Article - securitylinkindia

Article

Operator Control Challenges and Solutions

MassMediaLink India LLP SecurityLink IndiaSeptember 12, 2017November 14, 202407 mins

Control rooms are very hectic places. Maintaining a bird’s eye view of what is going on at all times is critical. Paradoxically, technology is both part of the problem and the solution. Guarding over public safety, security and other important things, operators need to have any situation under control at all times. Visual integration is the key because it greatly impacts the human-machine interface, which, in turn, enhances the operator’s situational awareness. In reality, however, the control room workspace is often part of the problem, lacking in efficiency, structure and ergonomics. Therefore, optimizing the working conditions is one of the first things that need to be addressed. Problem 1 : Applications on stand-alone systems Information input is the key for operators. There are lots of hardware in control room. For security reasons, sources cannot be mixed. In other words, every source needs a separate computer, meaning operators need to physically switch between workstations in order to do their job. Research indicates that more than 40% of the operators use more than 4 screens on the job. While this is definitely an effective way to stay in shape, it is not the way forward. The amount of screens should be defined by ergonomics and workflow, not by the amount of computers and systems to manage. Having to switch between desks not only impacts response times but it also means operators need to manually write down or remember data to combine it with other systems. However, this results in an increased risk of human error and is therefore not advisable. Problem 2 : Several mouse/ keyboard/ audio sets Tied to the ‘1 source, 1 computer, 1 screen’ issue, operators are often working with several mouse/ keyboard/ audio configurations. Organizing these according to the operator’s personal preferences can take up quite some time making it all the more difficult for co-workers to share their workstations. KVM (keyboard, video, mouse) switches can reduce the number of keyboard and mouse sets but they require the operator to manually select which system the KVM is connected to. Again, this leaves room for human error. Problem 3 : Keeping operator control costs down There is technology, on the one hand, and then there is budget, on the other. Ideally, every control room runs on its own fully integrated system, allowing information from different sources to be made available to other support applications so that video and data can easily be shared. In such an environment, reports can be generated and distributed automatically, leaving no room for error. However, building a fully integrated system requires a lot of resources and time. Most of the time neither of the two is available. Additionally, where legacy equipment and systems are involved, a fully integrated solution appears to be problematic. But, there is an alternative: Regaining control of the control room OpSpace delivers all the benefits of HMI integration but avoids the costs. Thanks to visual integration, the right information is presented to the operators when and where they need it. Gone are the days of multiple mouse and keyboard sets. Instead, one set can be used to control every screen and application. Operators can organize the workspace according to their personal preferences and then simply save their settings. Furthermore, visual integration avoids security compliance issues and vendor dependencies. The benefits of OpSpace One space OpSpace keeps one at the center of the information all the time. The software integrates information from disparate sources and networks only at the presentation layer while guaranteeing the security of the applications across security domains. Once the application is selected the system automatically copies the data into the work area in front of the operator. One keyboard and mouse One keyboard, mouse and audio set provide seamless control across all sources. This is especially handy during crisis situations. Share the workspace The ‘Follow me’ function makes it easier than ever before to share your workstation with co-workers. All this makes a cleaner, better organized and more efficient workspace. One views, monitors and interacts with multiple clients that reside on multiple networks with different security clearances or liability concerns. All relevant information can be consulted and manipulated within a single pixel space.

Aiming High – Aiming Safely

MassMediaLink India LLP SecurityLink IndiaSeptember 12, 2017November 14, 2024018 mins

