyber assessment to understand and remediate acute physical and human-centric vulnerabilities as well.
PerpetuityARC Training, part of Linx International Group, is proud to announce its new interactive and virtual online learning platform - Linxville. Visually reminiscent of classic computer games such as The Sims and Sim City, Linxville’s first bitesize course to launch is Perimeter Security. It presents the student with a simulated environment containing a number of commercial buildings surrounded by roads, gates, fencing, lighting and security guards, which link back to the topic. Information to handle threat/vulnerability Linxville is a highly visual and interactive concept that pushes the frontiers of distance learning"The learner is taken on a guided interactive learning journey around the site and is presented with potential threat vulnerabilities, suitable risk assessments and information on how to handle that threat/vulnerability at each location. Bolstered by the feature of people and traffic movement, the simulation adds ‘real world’ realism to assist learners in the application of their knowledge. Linx International Group Director, Angus Darroch-Warren states: “Linxville is a highly visual and interactive concept that pushes the frontiers of distance learning. By presenting graphical mapped real-world security scenarios, Linxville delivers an immersive and educational experience that is ideal for those who are new to security or have it under their remit but have limited experience.” Linxville is designed to grow and be fully inclusive and accessible, as Angus adds: “We will be expanding the simulation sites to include retail, universities and airports all within the Linxville platform. We are also excited by the potential scope for Linxville to be personalised in order to deliver specific security training for organisations.”
Rodrigue Zbinden, CEO at Morphean, discusses the business benefits from merging video surveillance and access control technologies as demand for ACaaS grows. The big question facing businesses today is how they will use the data that they possess to unlock new forms of value using emerging technologies such as the cloud, predictive analytics and artificial intelligence. Some data is better utilised than others: financial services were quick to recognise the competitive advantages in exploiting technology to improve customer service, detect fraud and improve risk assessment. In the world of physical security, however, we’re only just beginning to understand the potential of the data that our systems gather as a part of their core function. Benefits of ‘Integrated access control’ The first thing to look for is how multiple sources of data can be used to improve physical security functionsWhat many businesses have yet to realise is that many emerging technologies come into their own when used across multiple sources of data. In physical security, for example, we’re moving from discussions about access control and CCTV as siloed functions, to platforms that combine information for analysis from any source, and applying machine learning algorithms to deliver intelligent insights back to the business. ‘Integrated access control’ then looks not just to images or building management, but to images, building management, HR databases and calendar information, all at the same time. And some of the benefits are only now starting to become clear. The first thing to look for, of course, is how multiple sources of data can be used to improve physical security functions. For example, by combining traditional access control data, such as when a swipe card is used, with a video processing platform capable of facial recognition, a second factor of authentication is provided without the need to install separate biometric sensors. CCTV cameras are already deployed in most sensitive areas, so if a card doesn’t match the user based on HR records, staff can be quickly alerted. Making the tools cost-effective In a similar vein, if an access card is used by an employee, who is supposed to be on holiday according to the HR record, then video data can be used to ensure the individual’s identity and that the card has not been stolen – all before a human operator becomes involved. This is driving growth in ‘access control as a service’ (ACaaS), and the end-to-end digitalisation of a vital business functionThese capabilities are not new. What is, however, is the way in which cloud-based computing platforms for security analytics, which absorb information from IP-connected cameras, make the tools much more cost effective, accessible and easier to manage than traditional on-site server applications. In turn, this is driving growth in ‘access control as a service’ (ACaaS), and the end-to-end digitalisation of a vital business function. With this system set up, only access control hardware systems are deployed on premise while the software and access control data are shifted to a remote location and provided as a service to users on a recurring monthly subscription. The benefits of such an arrangement are numerous but include avoiding large capital investments, greater flexibility to scale up and down, and shifting the onus of cybersecurity and firmware updates to the vendor. Simple installation and removal of endpoints What’s more, because modern video and access control systems transmit data via the IP network, installation and removal of endpoints are simple, requiring nothing more than PoE and Wi-Fi. Of all the advantages of the ‘as a service’ model, it’s the rich data acquired from ACaaS that makes it so valuable, and capable of delivering business benefits beyond physical security. Managers are constantly looking for better quality of information to inform decision making, and integrated access control systems know more about operations than you might think. Integrating lighting systems with video feeds and access control creates the ability to control the lightsRight now, many firms are experimenting with ways to find efficiencies and reduce costs. For example, lights that automatically turn off to save energy are common in offices today, but can be a distraction if employees have to constantly move around to trigger motion detectors. Integrating lighting systems with video feeds and access control creates the ability to control the lights depending on exactly who is in the room and where they are sitting. Tracking the movement of employees Camera data has been used in retail to track the movement of customers in stores, helping managers to optimise displays and position stocks. The same technology can be used to map out how employees move around a workspace, finding out where productivity gains can be made by moving furniture around or how many desks should be provisioned. Other potential uses of the same data could be to look for correlations between staff movement – say to a store room – and sales spikes, to better predict stock ordering. What makes ACaaS truly exciting is it is still a very new field, and we’re only just scratching the surface of the number of ways that it can be used to create new sources of value. As smart buildings and smart city technology evolves, more and more open systems will become available, offering more ways to combine, analyse and draw insights from data. Within a few years, it will become the rule, rather than the exception, and only grow in utility as it does.
