A United Defense

Your head of physical security is probably a former law enforcement officer: a fit, taciturn man in a gray blazer with a Secret Service–style earpiece. By contrast, your IT security chief is an ex-network engineer who prefers black jeans, Diet Coke and poring over techno-hieroglyphics. To all appearances, these two people share nothing except the word “security” in their titles. But in fact, they have much in common. Integrating certain physical and IT security functions—such as access control—has always made sense. Let’s say that Kenji swipes his pass at the door to the R&D lab in Tokyo on a Sunday afternoon. That’s perfectly normal; he’s worked every second Sunday for 12 years. But what if someone also claiming to be Kenji accesses the corporate network from a site in San Francisco during the same period? If your two security chiefs could put those pieces of information together quickly, they could prevent the theft of precious intellectual property. Until recently, however, converged physical and IT security systems have proved too costly to engineer. Designers of older physical security applications created stand-alone systems that made integration difficult. Today’s physical security systems offer multifunction smart cards for building access and come with integration tool kits. As your company moves to new facilities or upgrades its existing physical plant, you’ll find that your new building security system runs on a standard server that plugs into your regular data network. But just because the new physical security systems resemble standard IT applications doesn’t mean the work’s all done. Like their bosses, your physical and IT security staffers have very different skill sets and will require cross training to work together. Some skills will probably be transferable. For example, both physical security experts who manage video surveillance and IT security experts accustomed to spying on clever hackers can easily learn to monitor consoles for significant events that span the physical and digital worlds. Physical and IT security staffs aren’t exactly hand in glove yet, according to a recent survey from Forrester Research. Just 5% of North American firms have a single organization that handles guards and cameras as well as firewalls and antivirus programs; and only 7% said they were moderately likely to integrate those functions this year. But nearly half of respondents think they can achieve better overall security by funding joint projects between physical and IT security departments. Government agencies in North America are continuing to expand their existing initiatives in security convergence, such as the U.S. Department of Defense’s Common Access Card. Companies in Europe, meanwhile, are showing a strong interest. A Switzerland-based international financial institution, for example, has assigned to each employee a combined access token that lets the employee both open doors and access the bank’s computer network. Most experts agree that a nation’s ability to prevent attacks requires the seamless sharing of information. As they confront threats from disgruntled employees, industrial spies, thrill-seeking hackers, and the like, companies are discovering the same thing.

A United Defense

Partner Center