Working at high altitudes is considered to be extremely dangerous. Fire services, for instance, need to conduct safe rescue operations, yet they are by no means the only ones. Safe working conditions are equally vital for anyone working at solar or wind farms, in the forestry industry or at a brewery. Technical regulations are therefore in place, ensuring the provision of suitable equipment and training. Transmission poles, bridge pylons, industrial stacks, giant trees, rescue operations in the mountains – it may well seem that the higher a person has to climb, the more they need to be protected from falling. Yet there is no need to aim quite so high. Even a fall from a relatively low height can lead to severe injuries or death. The same applies to depths, for example in a well. “Anywhere a person might need to enter and where they are then completely enclosed,” says Klaus Bornack, President of Düsseldorf’s A+A – the world’s leading trade fair on personal equipment, corporate safety and safety at work – and Board member of IVPS, the German Association of Manufacturers of Personal Protective Equipment, “Take a brewery, for instance, where barrels need to be cleaned at regular intervals. Sadly, it keeps happening that an employee faints while performing such work. This may be because they’re short of oxygen, or it may be because of toxic gases descending to the bottom of the barrel. Anyone rescuing them and letting themselves down into the barrel would then also faint.” This makes it essential to use rescue equipment with proper fall protection where a person can be suspended in an upright position if they faint. In Germany alone, says Bornack, manufacturers are selling about EUR 1.8 billion worth of personal protection equipment. Alongside protective gloves, footwear and clothing, about 25% of the revenue comes from life-saving products such as respiratory protection, fire protection and safety ropes, as important equipment to keep down accident figures. Such products are based on technical standards and the accident prevention regulations set up by Germany’s accident liability insurance associations, thus warranting compliance with minimum safety requirements. Moreover, thanks to EC directives, the regulations are applicable across borders, throughout Europe, and an important new element will be the upgrading of the former PPE directive 89/686/EEC to the level of an EC regulation from 2019. Indispensable: Training and seminars Under the law, it is basically the job of each company’s health and safety officer to ensure compliance with minimum standards. They therefore need to receive training as multipliers, so that they can be contacted about any questions that might arise and provide information and the necessary details about fall protection. A health and safety officer can demonstrate how to wear a belt or harness correctly, and they are also familiar with issues such as load safety. Furthermore, they are trained in the regular checking of PPE for operational reliability. Training in the checking and practical use of PPE is provided by companies such as Bornack (which has three training centres, including a large high-altitude facility in Marbach on the river Neckar), DWS Pohl, Edelrid, MAS and ABS Safety. Training courses are indispensable for the proper use of protection equipment. Good equipment is essential, but the better a user is trained, the more they are protected. After all, any work on radio masts and bridge piers is risk-prone, and when a person is in danger and needs to be rescued, this can never be described as an everyday situation. Even professionals such as special command units, fire services, the police and Germany’s Border Protection Group 9 can reach their mental and physical limits. This makes it all the more important for such workers to receive regular training in handling special situations and therefore to attend courses held by suitable service providers. Anyone requiring rope access in their work needs to be fully familiar with their workplace. This is the only way for them to understand the risks and to take suitable precautions. Moreover, technology always has its limits – and the same is of course true for safety technology. A rope access worker needs to be made aware of both these circumstances through suitable courses and must be trained in the correct use of their equipment. “This means providing a realistic environment,” says Bornack, “where they can learn to master high altitude situations – not just physically, but also mentally.” “To establish rope access as a legitimate working method in Germany, our members have decided to define a set of safety and training standards,” says the German Industrial Rope Access Trade Association (FISAT) as it comments on its foundation. A similar focus is maintained by the Global Wind Organisation, an association of companies catering for the offshore market. This organisation, too, has formulated regulations for equipment and training content which are applicable throughout the EU. Another industrial rope access workers’ organisation with certification as a training facility is IRATA (Industrial Rope Access Trade Association). From an alpine world to a working environment The history of fall protection at work is not as long as it might seem. Scaffolding is not always suitable as an access method, and a crane is often too expensive and cannot be set up everywhere. While the cost and benefit of construction projects were often still manageable, inspections and repairs – particularly in exposed places – increasingly required new and secure access options. According to the German Industrial Rope Access Trade Association (FISAT), the scope of the work originally covered maintenance and repairs of defective spires, sculptural architecture, certain high-altitude works of art, as well as offshore oil rigs and onshore wind farms. The association further explains, “Germany experienced an increase in public awareness about rope access work in 1995, with the shrouding of the Reichstag in Berlin – to realise the design of the artist couple Christo and Jeanne-Claude, over a hundred rope acess workers had to be employed. At the time, such work was still not generally permitted, but after long negotiations…

Autonomy & Safety Technology for Vehicles

MassMediaLink India LLP SecurityLink IndiaSeptember 9, 2017November 14, 202409 mins

New research on consumer preferences for full autonomy in new vehicles finds the technology is not yet popular among a broad audience, according to analysts at IHS Markit. Ironically, the same audience ranked it among the very features they would be willing to pay the most for in their next new vehicle purchase. The IHS research findings demonstrate a wide variety of viewpoints from consumers across leading global markets. Blind spot detection ranked highest as the most desired features among all audiences, young and old, and propensity to pay for it varied by region, with the U.S. respondents reporting they would be willing to pay significantly more for the technology than consumers in other regions. Responses from more than 5,000 vehicle owners intending to purchase a new vehicle within the next 36 months were reviewed in the 2017 Autonomous Driving and Urban Mobility Consumer Analysis , representing five key automotive markets – the U.S., Canada, China, Germany and the United Kingdom. This is the fifth annual survey of its kind from IHS Markit and identified key attributes for consumers, providing insight into preferences, desires and future interest as new vehicle intenders return to market. A number of subjects were covered. “In terms of ADAS safety features like automatic emergency braking and blind spot detection, consumers wanted to see these features standard across the board,” said Colin Bird, Senior Automotive Technology Analyst for IHS Markit and Co-author of the report, “There is a large subset of consumers who are willing to pay for full autonomy features demonstrating that consumers see this more as a value-add rather than a necessary safety component, at least for now.” Just 44 percent of all respondents indicated that full autonomy would be a desirable feature on their next car, the lowest rank of all of the technologies included in this subsection of the survey. Interestingly, however, it also ranked as the technology that consumers would be most willing to pay for, according to IHS Markit. Price points varied by country, with US consumers indicating they would pay the highest price to have the feature in their next new vehicle. German consumers surveyed about the cost of the technology added to a new vehicle purchase, German respondents indicated they would be willing to pay $1016 for it, nearly 20 percent more than the US audience. Among consumers surveyed in China, more than 72 percent of respondents reported desire for full autonomy as a feature in their next new vehicle, the highest of all the regions surveyed. They also expressed a willingness to pay for it at the highest cost among other technologies, noting a price point of $557. Many also were interested in related technologies, according to IHS Markit. These included blind spot detection (89 percent), automatic emergency braking (92 percent), lane departure warning (88 percent), highway autopilot (83 percent), autonomous co-pilot (81 percent). In comparison, just over half of U.S. consumers surveyed indicated full autonomy is a desired feature in their next new vehicle, though they too seem willing to pay the most for it over other technologies; noting an average willingness to spend $780 to have the technology on their next new vehicle. In addition, U.S. consumers are interested in blind spot detection, navigation systems, automatic emergency braking and steering wheel mounted controls. From a global perspective, highway autopilot also was mentioned as a top technology among consumers surveyed from all regions, but also at a variety of costs. US consumers indicated a willingness to pay $107 more than their nearest counterparts to have their next new vehicle equipped with the technology. Younger drivers more comfortable with full autonomy than older drivers The survey also researched comfort level with vehicle technology by age of the respondent groups. Across all geographies, younger drivers, including Millennials and Generation Z respondents, were more interested in full autonomy than other generational groups, with 61 percent suggesting it as a feature of interest in their next new vehicle. Generation X, baby boomers and the swing generation all trail in level of interest significantly, even though these new and evolving technologies will present the greatest opportunity to make transportation and mobility easier for older generations. In addition, respondents widely reported that driving alone was their leading form of transportation, seconded by walking and public transit. In addition, respondents in China indicated a very strong response to ride hailing and car-sharing services, with 42 percent indicating use of ride-hailing and 16 percent having engaged in car sharing in the last 12 months. US respondents were less likely; while respondents from Germany and the UK reported some use. If vehicle insurance rates were based on how often consumers used self-driving features, consumers felt slightly different about it. In China, 70 percent of respondents indicated they would be more open to self-driving features. Respondents in Germany were least likely, with just 32 percent reporting it would have an impact for them. “Among new car intenders, ride-hailing services aren’t used as often as a daily commuting option. Instead, the research found that ride-hailing is used more often for weekend trips, errands, and vacations,” Bird said, “Interestingly, new car intenders are more likely to be drivers for hailing service companies like Uber and DiDi than they are to be passengers. This is particularly the case in the UK, Germany and Canada, which suggests there could be a lucrative sales model in these markets for automakers.”