The Security Industry Association (SIA) looks forward to 2019, and it is apparent that physical security is moving into its most formative years. Changes presented by emerging technology, open systems and growing connectivity among devices and sensors will make a big difference for manufacturers, systems integrators/dealers and end users. With a more open, connected environment come cyber risk and data privacy concerns – which is why, in SIA’s 2019 Security Megatrends, cybersecurity’s impact on the physical security industry ranks number one on the list. Cybersecurity is affecting all areas of the industry landscape, from security implementation to attracting top talent to the workforce. Digital transformation The digital transformation we are experiencing impacts many other parts of the security industry as well, bringing opportunities like evolving identity management and collecting and delivering big data to customers. At this critical point in the industry’s development, it is important to embrace change, leverage disruptive technology in ways that give companies a competitive advantage. To determine this year’s Megatrends, SIA surveyed hundreds of executives from member companies To determine this year’s Megatrends, SIA surveyed hundreds of executives from member companies, along with current and recent Securing New Ground speakers and attendees, to identify which previous trends were still relevant, which trends were no longer as impactful and which broad trends should be added to our report. This year’s Security Megatrends 1. Cybersecurity’s Impact on Physical Security: It is important to prioritise cybersecurity for your business, your customers’ business and the vendors with which you work. This trend calls for continual process improvement and investment. 2. Internet of Things (IoT) and the Big Data Effect: The security industry makes use of IoT, analytics, artificial intelligence (AI), robotics and more, and data is coming from everywhere. The industry now faces the challenge of effectively managing and segmenting this information to be pertinent to the user. 3. Cloud Computing: Cloud platforms and applications are becoming prevalent across security solutions. This technology helps security integrators provide managed services and the advantages of off-site systems and services to customers. 4. Workforce Development: With historically low unemployment, finding skilled employees is a challenge to the whole security industry. Security stakeholders need talent with IT, cybersecurity, AI and even privacy expertise, presenting a need to grow students’ interest in the industry. 5. AI: Research firm Gartner predicts a new “democratisation of AI” that will impact more organisations than ever before. Companies are now testing this technology before offering it to customers and exploring how AI data can be used to improve security threat assessment and response. 6. Emphasis on Data Privacy: Growing connectivity brings new concerns over data privacy. Finding the balance between security and convenience is a dilemma the industry must now address. 7. Move to Service Models: The newest home security technologies are strongly impacting installing companies. Systems integrators must find ways to focus on services customers want and need and move to managed service models to make up revenues. 8. Security Integrated in Smart Environments: As everything becomes connected, smart environments will begin to proliferate. Buildings and cities are becoming more conscious, with connected systems now able to automatically respond to and even anticipate the needs of facility users and citizens. We must continue to find ways to make these environments smarter and safer. 9. Identity of the Future: With facial and voice recognition and biometrics growing in popularity and appeal, how will we enter buildings and access networks tomorrow? The industry will anticipate and adapt to constant technological change in identity and visitor management. 10. Impact of Consumer Electronics Companies: The influx of consumer electronics companies and DIY systems means changing rules and players in the security industry. This disruption presents both challenges and opportunities for security companies.
Edward Snowden’s name entered the cultural lexicon in 2013, after he leaked thousands of classified National Security Agency documents to journalists. He’s been variously called a traitor, a patriot, a revolutionary, a dissident and a whistleblower, but however you personally feel about him, there’s one way to categorise him that no one can dispute: He’s a thief. There’s no doubt about it: Snowden’s information didn’t belong to him, and the scary truth is that he is neither the first nor the last employee to attempt to smuggle secrets out of a building – and we need to learn from his success to try to prevent it from happening again. Since the dawn of the digital age, we’ve fought cyber pirates with tools like firewalls, encryption, strong passwords, antivirus software and white-hat hackers. But with so much attention on protecting against cyber risks, we sometimes forget about the other side of the coin: the risk that data will be physically removed from the building. Douglas Miorandi, director of federal programs, counter-terrorism and physical data security for Metrasens, recently discussed the major risks to physical data security with SourceSecurity.com. Q: What do you believe are the main physical threats to data? The biggest threats I have seen in the physical data security space have varied over the years, but there are four specific risks that remain the same across the board for any organisation, which are: Every organisation is at risk of having data walk out the building with that employee The Insider Threat The Outsider Threat The Seemingly Innocent Personal Item Poor or Nonexistent Screening To beginning with, every company or government agency has at least one disgruntled employee working for them, whether they know it or not, and that means every organisation is at risk of having data walk out the building with that employee. That is what security experts call the insider threat. Q: What do you think influences employees to steal data from their own organisation? People steal data from their workplaces because they see some means to an end, whether it’s to expose something embarrassing or damaging due to a personal vendetta, or because they can sell it to a competitor or the media and benefit financially – meaning they don’t even need to be disgruntled; they might just want a quick way to make a buck. Financial data, too, is attractive, both for insider trading and selling to the competition. People steal data from their workplaces because they see some means to an end, whether it’s to expose something embarrassing or damaging due to a personal vendetta, or because they can sell it to a competitor or the media and benefit financially This can happen to both private companies as well as government agencies. Take Natalie Mayflower Sours Edwards for example, a Treasury Department employee who was caught in the act just last month, when she disclosed sensitive government information about figures connected to the Russia investigation to a reporter. She didn’t hack the system, she simply used a flash drive. And let’s not forget that Snowden was a contractor working for the NSA. Q: Many of us think of security threats coming from an outsider, do companies still face these type of threats? Yes. Unfortunately, organisations do not only need to worry about their own employees – companies and government agencies need to be wary of threats from outsiders. COTS devices include SD cards, external hard drives, audio recorders and even smart phones They can come in the form of the corporate spy – someone specifically hired to pose as a legitimate employee or private contractor in order to extract information – or the opportunistic thief – a contractor hired to work on a server or in sensitive areas who sees an opening and seizes it. Either one is equally damaging to sensitive data because of the physical access they have. Q: Whether it be an insider threat or an outsider threat, what are ways these individuals can steal sensitive data? There are two types of personal items that can be used to steal data: the commercially available off-the-shelf (COTS) variety, and the intentionally disguised variety. This is considered risk number three – the seemingly