The digital revolution has created some great opportunities for the security industry and along with it has come some new “buzz” words. Data and Video over IP for example are a set of words that are now firmly planted in our vocabulary. The implications of what they mean to the security industry were initially widely ignored. However they are now being embraced as the benefits of this “new” method of the transmission of information rapidly becomes fully recognised.
It is perhaps not surprising that installers were a little slow to look at turning to digital products to provide long terms solutions for their customers. The electronic security industry, particularly in the UK, is steeped in analogue technology with more analogue CCTV cameras installed in the UK per square mile or per capita than anywhere else in the world.
The introduction of digital video recorders has been the catalyst for change and with the move from analogue to digital recording, has come the opportunity to network and a whole lot of other new “buzz” words e.g. redundancy, bandwidth, etc. In practical terms, opportunities to operate and integrate various component parts of a security became possible via software. And now, although not in any way new to our associates in the IT industry, we in the security industry “discovered” logical security.
What is the difference between Physical and Logical security?
Traditionally physical security has meant the ability to protect people or assets by some kind of barrier or some physical process such a lock. More recently it has also encompassed electronic security equipment such as intruder alarms, CCTV and access control. Logical security is about restricting access to and protecting data that is stored on a PC, server or other network storage system.
In most businesses and organisations, the responsibility for logical security will be managed by a person or team who work within the IT function. A security manager whose career path equips him with the knowledge to deal with physical security issues is unlikely to have the specialist knowledge to manage logical security. Whilst there are always exceptions, we therefore have a situation where the two security functions or departments co-exist but do not interact.
An easy way to affect major damage to a company is to attack their network and that threat may well come from a dishonest or disgruntled member of staff. This is particularly the case where organisations with multiple sites use their network to centrally monitor, control and exchange critical information.
Let us imagine a situation where a sophisticated access control system has been installed using Smart cards that have fingerprint/biometrics information as well as photo ID of the authorised card holder. Physical access could therefore be tightly controlled and security personnel would have a record of where and when a member of staff had arrived for work and subject to the location of card readers where in a building they had been during a specific time period. That would however not stop a dishonest member of staff using a colleague's PC whilst they are away from their desks, in a meeting or even out of the building. It is certainly not usual for passwords to be shared or stolen.
There is an easy to implement solution to minimize this threat and that is to introduce an active directory link between the access control system and the network'’s logical security software. A simple solution that would identify that the password/PC of a member of staff being used when they are not even in the building or that they are at the time in the staff restaurant!
This is just one example of where the gap can be bridged between physical and logical security to ensure that end-users can maximum benefit from their investment.