Smart City Solution

MassMediaLink India LLP SecurityLink IndiaSeptember 9, 2017November 14, 202409 mins

Ever expanding, cities today must pay more attention to protect their people and properties. It is evident to anyone with access to global news that now even the most developed cities are faced with huge safety threats, ranging from terrorists’ attacks aiming at well-populated areas and historically significant places to road accidents that keep increasing with the number of automobiles. A smart and integrated system for urban security is an urgent need, which Dahua is competent to provide. Time to do it smartly Boasting its AI technologies and highly integrated platform, Dahua smart city solution aims to address safety issues of mega-cities without dramatically expanding police forces. To be more specific, the deep-learning empowered video surveillance performs timely and effective risk detection. The unified platform allows faster emergency response, and the powerful data mining helps get more insights from the data front-end systems collected. Combined together, Dahua smart city solution gives unprecedented advantages. For example, the deep-learning redefines the capabilities of video analysis. Dahua achieved 99.78% facial recognition accuracy in LFW (Labeled Faces in the Wild, a well-known facial recognition benchmark for academic purpose) in October, 2016. Moreover, deep-leaning even allows instant classification of human and vehicle appearing in video, capturing extract detailed features such as clothe color, gender, headwear, bag for human and license plate number, vehicle color, size, mark, model, cellphone usage, seat belt usage for vehicle etc. Four working stages of Dahua smart city solution The overall working process of Dahua smart city solution can be viewed in four stages that are prevention, detection, response and investigation. By improving each, it can improve the city running in general. The Stage of Prevention means picking out and focusing on potentially dangerous persons and factors before they really do harm to public safety. This requires the ability of collecting and analyzing big data. Dahua’s smart city solution provides advanced forecasting models that give a better chance of predicting events. For example, with comprehensive analysis of violation data collected by traffic enforcement cameras, the system can generate a watch list for the vehicles with numerous violation records. The Stage of Detection involves real time surveillance in various forms, including deployment of 360-degree panoramic camera and ultra-long range, all weather monitoring thermal camera etc. In addition to multifunctional cameras, Dahua’s deep-learning empowered smart video surveillance can automatically detect risky individuals and activities from massive data collected. In fact, Dahua traffic enforcement system helped Hangzhou city automatically detect 29,823 vehicles’ illegal behavior during G20 Summit, which greatly reduced the burden on policemen who thus could put more focus on protecting key summit area. The Stage of Response enables key organizations in the city to react to security threats in real time. Dahua improves the communication efficiency through its integrated platform, allowing unified command and centralized data storage as well as cross-department information sharing. if a natural disaster takes place in the city, Dahua smart city solution can report it on a single e-map with available emergency response resources to all relevant departments and agencies, while providing seamless monitoring of the site to all units approaching. The Stage of Investigation analyzes all data collected by different systems and provide insights to facilitate the recovery of crucial incident like crime after it happened. In this stage, technologies such as video synopsis provide a short summary including all moving objects of a long video and supports query moving object according to different characteristics like size, color, direction and speed. Besides, there’re a rich set of data mining methods like active area analysis, active target analysis and trajectory analysis. So if a criminal tries to escape with different clothes or cars he is highly unlikely to make it in a city equipped with Dahua smart city solution. Multidimensional benefits Smart City Solution delivers on Dahua’s promise of ‘Safer society, smart living’ in 4 key metrics. Government investment measures the level of continued commitment by governments to maintain good function and development of systems in place. After deploying smart city solution, London’s police investment declined by 10% yet the criminal activity prevention score actually improved by 0.5% since 2015. Safety result measures changes in the levels of crime and risk to citizens. It also assesses the public’s perception of how well the city’s authorities can respond to incidents. This is improved by the efficiency savings that Dahua’s surveillance systems provide. Social benefits assess the ability of the public to enjoy entertainment and leisure activities safely and how their affinity for the government changes. Economic benefit accounts for personal wealth, spending on tourism and retail along with employment rates and the city’s protection against short-term economic fluctuations. Smart city solutions benefit everyone in all four aspects above. Governments can decrease spending and crime rates at the same time whilst increasing citizen safety, survival rates and citizen approval rating. Citizens will be safer and enjoy better living standards without the burden of increased public spending. In short, they will be happier with both the government and their lives. Summary By remaining ahead of the market with expertise in intelligent visual processing technologies and emphasizing its core value propositions of innovation, quality and service, Dahua Technology will continuously contribute to a safer society and smarter living, benefiting city dwellers worldwide. By Balasubramanian Jayam Head of Marketing (India & SAARC) Dahua Technology Co., Ltd.