innocent personal item. COTS devices include SD cards, external hard drives, audio recorders and even smart phones, any of which can be used to transport audio, video and computer data in and out of a building. Intentionally disguised devices are straight out of the spy novel; they could be a recording device that looks like a car key fob, or a coffee mug with a USB drive hidden in a false bottom. Intentionally disguised devices are straight out of the spy novel; they could be a recording device that looks like a car key fob, or a coffee mug with a USB drive hidden in a false bottom Q: What is the difference between COTS and disguised devices? The difference between COTS and disguised devices is that if someone gets caught with a COTS device, security will know what it is and can confiscate it. The disguised device looks like a security-approved item anyone could be carrying into the workplace, making it especially devious. Sometimes these devices don’t just function to bring information out of a building; they are used to damage a server or hard drive once it’s plugged in to a computer or the network. Some are both – a recording device that extracts data and then destroys the hard drive. Companies with airtight cyber security protocols can sometimes fall down when it comes to physically screening peopleQ: With these types of discrete items, can security personnel still catch individuals in the act? For example, through security screenings? Poor or nonexistent screening is the most substantial security threat to any organisation when it comes to sensitive data. Whether it’s an employee, an outside contractor or a device, the physical security risks are real, and everyone and everything entering and leaving a building needs to be screened. Unfortunately, screening often isn’t occurring at all, or is ineffective or inconsistent when it does occur. Even companies with airtight cyber security protocols can sometimes fall down when it comes to physically screening people and stopping them from stealing data through recording devices. Q: It’s surprising that so many organisations would neglect physical security when protecting their data. It’s a huge mistake, and the consequences can be dire. They range from loss of customer trust, exorbitant lawsuits and tanking stock prices in the private sector; and risks to national security in the public sector. Costs and resource allocation increase as well during efforts to reactively fix or mitigate the effects of physically stolen data. For both the private and public sectors, the risk for data to be physically removed from a building has never been greater. Years ago, it was much harder for the average Joe to figure out where they could sell stolen data. Now, with the Deep Web, anyone with Tor can access forums requesting specific information from competing spy agencies, with instructions on how to deliver it, greatly reducing the risk of getting caught – and increasing the likelihood people will try it. Although it’s getting easier to sell data, the good news is that all of these threats are avoidable with the right measures. Physical data security and cybersecurity must be considered the yin and yang of an airtight policy that effectively protects sensitive or confidential assets from a malicious attack Q: So how can an organisation protect against these risks? There are a number of ways – and the first one requires a change of mindset. Not long ago, the building/physical security department and the IT/cybersecurity department were considered two different entities within an organisation, with little overlap or communication. Organisations now are realising that, because of the level of risk they face from both internal and external threats, they must take a holistic approach to data security. Physical data security and cybersecurity must be considered the yin and yang of an airtight policy that effectively protects sensitive or confidential assets from a malicious attack. Q: How can companies and government agencies combine both physical data security and cybersecurity initiatives? Physical security managers can advise cybersecurity managers on ways to reinforce their protocols – perhaps by implementing the newest surveillance cameras in sensitive areas, or removing ports on servers so that external drives cannot be used. Organisations need to create an effective program and ensure it stays effective so people know it’s not worth the hassle to try In turn, the cybersecurity team can let the physical security team know that they have outside contractors coming in to work on the server, and the physical security team can escort the contractors in and stand guard as they work. Constant communication and a symbiotic relationship between the two departments are crucial to creating an effective holistic security protocol and, once you’ve got the momentum going, don’t let it slow down. Sometimes efforts start off strong and then peter out if priorities change. When guards are down, it’s an excellent time for a malicious actor to strike. Organisations need to create an effective program and ensure it stays effective so people know it’s not worth the hassle to try. It’s not just about the mentality, though. Using the right technology is just as important. Q: What type of technology can you use to protect physical data? Many problems can be avoided by simply using the right technology to detect devices that bring threats in and carry proprietary information out. Electronics such as hard drives, cell phones, smart watches, SD cards and recording devices have a magnetic signature because of the ferrous metals inside them. Using a ferromagnetic detection system (FMDS) as people enter and exit a building or restricted area means that anything down to a small microSD card triggers an alert, allowing confiscation or further action as needed. Electronics such as hard drives, cell phones, smart watches, SD cards and recording devices have a magnetic signature because of the ferrous metals inside them Q: How does FMDS work? In the most basic terms, FMDS uses passive sensors that evaluate disturbances in the earth’s magnetic field made by something magnetic moving through its detection zone. Nothing can be used to shield the threat, because FMDS doesn’t detect metallic mass; it detects the magnetic signature, down to a millionth of the earth’s magnetic field. FMDS is the most reliable method of finding small electronics items and should be part of the “trust, but verify” model Although it is a passive technology, it is more effective and reliable than using hand wands or the walk-through metal detectors typically seen in an airport, which cannot detect very small ferrous metal objects. FMDS can see through body tissue and liquids, so items cannot be concealed anywhere on a person or with their belongings. Whether or not the items are turned on doesn’t matter; FMDS doesn’t work by detecting a signal, but rather by spotting the magnetic signature that electronics contain. This is ideal, because most recording devices do not emit any signal whatsoever. In my experience, FMDS is the most reliable method of finding small electronics items (as well as other ferrous metal objects, like weapons), and should be part of the “trust, but verify” model, in which companies assume the best of their employees and anyone else entering the building, but still take necessary precautions. Q: What are the key takeaways for organisations looking to enhance data security? The toughest challenge in the security sector – whether it’s cyber or physical – is remembering that the bad guys are constantly looking for ways to slip in through the cracks, and security departments need to stay one step ahead to ward off both internal and external threats. Recognising the existing threats, putting together a holistic security strategy, and using the right technology to detect illicit devices comprises an effective three-pronged approach to protecting an organisation’s data. Organisations cannot afford to be passive about security and assume employees won’t steal data and spies won’t sneak in. Strong countermeasures are necessary because data loss can come from both inside and outside, in both private and public sectors, from places not everyone thinks of – and with technology like FMDS acting as a backup to the human element, organisations can lock down their data and keep the wolves in sheep’s clothing from getting through the door.
