It’s not your imagination. Cybercrime comes with a huge price tag and it’s growing. Insights from IBM’s Cost of a Data Breach Report says 2021 saw the highest average cost of a breach at $4.24 million. The annual cybercrime report from FBI reveals the FBI received 300,000 cybercrime reports in 2016. The number has jumped to almost 800,000 in 2020!
The numbers don’t surprise anyone. More organizations are doing business online and employees are not working at the office. They’re relying more on cloud computing and cloud-based services, but many still rely on traditional servers, laptops, and workstations, which require updates. With that comes more opportunities for cyberattacks. No industry is immune.
“Cybercrime, whether nation state sponsored or permitted, is a threat to national security. Cybercriminals are targeting and attacking all sectors of critical infrastructure, including healthcare and public health, information technology (IT), financial services, and energy sectors,” writes Amy Hogan-Burney. “Ransomware attacks are increasingly successful, crippling governments and businesses, and the profits from these attacks are soaring.”
These problems affect both physical security and cybersecurity.
How Are Physical Security and Cyber Security Attacks Tied Together?
Norton reports data from IoT Analytics shows the market will have more than 11 billion Internet of Things (IoT) devices. These are connected devices that can be hacked. They can also provide physical security. Hence, cyber threats are also physical security threats.
That’s because connected devices providing physical security, such as security cameras, give bad actors a point of entry. In terms of video surveillance used for physical security, when a hacker attempts to gain access to video security cameras, they could block operators from seeing what’s happening on a site.
It may not be a physical attack in which an attacker breaks into a server room and installs rogue devices that capture confidential data. The hacker behind the act could request a certain amount of money to restore the company’s data.
A hacker can do serious damage without ever stepping into a server room. They can go into an employee’s computer. It doesn’t even have to be an IT professional’s computer. They could go to a human resources employee’s computer where hackers could access personnel data and sensitive information. They may find their way to finance and wire money into their own accounts. Many technologies think if you’re physically there, it must be OK to let you in.
All of these intersect cybersecurity and physical security. Criminals are finding ways to take advantage of weaknesses in physical security to do a cyberattack. Any of these can be costly for a company. Not just in dollars, but also in reputation and customer loyalty.
What Is Convergence in Security and Why Is It Needed?
What can you do about these crimes that involve physical security and cybersecurity? This isn’t something that is the responsibility of the IT department that handles cybersecurity matters. A better way would be to start thinking about the convergence of security.
Convergence is a formal cooperation between previously separate security functions. As an example, physical security and cybersecurity are often silos. Companies view them as unrelated with each having its own experts and functions. Now, companies are realizing they need to integrate them for maximum security. Therefore, holistic security management requires the convergence of physical security and cybersecurity.
Convergence has nothing to do with the organization chart. It is about multiple functions working together to coordinate activities including loss prevention, fraud prevention, compliance, business continuity planning, and insurance. A holistic security strategy in a convergence setup between cybersecurity and physical security will ensure security goals are aligned.
Cost savings is a byproduct of convergence. You lower staffing costs especially when you add a centralized remote video surveillance system. This can reduce or eliminate the need for security guards. Instead of recording video to a DVR, they’re saved to server disks, which are far cheaper to replace than a DVR.
How Physical Security and Cybersecurity Convergence Works
Here’s how convergence between cybersecurity and physical security can work. The company will adopt a cybersecurity framework that takes a physical security approach with video surveillance to watch over operations and an IT approach to minimizing threats.
If a bad actor breaks into onsite technology, the monitoring operator observing the security monitors can report any change in equipment and technology behavior before something happens. When you couple that with an access control system, you can manage access to server rooms that may have vital company and customer information.
It’s crucial to have strong IT security because it will be hard for a company to recover from a cyberattack. The price will be high when a business becomes a victim of online scams, phishing, malware, malicious domains, or misinformation. When something like this happens, you must notify customers and stockholders and tell them about the breach.
You will also need to hire consultants to help with the recovery efforts and a forensic investigation to determine the source and extent of the breach. Additionally, the Payment Card Industry Security Standards Council may inflict fines and penalties on your company.
Think of the effects this will have on customers. They will have to shut down their accounts associated with their credit or debit cards and replace them. Forcing customers to do this will most certainly lead to a complete loss of customer trust. They could take their business elsewhere.
It’s critical to avoid taking an ad hoc approach to fighting cyber threats as many companies often tend to do. To get ahead of the threats, companies need to create a security strategy that includes human factors. Just like any other business risk, they must identify and understand the cyber risks.
Your organization will want to adopt a convergence framework that takes a two-pronged approach. One prong is the IT security approach to minimize threats. The other prong is the physical security approach with video surveillance to watch over operations. The IT solution may incorporate implementing multi-factor authentication (MFA) and the physical security solution is to invest in remote video surveillance.
MFA adds a layer of security. If an intruder enters the building either by piggybacking or some other means and finds a computer, MFA will stop them from logging into the system. It can also send an alert to the security response team. The other factor is to train employees. They’re the ones that can leave computers and laptops unlocked or bring a USB drive from outside that contains malware.
As for physical security with video surveillance, the monitoring operator watching video surveillance cameras can report any change in equipment and technology behavior before serious damage occurs. An access control system can manage access to computers that may have vital company information. It can also manage access on a per-building and per-room basis.
How Remote Video Surveillance Helps Cybersecurity
Many security solutions don’t act until after a crime has already happened. Fortunately, there’s a solution that can deliver many benefits and works well as part of the convergence between physical security and cybersecurity. Remote video surveillance with monitoring is a proactive security system that can help deter crime. The technology pairs video analytics and human monitoring to help catch suspicious activity before it becomes a problem.
As mentioned before, cyber threats are physical threats. This means you want to make sure the security company vets all their cameras and other products they use for remote video surveillance before you start working with them.
Additionally, take steps to verify the security company follows cybersecurity protocols, such using as cameras that issue firmware updates or upgrades and encryption and incorporating trusted platform module (TPM). These should all occur at the manufacturer level to confirm that security is built into the product itself.
As stated before, physical threats are cyber threats. This means you want remote video surveillance watching your business to capture, see, and deter live incidents. The monitoring operator and system can help catch someone attempting to break in or gain unauthorized access to plant a USB drive. A company like Stealth has trained operators that may spot things like this and follow your protocol to deter a potential crime.
When you work with experienced companies like Stealth, they should have their own processes in place to verify and protect the integrity of their systems. As you interview potential security partners, ask about their security plans and make sure their cameras, access systems, and software are all clean. Ask them how they go about ensuring their technology is secure.
While many cyberattacks occur without the criminal stepping into the building, many suspects still prefer to do a physical break-in over the digital. Additionally, leaders tend to focus on investing their budget into IT security while neglecting physical security. Both need equal attention. If either is weak, it’ll help the criminals take advantage of it.
If you’d like to learn more about information risk management and protecting your business from its vulnerabilities, check out the information risk management guide. To get a customized security solution that fits your requirements and budget, contact us.