Deepening the Value of Surveillance

MassMediaLink India LLP SecurityLink IndiaSeptember 9, 2017November 14, 202405 mins

Deep Learning has swept through the IT industry, bringing benefits and better classifications to a number of applications. Inspired by the way the human brain works, the technology uses a layered learning process to enable the computer to classify, store and access data, which it can then refer to for learning. This means it can use a whole image to recognise, rather than relying on separate elements of that image. This is a cumulative process – the more elements it has to draw on, the better the classification – thus, the better the ‘learning.’ The benefits of this technology for face recognition and image classification make it hugely valuable in the field of security. It touches on every aspect of the security industry – from facial and vehicle detection to behaviour analysis. This, in turn, starts to change the focus of security from being reactive to being able to predict problems before they happen. Hikvision has taken this technology and innovated a family of products to maximise its use. The DeepInview IP camera range and the DeepInmind NVR range work together to provide all the power and benefits of Deep Learning. While the cameras provide the smart ‘eyes’ of the system, the NVR represents the analytic and storage capabilities of the brain. The products help to tackle security on two fronts – recognition, monitoring and counting of people, and recognition and detection of vehicles. This uses Deep Learning technology at its most effective – for its ability to classify and recognise thousands of ‘features.’ Obviously, this multi-layered approach uses a lot of memory and performance, which is one of the reasons why the technology has become much more widespread in the past few years. To put this into perspective, in the first stages of the technology, it took 1,000 devices with 16,000 CPUs to simulate a neural network; now, just a few GPUs are needed. Hikvision is partnering with the largest of the chipset brands – Intel and nVidia – to explore the possibilities of Deep Learning for the surveillance industry. Hikvision’s innovation also facilitates and improves on this. The H.265+ codec radically reduces transmission bandwidth and data storage capacity requirements. This means there’s no loss of quality even though the data being shared and stored is exponentially higher. Applications are numerous. The technology could enable the system to provide a black list/ white list alarm, which could come in very handy in access control scenarios. It could also be used to recognise unusual behaviour – possibly allowing security staff to prevent an issue if people are found loitering nearby, for example. The new premium range of products will further extend the quality and capabilities of security systems. They will also allow security professionals to start planning to avoid issues, rather than reacting to them. This could be the next evolution of the whole industry – using AI to change the world, one Hikvision solution at a time. By Ashish P. Dhakan – MD & CEO, Prama Hikvision

State of Security Training in India

MassMediaLink India LLP SecurityLink IndiaAugust 11, 2017November 14, 2024022 mins