The ban on U.S. government usage of Chinese-made video surveillance products was signed into law last year and was scheduled to take effect a year later – on August 13, 2019. With that deadline looming, there are questions about whether government agencies and departments will comply in time. A year ago, the U.S. Congress passed, and the President signed, a ban on government uses of video surveillance equipment produced by two of the world’s top manufacturers – Hikvision and Dahua. The provision was buried in the National Defense Authorization Act (NDAA) for fiscal year 2019, which the President signed into law on August 13, 2018. The ban, which takes effect ‘not later than one year after … enactment’, applies not only to future uses of Dahua and Hikvision equipment but also to legacy installations. Tracking software to detect banned products Forescout Technologies, San Jose, California, provides software to track various banned devicesThe bill calls for an assessment of the current presence of the banned technologies and development of a ‘phase-out plan’ to eliminate the equipment from government uses. One problem is identifying where the surveillance equipment is being used, which involves either a tedious manual process to search out the equipment or the installation of tracking software to identify it on the network. A federal Department of Homeland Security program called ‘Continuous Diagnostics and Mitigation’ requires use of a detection tool to find any banned products on a network. Forescout Technologies, San Jose, California, provides software to track various banned devices, but not all required agencies have complied with a mandate to secure their networks by tracking every connected device (only 35% had complied as of 2018.) “Without an automated, real-time tool that can detect all of the IT devices – computer or ‘other’ – on your network, there is simply no way to be 100 percent certain that you are compliant with these product bans,” says Katherine Gronberg, Forescout’s Vice President, Government Affairs. Difficult to determine device’s manufacturer Not all equipment is marked to identify its manufacturer; some has been rebrandedAnother problem is the existence of OEM agreements and other supply chain complications that can make it difficult to determine the manufacturer of any given device. A report by Bloomberg says: “A complex web of supply chain logistics and licensing agreements makes it almost impossible to know whether a security camera is actually made in China or contains components that would violate U.S. rules.” Not all equipment is marked to identify its manufacturer; some has been rebranded. “There are all kinds of shadowy licensing agreements that prevent us from knowing the true scope of China’s foothold in this market,” said Peter Kusnic, a technology writer at business research firm The Freedonia Group. “I’m not sure it will even be possible to ever fully identify all of these cameras, let alone remove them. The sheer number is insurmountable.” Companies banned under NDAA The NDAA ban covers “public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.” It bans “video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, [and] Dahua Technology Company (or any subsidiary or affiliate of such entities).” Hytera Communications is a Chinese digital mobile radio manufacturer. Huawei Technologies Co. equipment has also been banned, including the HiSilicon chips widely used in video cameras. In addition to banning the Chinese equipment in government installations, the NDAA also includes a ‘blacklist’ provision [paragraph (a)(1)(B)], which could be interpreted to extend the ban to companies that use Chinese-made products in other, non-government applications. Rulemaking on that aspect is still under way, including a public hearing in July.
Unmanned aerial vehicles (UAVs), or drones, present a range of threats, from the careless and clueless to the criminal. While many incidents may seem harmless, the threat to any location at any time depends on a range of factors. Drones are inexpensive for criminals to buy or make, and there are continuously improving battery, airspeed, and payload capabilities. UAVs can also fly without an RF signal to jam or hack. Fortunately, sensor technologies including radar are available for security agencies and personnel to protect assets and the public. Radio-wave signals Radar works as a deterrent by sending out a radio-wave signal using a transmitter antenna, and a small portion of that signal reflects off objects in its path and returns to a receiver antenna. The highest performing radars use an antenna technology called Active Electronically Scanning Array (AESA), which enables all-electronic reconfiguration of the antennas. When an AESA radar detects an object, it can ‘focus’ its antennas to track the object, in much the same way as the zoom on a camera does. Multiple objects can be tracked while continuing to scan. Kirkland, Washington-based Echodyne offers a radar product that brings these ESA capabilities to non-military security applications at commercial price points. Combining proprietary hardware with intelligent software, Echodyne produces a compact, solid-state, electronically scanning array Echodyne’s ESA radar Echodyne says they are reinventing radar price-performance for security applications in the ground (people, vehicles) or air (counter-UAS) domains. Combining proprietary hardware with intelligent software, Echodyne produces a compact, solid-state, electronically scanning array (ESA) radar that is affordable for commercial, law enforcement, and governmental customers. The company is backed by high profile investors, including Bill Gates, Madrona Venture Group, Vulcan Capital, NEA, and Lux Capital. “Radar is a sensor,” says Leo McCloskey, Echodyne VP Marketing. “It is most applicable when security professionals can both understand its capabilities and define risk assessment and deployment requirements that call for those capabilities. Our customers are primarily security system integrators and consultancies, which integrate the performance of radar into a sensor array that meets mission requirements.” Radar technology for border surveillance Echodyne was selected by the Science and Technology Directorate of the Department of Homeland Security (DHS) for its Silicon Valley Innovation Program (SVIP) to demonstrate the performance of its radar technology for border surveillance applications. The radar was deployed both in fixed remote surveillance towers and as a lightweight rapid deployment kit for field agents. Able to surveil ground and air domains, the radar combines versatility and commercial price with surveillance capabilities. “We set out to build the world’s best compact, solid-state ESA radar sensor, and we are demonstrating that we’ve reached that objective,” says McCloskey. “We’re excited to introduce these capabilities for other security applications.” Able to surveil ground and air domains, the radar combines versatility and commercial price with surveillance capabilities MESA technology Echodyne’s proprietary technology provides a small true electronically scanning array (ESA) radar. Unlike expensive Active ESA (AESA) phased array radars, MESA requires no physical phase shifters, thus reducing the cost, size, weight, and power by several orders of magnitude while maintaining all the benefits of fast ESA radar. Echodyne combines its MESA technology with an intelligent software suite, Acuity, to produce a configurable, software-defined radar for commercial, law enforcement, and governmental security applications. The capability is also useful for temporary events such as rallies and marathons, and many other market applications “Technology seems to make everything more available to more people over time,” says McCloskey. “What is a retail product today will be a purchased self-assembly kit tomorrow and an improvised self-made drone the following day. The Federal Aviation Administration (FAA) is diligently at work on creating rules for safe UAV operation, though any final rules remain some distance off. As drone volumes increase, delineating friend from foe in the airspace requires clear legal and regulatory frameworks, which are nascent but would help distinguish the threat of nuisance flyers from illegal overflight.” Radar sensor for security applications “Detecting and tracking airspace objects of interest is imperative for airports, chemical plants, oil and gas installations, refineries, water and energy utilities, stadiums and other public spaces”, says McCloskey. The capability is also useful for temporary events such as rallies and marathons, and many other market applications. “As with any product, our applicability will depend on variables like location, terrain, risk assessment, and existing security technologies,” says McCloskey. “Our mission is to deliver the very best radar sensor for security applications.”
