The Line Between Physical Security & Cybersecurity Blurs as World Gets More Digital

As the technological landscape has evolved, the security industry has evolved with it. Analog devices are largely a thing of the past, and the rise of connected devices has enabled security technology to make incredible advances in recent years. Today, surveillance video can be analyzed in real time, generating automatic alerts when suspicious behavior is detected. Intelligent audio solutions can detect raised voices or breaking glass. Access control stations can keep intruders out of restricted areas while notifying the appropriate authorities.

Protecting people and property is as important as ever, and devices like IP cameras and other sensors have put powerful new capabilities in the hands of security teams. But the connected nature of these devices has brought new challenges to bear on security teams, and preventing them from being compromised — or even commandeered — by cybercriminals has become an essential part of keeping people and property safe.

Understanding the Threat
The idea that physical security devices can be hacked is hardly new. The high-profile Ring hack in 2019 resulted in the compromise of doorbells and home security cameras across four states, underscoring the fact that even companies like Amazon, with seemingly infinite resources, are not immune to this type of vulnerability.

This is a problem across a wide range of industries. As more devices are connected to the Internet, they become attractive targets for criminals. Webcams are so widely understood to be vulnerable that "webcam covers" are now commonplace. Studies have shown that vehicles can be hacked while driving down the highway. Even pacemakers have proven susceptible to attack — while implanted in the human body. If devices ranging from doorbells to artificial hearts can be targeted by cybercriminals, it should come as little surprise to those in the security industry that surveillance cameras and door stations are potential targets as well.

Connected devices often serve as a pivot point for cyberattacks. If one IP camera is compromised, it likely means the entire network is compromised. And while controlling the surveillance cameras protecting a property might enable some Ocean's 11-style heist hijinks, it is more likely to lead to a serious data breach as the intruder moves throughout the network looking for high-value information, such as intellectual property data or customers' personal or financial information. In the case of power plants, chemical plants, and other properties using industrial control systems, a compromised network has the potential to lead to even more disastrous — and explosive — results.

The Role of Manufacturers and Integrators in Keeping Things Cybersecure
For physical security, this means, for starters, that everyone involved in the manufacturing, installation, operation, and maintenance of physical security devices needs at least a base-level understanding of cybersecurity challenges. If each new device that connects to a network represents a potential inroad for would-be cybercriminals, protecting those devices at every level becomes essential. Which makes it more important than ever for an organization's security department to work closely with the IT team.

For manufacturers, the importance of forcing users to change default credentials before first use has never been higher. The Mirai botnet, one of the most well-known and successful pieces of malware in history, infected millions of connected devices across the globe by exploiting common default username/password combinations. While manufacturers have been aware of the importance of changing default passwords, we are now seeing mechanisms being put in place to ensure a device doesn't function until the password is changed. Going even further, some states, including California, have reinforced that knowledge with legislation mandating their use.

Similarly, integrators must be able to keep devices protected during and after the installation process, avoiding the sort of misconfigurations that cyberattackers are known to exploit. IT departments and users themselves also bear a degree of responsibility when it comes to securing their devices by installing product updates and patches in a timely manner. Organizations must ensure that their employees understand the importance of protecting every device on the network, while also effectively vetting the security knowledge and capabilities of both their manufacturer and integrator partners.

Bridging the Gap Between Physical and Digital
The proliferation of advanced, Internet-enabled devices like IP cameras and access control stations has put exciting new tools in the hands of security teams; however, it's critical for security professionals to understand the potential challenges they bring with them. Connected devices have become a common target for cybercriminals hoping to steal valuable data or even cause potential destruction of property. Protecting those devices through effective cybersecurity now goes hand-in-hand with physical security, creating a convergence of the physical and digital realms that reflects the increasingly interconnected state of today's world.