The Private Security Sector (PSS), which employs the second largest manpower in India after the agriculture sector, is a moderately motivated sector of the country. The sector engages approximately seven million people today and is growing at an annual rate of 25 per cent. But unfortunately, majority of job-seekers and already employed members of the sector are found unwilling to adopt security profession and resort to it as their last option. The employment normally comprises youth who lack in education and training, and hail from the weaker sections of the society. They are either school dropouts, or are unable to afford the huge cost of education and training which can enable them to meet their inherent desire of living a respectable life. The unwillingness is attributed to the presumed less respect to the role, as well as the miserable salary drawn which is fixed at bare minimum wage for unskilled/ semi-skilled labor. Education and training not only elevate respect and livelihood, but also enhance the efficiency of the sector. Self-respecting and confident personnel are highly focused and more competent, and with their world class executions they could be able to get recognitions all around the globe. This also opens the global scope for employment. The current government has also taken upskilling of the security persons seriously and designed several pertinent policies and institutions including Skill India, NSDN, SSSDC, PMKVY and so on. Employee problems appear in various shapes and sizes such as complaints of sexual harassment, money missing from employee lockers, workplace accidents, employee sabotage, and so on. Workplace disputes often have personal importance to the employees involved, as well as they also impact their livelihood adversely. This makes the employees sometimes tending to tell lies and hide facts. From these differing accounts employers must arrange to thoroughly investigate the issue and determine what really has happened. Any workplace investigation requires judgmental calls about what issues to investigate, who to include in the internal investigation, and ultimately who to believe on. The goal should be to conduct the investigation in the fairest way possible. But do the employers have an efficiently educated and trained team to successfully resolve such issues; or they need to arrange training? There is surely a gap. Security education and training is a serious concern and need of the time, with a wide scope, of course. Proactive call by Lancers Network Limited Lancers Network Limited, under the leadership of Kunwar Vikram Singh, a security veteran, has proactively taken up the challenge and been engaged in facilitating security trainings for several years. Lancers Network Limited is South Asia’s leading Risk Consulting firm, operating in the high-on-risk countries of the region. Established in 1980, the firm continues to pursue its founding principles of integrity, confidentiality and value addition, and thus has created a strong client base across the globe. Equipped with a highly experienced operational team of over 120 professionals drawn from the financial sector, armed forces, police, security services and industry professionals; the company has developed a reputation for providing quality driven, customer focused, and highly successful actionable intelligence and security solutions. They have achieved unmatched client retention levels across Automotive, Chemicals, FMCG, Banking, Insurance, and IT Industries. Lancers impart security training in partnership with the following international organizations: ARC Training International Academy for Security Management Arc Training is the UK based leading international providers of security management training courses. They work with security professionals from all over the world, providing fully-accredited qualifications in subjects that are current, interesting and internationally relevant. Tavcom Training Part of the renowned Linx International Group, Tavcom Training is also the UK based world’s leading provider of accredited security systems training courses. They provide award winning BTEC certificated courses to installers, operators, managers, and designers of CCTV, Network IP, Intruder alarm, Access control, Fire alarm and all other types of electronic security systems. Perpetuity Academy Another UK based Perpetuity Academy is specialized in the fields of security, crime and risk management worldwide, offering accredited training courses designed for managers, supervisors, and practitioners. Strongly supported by universities and professional bodies, their courses provide the latest thinking and best practices, combined with academic knowledge that is required for today’s security professional. Courses Lancers, in collaboration with their partners, offer various levels of courses to cater to different categories of on-job as well as off-job aspirants. They provide both BTEC (Business and Technology Education Council) level, as well IQ level courses. Some of their offerings are as follows: Corporate Intelligence Management (3 Day Programme) The effective analysis and communication of commercial intelligence is a rapidly developing area of responsibility for security managers. This course provides a critical introduction to the key ideas, techniques and issues that make up the effective use of intelligence within a corporate environment. The course is of immediate benefit to security managers, security supervisors or multi-tasked managers, and those who are seeking to make a career in security management. Risk, Crisis & Disaster Management (BTEC Level 4: 3 Day Programme) Acting confidently in a crisis is vital in protecting the business. This short course prepares staff at all levels in how to effectively manage a crisis, and to help prevent unexpected incidents. It aims to equip security professionals with a broad spectrum of knowledge relating to risk, crisis and disaster management within their organizations. It also deals with all aspects of crisis and disaster management including the composition and operation of the crisis management team. The course immediately benefits those who are working as security managers, or those seeking to make a career in security management with an inclination to crisis management. Managing Security Surveying (BTEC Level 4: 3 Day Programme) Conducting a security survey is an essential skill for security managers. This course provides a step-by-step guide to the process of conducting an effective survey, and supplies a template for conducting one’s own security surveys. The course shows how to identify the particular threats to the business, premises and staff, and how one can protect against them. The course…

Paradigm Shift in the Security Threat Landscape

MassMediaLink India LLP SecurityLink IndiaAugust 11, 2017November 14, 2024010 mins