There are many new technologies at ISC West this year. There are also some tried-and-true solutions on display. More mature products have the benefit of being fully vetted and battle-tested, which may make them a more comfortable choice for security customers. I had a couple of discussions on Day 2 of the show about the advantages, and possible drawbacks, of new products. “To a security director, when you say ‘new,’ he translates that into ‘risk,’” says Bill Spence, VP of Sales, U.S., Canada and Western Europe for HID Global’s Lumidigm biometrics brand. “Anytime you say new, there is a probability of risk. The key is to educate. Education quantifies risk, and an educated customer can make an intelligent decision about risk versus reward.” “We have to take customers from where they are to help them understand new technologies,” says Spence. “We must give them a bridge to that understanding, and education is the bridge.” Lumidigm biometrics integrations An app provides graphics that take installers step-by-step through the installation process HID Global is incorporating Lumidigm biometrics into the new iClass SE RB25F fingerprint reader being highlighted at the show. Two-factor authentication can use either a card or mobile credential along with biometrics; there is no latency; and templates can be stored on a card. Another new offering at the HID Global booth is an augmented reality tool to simplify installation of newer systems that incorporate the more secure OSDP protocol. An app provides graphics that take installers step-by-step through the installation process. Also highlighted at the HID Global booth — and at the booths of turnstile manufacturers throughout the show — are embedded readers that provide tested and certified mobile access control for turnstiles. IClass SE technology is embedded in the iRox-T Turnstile Reader from Essex Electronics. Innovative security technologies There’s a delicate balance at any trade show between creating excitement about new products and educating customers to be comfortable with new technologies. There is some of both at ISC West 2019. In the future, hardware will be a delivery device, not the core of systems “We are on the cusp of change in the industry, and it’s closer than ever,” says Jennifer Doctor, Johnson Controls’ Senior Director, Project Management - Intrusion. “We will see the impact of promised technologies that will come from other industries, such as artificial intelligence. The very definition of security is changing. We are an industry that needs to be risk-averse, and we need to prove out the technology. There is innovation, but we just need to make sure technologies are what the market wants and expects.” “In the future, hardware will be a delivery device, not the core of systems, which will come from intelligence in the software and from services,” she adds. “The products we deliver will enable that.” Have 30 percent of service companies in the U.S. security market jumped into the cloud? PowerSeries Pro intrusion portfolio Johnson Controls is highlighting the commercial PowerSeries Pro intrusion portfolio, which features PowerG encrypted technology that enables wireless systems that are cyber-secure. The cloud is coming on strong, and one company finding success in cloud systems is Eagle Eye Networks, which has seen 93% compounded annual growth over the past three years. Economies of scale have enabled them to lower subscription prices by 35%, with an extra 10% decrease for customers that pay annually. Ken Francis, President of Eagle Eye Networks, says they are signing up 50 new dealers a month for the cloud video offering. Francis estimates that 30 percent of service companies in the U.S. security market have jumped into the cloud “It’s really heating up,” says Francis. “The general cloud is driving increases in the surveillance cloud.” Jumping to cloud Embracing the cloud and recurring monthly revenue (RMR) requires that dealers transform their businesses to ensure success. Francis says dealers should dedicate sales resources to cloud offerings rather than expect everyone to sell the cloud, and there should be a base commission plan on RMR services in lieu of upfront project fees. March Networks is also showing integration of video with the Shopify cloud-based point-of-sale (POS) system “Talk to professionals about your cash flow and understand how to capitalise on financing partners to ensure cash flow while investing in the RMR stream,” he adds. “And look for ways to reduce your costs to serve the customer base as your RMR increases.” For example, use of remote site diagnostics, configuration and support can avoid the need for expensive “truck rolls” that can undermine profitability. Francis estimates that 30 percent of service companies in the U.S. security market have jumped into the cloud. Alarm companies, which are accustomed to the RMR model, are generally ahead of the curve, while traditional security integrators are lagging. “It’s a requirement to change or die,” he notes. Insight hosted managed service Also, in the area of managed services, March Networks is highlighting its Insight hosted managed service that can provide instant information on video systems located at remote sites, including visibility into firmware versions, camera warranty information, and cybersecurity status of systems. The ability to dive deeply into system status empowers a new recurring revenue stream for integrators. Color-coded icons summarise system status and show pending issues and clicking on the icons provides detailed workflow information. The system can also be offered for smaller systems such as those at convenience stores and quick-serve restaurants. March Networks is also showing integration of video with the Shopify cloud-based point-of-sale (POS) system. The integration enables managers to evaluate POS information, especially anomalies, to determine possible employee theft and other shrinkage issues.
Pulse Secure, the provider of software-defined Secure Access solutions, has announced the successful delivery of a project to help Hogarth Worldwide refresh its secure access platform as part of a Zero Trust approach to security. Hogarth Worldwide is a creative production business, providing marketing production and adaptation services for some of the world’s most recognisable brands and global multinationals. Security is a critical part of this service and Hogarth manages its own multi-layered secure access platform. Having grown rapidly over the last decade, the company had reached capacity on its legacy Juniper VPN solution that was also heading towards end of support. With the need to upgrade fast approaching, Hogarth decided to both refresh its secure access platforms to meet greater demand and gain access to more advanced capabilities. Requirement of VPN and NAC platform Hogarth contacted ANSecurity, a trusted cyber security advisor that it had worked with previously on several projectsPeter Smith, Global Network Architect at Hogarth, said, “We initially created a shortlist of vendors from the Gartner Magic Quadrant and started examining a few options. Our key criteria was a VPN and NAC platform that was easy to deploy and manage, with strong compatibility across a wide range of devices, plus the ability to adapt.” Hogarth contacted ANSecurity, a trusted cyber security advisor that it had worked with previously on several projects. The team at ANSecurity provided guidance to help scope the project and design a technical implementation. “We looked at a number of options, but we felt that Pulse Secure offered the best combination of features and compatibility along with the flexibility we needed to meet our current requirements and future needs,” said Smith. Pulse Connect Secure (PCS) virtual appliances Based on these requirements, Hogarth selected Pulse Connect Secure (PCS) virtual appliances deployed within its main data centres in London and several branch offices across the world to provide VPN access. This is supported by Pulse Policy Secure (PPS), a next-generation NAC appliance that enables Hogarth to gain deeper visibility and understanding of its security posture. The combined solution is deployed as part of a Zero Trust approach to security allowing Hogarth to ensure its distributed workforce is authenticated, authorised and secure when accessing applications and resources across its own data centre and cloud-based resources. The data from all these systems is passed to a SIEM to allow the IT department to quickly detect any issues The solution is integrated into its Ruckus based Wi-Fi network, Radius authentication server and multi-factor authentication which runs in Azure. The data from all these systems is passed to a SIEM to allow the IT department to quickly detect any issues and automate threat response to mitigate malware, rogue devices, unauthorised access and data leakage risks. Meeting the requirements of TISAX “The virtual appliance offered better performance than our legacy solution and the Pulse Secure VPN and NAC appliances were easy to deploy with a low management overhead,” commented Smith. “We have a high availability configuration and the built-in licence server makes it easy to add more users or devices as needed.” The new solution has also helped Hogarth to meet the requirements of TISAX (Trusted Information Security Assessment Exchange) that enables mutual acceptance of Information Security Assessments which was a key requirement for several of its clients within the automotive industry. “The upgrade to Pulse Secure has gone very smoothly, we have had no issues and the solution has delivered as expected with the potential to adapt as our security needs evolve,” Smith concluded.
There is a saying that ‘Everything is Bigger in Texas’, and the Dallas, Texas police department is no exception. The city of Dallas is ranked in the top 10 cities in the U.S. in terms of population, at 1.2 million people. The Dallas Police Department is the ninth largest municipal police force in the U.S., based on 3,012 sworn officers. It is led by Chief of Police, U. Reneé Hall. The department is located in the Jack Evans Police Headquarters building, which was built in 2003. It is 358,000 square feet, has six floors, is spread over a three-acre site, has a separate 1,200 car parking garage and a two-acre, open parking lot for additional visitor parking. Prior to 2003, the department was housed in the circa 1914 former City Hall Building. Preventing terrorist attack and hazards Police officials worked with a Police Design Consultant to help design the building to resist terrorist attacksThe Jack Evans Police Headquarters building was under construction when 9/11 terrorists flew airplanes into the World Trade Buildings in New York. That event was preceded by the Oklahoma City Murrah Federal Building bombing in April 1995. Therefore, security was a concern in its design. Police officials worked with a Police Design Consultant – McClaren, Wilson, and Lawrie Architects of Phoenix – to help design the building to resist a terrorist attack and isolate potential hazards. The building also needed to control visitor traffic and access. On an average month, there are 5,000 public visitors to the Jack Evans building. In addition, shots fired at police buildings nationally are not uncommon, says Paul M. Schuster, Senior Corporal/Facilities Management for the Dallas Police Department. Ready to anticipate dangerous crimes “For the most part they are random, single shot drive-by shootings. Often, the officers are unaware that the building has been shot at, until they find a bullet hole in the brick or glass. Increasingly, police tend to be a symbol of government and some citizens see that as a visible target to lash out at. Police officers are trained to expect the routine types of calls, such as domestic violence, traffic accidents, and other crimes. Yet they must be flexible to anticipate the non-routine that can be dangerous and change in a heartbeat.” On June 13, 2015, after midnight, a 35-year-old male placed a duffle bag with a remote-controlled bomb to detonate later between cars in the parking lot of the headquarters building. The suspect then began shooting continuously at the lobby windows. Officers responded to the scene, a vehicle chase began, and the incident ended outside the city. Luckily officers in the lobby took cover and were not injured. Conducting building security assessment The assessment included testing various construction materials for bullet resistance to various types of weaponsFollowing that incident, the Dallas Police Department conducted a security assessment of the building and also at seven patrol stations throughout the city. The assessment included testing various construction materials for bullet resistance to various types of weapons. Gensler Architects and Guidepost Solutions, LLC developed the solutions and plans. “Yesterday we were concerned about handguns, today we are worried about rifles, and the idea of terrorism is always present with outright attack or bombs,” Schuster notes. “The police officers and police staff only want a place that is safe and where they can do their good work.” Funding of $1.3 million was approved to upgrade the lobbies of the