With the evolution of Internet of Things (IoT) the security challenges for industrial security are increasing exponentially. The 25 billion globally connected devices in 2015 are expected to double by 2020. On an average, each individual is expected to be connected to six things online in terms of sensors, smart objects and device clustered systems. Under this scenario, and given the fact that the weakest link will continue to define the robustness of any organizations security architecture, security vulnerabilities are poised to increase manifold, in terms of the scale, intensity and complexity of the attacks. The effects of these attacks, however, will not be restricted to the cyber domain alone. They will also impact the physical security of the people and infrastructure, in spite of having the best ‘physical security’ controls in terms of people, processes and technology to mitigate these threats. Holistic approach to address the security threat landscape This calls for a multidimensional integrated security concept, holistically encompassing physical security, cyber security, information security, business continuity, risk management, compliance and privacy protection, and emergency & crisis management. The convergence between logical and traditional physical security will entail a cascading effect on these seemingly different dimensions, with the impact multiplying at every stage. For instance a cyber-breach can impact safety, which in turn would impact compliance, as also may cause physical damage by aggregating the compound effect impacting business continuity, thereby directly impinging on the bottom-line. A combination attack using multiple threat vectors can adversely impact the market sentiments in no time. This will lead to long term brand erosion, as well as economic loss to the business, which in turn will have an adverse impact on the industry and the nation at large, especially if critical infrastructure is targeted. This has necessitated that we create synergy across the threat landscape to deal with a combination of physical and cyber-based threat vectors. In order to achieve this objective it is important to act in a concerted manner. As a result, chief security officers need to take care of the physical as well as the digital aspects of security and simultaneously address the increasingly complex area of compliance. Convergence not only helps in providing enhanced level of security but also results in cost saving by integrating disparate systems and optimizing resources; both in terms of personnel, processes and technology platforms. Case studies Hackers targeted Sony Pictures and wiped out half of their global network. They erased everything stored on 3,262 of the company’s 6,797 personal computers and 837 of its 1,555 servers. At the same time, they ensured that nothing could be recovered by using a special deleting algorithm that overwrote the data seven different ways. Subsequently the code targeted each computer’s start up software and rendered the machines brain-dead. A group of cybercriminals successfully targeted 100 banks in 30 countries globally including US, Russia, Ukraine and China after phishing its targets with infected email attachments. The criminals used their computer exploits to dispense cash from ATMs or transfer cash digitally to accounts they controlled. The USD 1 billion haul was unprecedented in its scope, which Kaspersky reported as under investigation. LinkedIn confirmed in 2016 that the impact of a 2012 breach in which 6.5 million users’ passwords were compromised, is now likely to be closer to 167 million users, 117 million of whom had both their e-mails and passwords exposed. The 1768 km long Azerbaijan – Georgia – Turkey (Baku-Tbilisi-Ceyhan) crude oil pipeline connecting the oilfields in the Caspian Sea to the Mediterranean Sea was blown up by hackers. They exploited the vulnerabilities of the IP cameras communication software, to gain entry and move deep into the internal network, to blow the pipeline by over pressurizing it. This resulted in a loss of USD 1 billion in export revenue for Azerbaijan and the pipeline was out of action for 20 days. The stuxnet virus that was used for spinning several centrifuges out of control at an Iranian nuclear facility was believed to have been transmitted using a thumb drive that was physically inserted into a computer within the facility. Critical infrastructure is the most vulnerable with high impact Thus, in future, critical infrastructure in particular is likely to be targeted by both terrorists and state sponsored actors, as it provides an easy option to them. Future wars will be asymmetric in nature. Economically weaker nations will inflict heavy economic loss on their adversaries to include both life and property, by using meagre resources, as compared to achieving the same using conventional means at a huge monetary cost and loss of lives. All it takes to target critical infrastructure is a bunch of highly trained cyber hackers who require hardware, software and a high-speed internet connection, and all of this cost not more than a few hundred thousand dollars, and will to execute. The best part is that it can be done sitting anywhere in the world and one need not be physically present at the target location. The victim organization/ country cannot be very sure of the identity of the perpetrator group/ individual/ country and retaliate immediately, thereby they can virtually go scot free in terms of facing any consequences, and enjoying virtual immunity against any adverse action due to lack of stringent laws dealing with sharing of data and lack of collaboration at the global level. Need for public private partnership and restructuring of the traditional security organization There is a need for public private partnership to effectively deal with such scenarios, wherein we pool in the resources of the government and the private sector to address these security challenges to our critical infrastructure and the industry at large. At the same time, there is a requirement to create a CXO level appointment within the organization who should be responsible for addressing the security challenges to include both physical security as well as cyber security. The CXO should also be integrated with the Government agencies both at the national and international level, for exchange of relevant information,…

Article

How to know Access Control in The Cloud is Secure?

MassMediaLink India LLP SecurityLink IndiaJuly 11, 2017November 14, 2024011 mins

Access Control as a Service (ACaaS) has grown into a mainstream product offering from many access control manufacturers, and it is gaining significant growth in the market. With the adoption of this technology, end users and integrators need to ask several pertinent questions. It is extremely important to understand the security of the communications, the quality of service, who the provider of the cloud service is, the redundancy of the servers, disaster recovery, scalability of the platform, and finally the stability and availability of the service. With this information end users and system integrators can make a sound decision on which product to select and if the provider can be trusted to deliver the critical action of physically opening and closing doors successfully. At ISONAS we take each of these issues very seriously and have worked tirelessly to provide the most transparent service to a customer while leading the industry in security and scalability. When selecting an Access Control as a Service provider, we recommend looking for the following best practices to ensure clarity in the decision making process. 1. Overall structure Where is the platform hosted? Amazon Web Services has created a business solely around hosting services. ISONAS Pure Access Cloud is hosted on a complex structure within Amazon Web Services. We chose AWS because of their best in class cyber security infrastructure and their extensive global flexibility in hosting and deployment of Pure Access. 2. Perimeter security Does the platform have perimeter security? Typical first line of defense is through the firewall that can deny or allow traffic. Networks should be surrounded by firewalls and reverse proxy units, which protect the systems within. Intrusion detection and prevention measures should be set up to alert and mitigate potential risks before they can get into the network. All perimeter security logs should be reviewed daily as well as alerting on key terms for a rapid response to threats. At ISONAS, we measure and monitor 430 individual metrics 24/7 with real time alerting to our technical team and we use an industry leading service to provide this comprehensive level of IT infrastructure. 3. Internal security How the cloud provider manages their internal systems is a good reflection on how they manage additional systems and will prevent another avenue for an attack. Systems should be under a network access control layer as well as local firewalls limiting only the required ports for operation to be active, and only responsive to specified networks. As a second layer of protection, host intrusion detection and prevention act as a threat reduction as well as Antivirus and Malware mitigation. Internal team access to systems should be group based and only granted on an as needed basis via a secure password manager portal where access can be granted and revoked at any time. 4. Encryption One of the most basic pieces of security is ensuring the web application has an SSL (Secure Sockets Layer). An SSL establishes an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private. Pure Access Cloud utilizes SSL encryption governed by the reverse proxy. Even the passwords used by the web servers to access the database are encrypted to mitigate against data leakage. Automated file watchers keep a close eye on configuration details in the servers to ensure no access is granted without administration approval. All information on ISONAS hardware is encrypted using AES-256 bit algorithms. Communication between Pure Access Cloud and each connected access point can also be AES 256 bit encrypted. 5. Data protection The worst time to find out backups didn’t work is when you need them the most so employing backups and snap shots of the database is vital. This will ensure that data cannot be lost due to failure or even accidental deletion. All recovery methods should also be tested on a regular basis to ensure that restore and recovery is fast and accurate if required. 6. Testing All products should undergo thorough and rigorous automated and manual testing to ensure that the product that is placed in front of customers is stable without issue. ISONAS utilizes 3rd party penetration testing on a regular basis to subject our systems and configurations to the highest level of cyber security standards. 7. Monitoring All systems should be monitored heavily. A good practice here at ISONAS is that each server has up to 30 points monitored from services to configuration files to up/ down time. Ports are monitored as well as web services. Our services are monitored by Selenium style scripts that not only see if the web services are up but actually log in and click links and log out measuring the performance of the services. These checks are done every 5 minutes from locations in the US and internationally as well as internal network monitors. 8. Redundancy and load balancing As systems scale and grow, there is risk that traffic to the platform could create performance issues, therefore the ability to load balance information is critical to preventing an overload. Systems should be redundantly load balanced using affinity in the virtual IP configuration to ensure a seamless customer experience. In addition, applications should be stateless and share cache information so if a system stops responding the customer will not be affected and it can be repaired without downtime being a factor. 9. Support philosophy Is there a support program and team in place to assist if there are issues? Here at ISONAS we don’t believe in traditional tech departments where there are separate network, server, security, cloud and support teams. We fundamentally believe that a rapidly scaling business and application needs a team that can manage all systems, anytime and anywhere. Our team is empowered and trained to handle all facets of the support process from the customer to SaaS application. At ISONAS, security is taken seriously. The patented Pure IP hardware products from ISONAS offer a technologically advanced solution that eliminates the…