seven patrol stations to withstand rifle rounds, and $1.9 million to improve headquarters lobby security, and to upgrade an aging security system. Turner Construction Company and Convergint Technologies, LLC conducted the renovations and security technology integration. Challenges in upgrading lobby security Visitors were allowed free entry into the lobby and were only screened in an open area to the side if going to other floorsThe headquarters’ lobby was initially designed as a two-storey glass-walled structure, with an information desk and public records service windows. Visitors were allowed free entry into the lobby and were only screened in an open area to the side if going to other floors. “The challenge in upgrading lobby security was the two-storey lobby entrance glass. The glass was not bullet rated, due to budget constraints. Changing the front of the building to support ballistic rifle-rated glass would have caused extensive time, exposed the inside of the lobby to weather, and would not have solved all of the security issues,” Schuster says. “In addition, there were concerns about keeping an ‘open’ and friendly service concept in mind and ensuring that the lobby would not resemble a ‘fortress’,” Schuster notes. Bullet-rated glass and bullet resistant wall The solution was to keep the existing exterior unchanged and focus on adding a layer of security once a person enters the lobby. Visitors now enter the headquarters and immediately proceed to a side room where security screening is conducted. Once inside the screening room, the visitor has belongings x-rayed, and they walk through a metal detector A new secondary wall with bullet-rated glass and solid bullet resistant wall materials was constructed inside the lobby to channel visitors to the room. Once inside the screening room, which also has bullet resistant walls, the visitor has belongings x-rayed, and they walk through a metal detector. In the event that anyone was to produce a gun and begin shooting, the incident could be contained inside that room. Tourlock 180+90 security revolving door Once a visitor has been cleared, they proceed into the main lobby via a Boon Edam Tourlock 180+90 security revolving door. This automatic, four-wing door is the most advanced, security revolving door in the Boon Edam product range that offers maximum throughput, allowing users to enter and leave the building simultaneously. In the event that a large number of persons try to force their way into the facility, the Tourlock 180+90 will determine that more than one person is trying to enter and will reject the person and lock out any others from entering. Once a visitor is ready to leave the lobby and exit the building, they pass through another Boon Edam Tourlock 180+90 that leads to a vestibule with exterior swinging doors. In the event that someone tries to go back into the lobby from the front vestibule area, without going through the security screening room, the Tourlock security revolving door will reject their entry. Preventing tailgating and piggybacking The Boon Edam security revolving doors accurately prevent both tailgating and piggybackingThe Jack Evans Headquarters security upgrades for the lobby improved security and still kept the best aspects of the lobby design, including the antique police car, and the overhead police helicopter. The Boon Edam security revolving doors accurately prevent both tailgating and piggybacking, and provide the department with maximum security while controlling traffic flow. “While it would be great to have a building totally open to the public and then add security as needed, such is not the world we live in anymore,” Schuster adds. Future security plans include exterior site security upgrades to the patrol stations and the headquarters to include security fencing with card access controls for fleet and employee vehicles at each of the sites.
Ports of Jersey operate the island’s busy harbours and airports, providing high-quality services and facilities to enrich the experiences and journeys of their customers, with Jersey Marinas offering 1,000 berths across three award-winning locations close to the vibrant waterfront at St Helier. At very busy times of the year, such as the annual Jersey Regatta, the sheer volume of visitor traffic arriving from both land and sea can present serious problems. With particular challenges arising from managing car parking, and the issuance of port entry digital keys for boats harbouring. Smart access control solution Ports of Jersey needed a smart access control solution capable of managing short-term parking at St Helier harbour Ports of Jersey needed a smart access control solution capable of managing short-term parking at St Helier harbour. The system needed to be intelligent enough to manage complex bookings for use by berth and mooring holders dropping off and loading gear onto boats, before parking elsewhere long-term. The existing solution was no longer cost effective, and was open to abuse by some users. In addition, Ports of Jersey also required an upgrade to the out of date Jersey Marinas security gate access control system. At peak times this system needed to be able to cope with rapid, high capacity issuance of smart cards to vessel owners and boat crews wishing to access the marina and marina hospitality faculties. Smart installation SALTO partner JMH Technology was asked to provide a new car park access control solution and resolve the looming problem of needing to issue 1,000 cards, at a cost of over £100,000. A replacement car park access control system was installed based on new technology smart cards and 2,000 cards issued. This project was highly cost-effective with installation and card issuance totalling less than just card issuance on the previous system. Future savings also assured thanks to a choice of more cost-effective cards. Abuse of short-term parking has been cut, and the experience for visitors is improved. JMH Technology is in the process of adding more reader-controlled doors To drive yet more efficiency and further reduce overheads the system has subsequently been updated at both St Helier and Albert Pier car park, with smart installation of the latest SALTO access control technology. The upgrade continues, and JMH Technology is in the process of adding more reader-controlled doors and smart handles across the facility. Security assessment A full security assessment was carried out at Jersey Marinas, and a decision taken to replace all of the expensive and temperamental mechanical code locks with a full online access control system. By engineering a bespoke solution that integrated a SALTO kiosk system with a touch screen unit interface, Jersey Marinas staff are now able to allocate more than 500 cards during the high-tide window. With extra capacity on tap when they need it to cope with high demand at peak times, and valuable cost savings made. The SALTO system provided is technically robust and cost-effective to expand. As a partitioned system Ports of Jersey now have a global overview, with each department able to see the section relevant to them. This enables micro management of cost savings across equipment and cards and allows staff to get permissioned access to all necessary parts of the Ports infrastructure without delay.
Retail banking combines a demand for high security with complex workflows. Staff need efficient access. Facility managers need the flexibility to design access permissions around individual needs, so not everyone can access every area whenever they choose. Nobody wants to carry or track large numbers of keys. These were the requirements, managers of Creval — a regional bank in Italy — faced when seeking an alternative to a mechanical master-key system. Creval needed new access control devices to become an integral part of a security system for assets and people with the highest level of protection. They sought locks to offer a durable, secure and flexible alternative to standard mechanical security. They found an easy, electronic way to administer a powerful, user-friendly system based on battery-powered physical keys and secure, advanced microelectronics. Flexible high-security locking Staff carry a single, battery-powered eCLIQ key, programmed with only the right preauthorised access permissionsCreval chose eCLIQ key-based wireless access control for its banking premises. Bank doors across the Lombardy region are guarded by more than 30 durable eCLIQ cylinders, putting Creval managers in complete control of entrance security. eCLIQ is a scalable electronic extension of the CLIQ access control system deployed in critical infrastructure sites across Europe. Cylinders are fully electronic, protected against manipulation and with 128-bit AES encryption built into both lock and key microelectronics. Staff carry a single, battery-powered eCLIQ key, programmed with only the right preauthorised access permissions. Time-limited access rights Creval’s security manager is now able to grant access based on scheduled times and specific doors, and right down to the level of the individual site user. It is also straightforward to set time-limited access rights for a user key, increasing security if a key is lost. Audit trails and event logs are collected to the same, fine-grained degree. Key management is easy with software operated from a local PC or securely on the web via a standard browser. In the unlikely event a key is misplaced, Creval administrators simply delete its validity from the system. “We are satisfied with the results of the new access control system,” says Claudio Brisia, Logical Security Manager at Creval headquarters in Sondrio.
The Security Industry Association (SIA) has expressed strong support for MI HB 5828 and HB5830, two bills designed to improve school security across the state of Michigan. Michigan Legislation In a letter to Michigan House of Representatives Committee on Appropriations Chairwoman Laura Cox and Vice-Chair Rob VerHeulen, SIA CEO Don Erickson praised the bills’ creation of a comprehensive school plan and fund to enable local districts to procure security solutions to protect students from malicious perpetrators and update building code requirements to include security measures. “Sadly, our nation’s schools have increasingly become a soft target for mass violence – at Sandy Hook Elementary, recently at Stoneman Douglas High School and in many other attacks,” said Erickson. “We support holistic approaches to improving school safety and security in response to these tragedies – recognising there is no single action that can be taken that will, by itself, make our schools safe.” SIA is a co-founder of the Partner Alliance for Safer Schools (PASS), a consortium of school security experts Improving school security SIA represents about 900 security and life safety solutions providers – companies that develop, manufacture and integrate technologies that help keep people and property safe from hazards. These industry leaders strive to introduce robust security solutions integrated into our nation’s K–12 public schools, private academic institutions, colleges and universities. In addition to serving member organisations working to improve security in schools and other environments, SIA is a co-founder of the Partner Alliance for Safer Schools (PASS), a consortium of school security experts that developed threat- and income-based guidelines for schools housing grades K–12 to implement appropriate, layered security measures. These guidelines are available to help guide school investments. Additionally, PASS provides integrators with risk assessments and white papers that can be used when working with schools to evaluate and establish the best security protections for their buildings. SIA believes state assistance like that in the Michigan legislation is a start to addressing key security gaps in schools and is especially critical to high-risk school districts or those with limited budgets.
A new Concierge and Physical Security Information Management (PSIM) solution from Intergrated Security Manufacturing (ISM) is protecting two tower blocks in Haringey, enabling authorised council employees to control door access and manage fire and security systems from anywhere within the council’s estate. Newbury House, Finsbury House, John Keats House and Thomas Hardy House in Wood Green, London, already feature four of ISM’s state-of-the-art Ultimate door entry systems as well as another two, third-party technology systems (Elizabeth Blackwell and George Lansbury) from Entrotec, utilising its Apex Dual path speech technology. Thanks to the Genesys PSIM from ISM, multiple technologies can be controlled, regardless of the manufacturer, providing enhanced security to residents in 510 flats across the six towers. This delivers greater flexibility and control, eliminates the potential disruption caused by installing new equipment, and protects the council’s legacy investment. It also means that further buildings with existing ISM or Entrotec systems can be added as required with only minimal additional investment. Integrated security system Genesys allows the integration not just of door entry systems, but also multiple systems from multiple manufacturers – all from one holistic integrated security system. Every electronic security or fire safety device from CCTV and intruder alarms to electronic locking and public address can be monitored and controlled from a single platform. Most importantly, it features Migrating 3+ technology, a patented automatic failover technology that adds higher levels of automatic configurable redundancy and power. Control is effectively distributed across multiple workstations. "To improve our efficiency and give faster responsesto our residents we neededto provide conciergeservices to all our estates" Len Fevrier at Homes for Haringey has been impressed with the system and how it has performed so far: “We have used the ISM Ultimate door entry products and its Genesys 2 control room software platform extensively in the Borough over many years and have enjoyed excellent product reliability and technical support. To improve our efficiency and give faster responses to our residents we needed to provide concierge services to all our estates,” he says. “The development of the Entrotec integration into the Genesys platform, allowed Haringey to combine technology, including CCTV and fire, without going to the expense of replacing legacy door entry equipment unnecessarily. This delivers a much-needed saving during these challenging economic times for local councils, and we plan to roll this system out across the rest of the Broadwater Farm Estate and potentially other sites in the borough.” Intuitive software Managing Director of ISM, Stephen Smith, says this project is a perfect example of the flexibility of Genesys and its door entry system range: “Genesys is a ‘true’ PSIM system built around intuitive software that combines a range of industry leading features and benefits including an enhanced graphical user experience and 3-D modeling and a comprehensive event management database. Events and alarms from any integrated security application are presented to the operator clearly as and when they happen.” The PSIM software operates as a standalone platform over LAN or WAN networks for remote and local sites with workstations that can be transferred to any operating security control room on the network. This offers the end user flexibility when closing down sites or buildings for off-peak or out of normal working hours or in the unlikely event of any system failures. Ultimate is a fully addressable digital telephone entry system that is robust in design and easy to install. Unlike other door entry systems on the market it has multi speech paths that allow numerous conversations to be had at one time Such was the complexity of the project, that from initial design of the system to completing the installation took around two years to complete. Fire alarms, access control and CCTV can all now be controlled from one computer from any of the Council’s network.