Article

Change Approach to Vulnerability Management

MassMediaLink India LLP SecurityLink IndiaJuly 11, 2017November 14, 202407 mins

Skybox™ Security has announced the availability of threat-centric vulnerability management (TCVM) for the Skybox™ Security Suite, signalling a fundamental shift in the approach to managing and prioritizing vulnerabilities. TCVM changes vulnerability management from an exercise of trying to patch ‘everything all the time’ to focused, intelligent action that considers real-world threats. TCVM does this by correlating multiple factors to determine vulnerability risk, including: The context of an organization’s environment such as potential attack paths and security controls in place, each asset’s exposure and importance to the business, and details of existing vulnerabilities. Intelligence on vulnerabilities being exploited in the wild. With the prioritization center in Skybox™ vulnerability control, security leaders can automatically analyze the thousands, even millions of vulnerabilities in their environment (including cloud and virtual) to pinpoint those that are truly putting their organization at risk. This means narrowing a huge volume of ‘known’ vulnerabilities that are potential threats down to a small, manageable number. They are identified as imminent threats known to be exploited in the wild. In addition, TCVM enables a systematic approach for ongoing, gradual risk reduction of potential threats that could escalate in the future. Skybox TCVM leverages ongoing intelligence of the active threat landscape produced by the Skybox™ research lab. The lab aggregates information from more than 30 security data feeds along with research of exploits available on more than 700,000 dark web sites and validated by Skybox’s security analysts. For example, Skybox analysts have been closely monitoring three major event categories impacting organizations today – the use of a specific, commercialized set of exploit kits, the rise of targeted client-side vulnerabilities, and the continued popularity of Internet of Things (IoT) botnets. A small, targeted number of exploit kits are dominating the dark web. In the first part of this year, five major exploits kits dominated chatter on the dark web, targeting nearly 70 vulnerabilities in Firefox, Adobe Flash, Microsoft Internet Explorer and Edge, Java, Microsoft XML Services and more. These vulnerabilities are known to distribute different malware as payload – for example, popular ransom ware and banking trojans. Threat actors continue to target specific vulnerabilities included in exploit dumps by hacker groups such as The Shadow Brokers. The group, notorious for allegedly leaking the National Security Agency (NSA)’s hacking tools, continues to pepper the dark web with exploit dumps like the major one on April 14 that contained many OS and server-side exploits. These dumps and targeted vulnerabilities impact web apps built with Apache Struts plus VMware, Cisco, Oracle and Microsoft products, to name just a few. Poor IoT security is still vulnerable. Botnets are exploiting vulnerabilities in network devices, gateways, cameras and other internet-connected devices, delivering distributed denial of service (DDoS) attacks through things like the ‘HTTP Port 81 Botnet’ and the Amnesia botnet which is the next generation of Mirai malware after source code was published and shared online. “Security leaders understand that the threat landscape is always changing. The difference now is that we’re seeing the growth of an increasingly commercialized cybercrime market. This is making it easier than ever for threat actors to attack, adjust and attack again until they accomplish their objective,” said Skybox CEO, Gidi Cohen, “They tend to aim for the easy targets – and the biggest ROI – by exploiting a surprisingly small number of vulnerabilities, many of which current vulnerability management approaches don’t consider as priorities. This has to change. Security leaders have to be smarter and way more targeted in their approach – aligning it to what’s happening in the real world – if they are to stay ahead of cybercriminals.” Skybox TCVM makes focused action possible by combining attack surface visibility, threat-centric vulnerability intelligence, and attack vector analytics to identify and prioritize an organization’s biggest risks according to vulnerabilities known to: Exist and are exposed in the network. Be actively exploited in the wild; or known to be attacked within a specific industry or geography. Have an exploit available, but are not known to be part of an active exploit campaign. Exist but are not exposed in the network. Threat-centric approaches to vulnerability management require the use of multiple technologies using several different types of security analytics.

Critical Infrastructure Security and Smart Cities

MassMediaLink India LLP SecurityLink IndiaJuly 10, 2017November 14, 2024018 mins

Recently there have been several policies, simulations, active designing and implementation of smart city concepts in several locations around the world including India. Today, the world is talking about connecting everything to the internet. The fourth industrial revolution (Industry 4.0), a term used to draw together cyber-physical systems, the Internet Services and Internet of Things (IoT), has started to revolutionize projects such as smart grids and smart cities. There is no universally accepted definition of a smart city, with different schools of thoughts describing this concept in terms of annotations depending on their geographical scope, location and socio economic settings. Faced with rapid urbanization, city planners are turning to technology to solve a wide range of problems associated with modern cities. To provide for the aspirations and needs of the citizens, urban planners ideally aim at developing the entire urban eco-system, which is represented by the four pillars of comprehensive development – institutional, physical, social and economic infrastructure. This can be a long-term goal and cities can work towards developing such comprehensive infrastructure incrementally, adding on layers of ‘smartness.’ Ideally the planning of a smart city originates from the end user. The needs of the end user are assimilated in a systematic manner and are then distributed into several smart layers such as transportation, energy, utilities, finance, social, and logistics, amongst others. A true smart city is networked in such a manner that there is a balance between sustainable socio economic growth and urbanization. There are several examples of successful smart cities in the world such as San Diego in southern California and Glasgow in Scotland. The above illustrations show a few aspects of steps required to convert a city into a smart city. There are also several aspects of smart cities that are directly related to critical information systems and critical infrastructure. These components directly connect an end user to the service provider in terms of information display and service availability. For example, an end user can directly monitor the usage of piped gas from a mobile application; at the same time sensors in a house detect motion and usage, and the service can be cut off in case no one occupies the premise. This close networked platform is usually achieved through machine to machine communication (M2M) or an IoT platform. So how do we define these critical infrastructure platforms? Critical infrastructures are usually divided into physical and socio-economic infrastructure systems. Physical critical infrastructure encompasses all basic services such as electricity and water supply, waste (water) management, transport or information and telecommunication technologies. Socio-economic infrastructures instead include facilities such as banks, hospitals and schools but also public administration. Critical infrastructure is also a term used by governments to describe assets that are essential to the functioning of the society and economy. Future cities will challenge existing safety and security engineering models e.g., the United States electricity blackout in 2003 showed that in interdependent networks a very small failure in one network might lead to catastrophic consequences. New and complex cascading failure modes will arise out of unforeseen or emergent system characteristics as they are developed in an incremental and ad hoc fashion, especially where more sophisticated technologies are added to an already ageing physical infrastructure. A common concept between smart cities and critical infrastructure is cyber physical systems with city as the platform or (CPS). There are a number of definitions of CPS. Common features effectively describe control systems, networked and/ or distributed, incorporating a degree of intelligence (adaptive or predictive), and work in real time to influence outcomes in the real world. These definitions point to the diverse nature of CPS found in transportation, utilities, buildings, infrastructure, manufacturing, and health care. Although CPS have similarities with traditional data processing systems e.g., their networked or distributed nature and a degree of automation, the real-time nature of their interactions with the physical world is a significant difference. Interactions are sensors detecting and measuring physical parameters with actuators to control physical processes. Feedback loops allow data about the environment and the physical processes to be collected and computed. Actuation may be automatic or by an alert to a human operator. Critical infrastructure systems are CPS, whose failure would have economic or social impact. Society expects systems will operate in a safe, secure and consistent manner. In response to environmental, demographic and societal pressures, cities may no longer conduct business as usual. Traditional city models are no longer appropriate, as transport and utility infrastructures become unsustainable and require significant investment. Some cities have embraced the concept of the ‘city as a platform,’ a hyperconnected urban environment that harnesses the network effects, openness, and agility of the real-time web. The focus has been on access to data, leading to development of smartphone apps and portals allowing citizens to ‘connect’ with city services and institutions. To address cyber security requirements, we need to understand the proliferation of functions in this hyper-connected world. Where functions in individual CPS interact, they will create new functions that will proliferate over time. To protect these complex systems, we need to understand their network of functions, relationships and interdependencies. A study of critical infrastructure interdependencies led to the identification of six dimensions, which can be used to examine CPS and supporting infrastructures: Type of interdependency e.g., cyber, physical, logical or geographic. Environment e.g., business, economic, public policy, legal, regulatory, security, technical, health/ safety, or social/ political. Coupling and response behavior e.g., adaptive, inflexible, loose/tight or linear/ complex. Infrastructure characteristics e.g., spatial, operational, organizational or temporal. Type of failure e.g., common cause, escalating or cascading. State of operation e.g., normal, stressed/ disrupted, restoration or repair. Identifying critical city infrastructure in every smart city project is of prime importance. Whilst there are a number of definitions for critical national infrastructure, from a city perspective the concept of critical infrastructure is not well defined. The UK’s definition of critical national infrastructure (CNI) is: “Those facilities, systems, sites and networks necessary for the functioning of the country and the delivery of…