Introduction

With compliance regulations such as Security of Critical Infrastructure (SoCI) evolving rapidly, it is more important than ever for physical security and IT teams to work together to safeguard facilities and network infrastructure.

A research report by analyst firm IDC in March found that “a significant percentage of global physical security professionals believe the convergence of physical security and cybersecurity is happening and will require that organisations begin planning for it.” Gartner, meanwhile, found that 41 percent of organisations globally planned “to converge parts of their cyber and physical security operations by 2025”.

IT and physical security have been on the convergence path for years. The two groups clearly share some common ground. They each have long-standing organisational strengths and share a dedication to keeping the organisation secure. Both also play critical roles in corporate risk management, even if the types of risks they oversee can be vastly different.

It’s no surprise to see some convergence already occurring in forward-thinking organisations.

The Point of Convergence

While there is no right or wrong way to approach physical and IT security convergence, customer feedback indicates that organisations will avail themselves of one or several potential approaches to addressing the challenge.

One of these approaches is to have IT teams bring physical security professionals into their group, aligning IT’s goals with physical security mandates, and creating unified leadership. The Chief Information Security Officer, or CISO, often becomes the predominant leader of IT and physical security, and – in Australia, at least – often rebrands as the Chief Security Officer or CSO. This role provides a more central overview of operations and risk mitigation strategies, with a focus on resilient networks and security ecosystems.

Some organisations will go the opposite way, with physical security leaders expanding their departments with IT skills. This scenario involves physical security hiring dedicated resources within their department to oversee IT-related tasks and/or act as a bridge for enhanced interdepartmental collaboration. For instance, they may bring on cybersecurity and privacy experts or add data specialists. Incorporating existing internal IT resources within the physical department is a related option.

A third convergence model involves having a different team act as the bridge between physical and IT security. This is often implemented by broadening the security operations (SecOps) function to address security risks and capitalise on data coming from both physical and IT security. Security operations groups have experience in IT-related cybersecurity, network optimisation, and risk mitigation. In this scenario, they evolve that responsibility to also oversee those domains across physical security. They manage data across the enterprise, including from physical security sources, with the primary goal of using that information to extract business value.

All of these models or approaches have their strengths and weaknesses. There is no right or wrong approach to convergence, and the approach taken will be very much organisation-dependent.

That said, there are common support and enablement structures that can be particularly helpful for organisations that are either just starting or are already on their security convergence journeys.

Defining the Path Forward for Physical Security

In particular, an open, unified physical security platform can be useful in supporting all three convergence strategies, facilitating the IT and physical security merger.

A unified solution consolidates all physical security data – ingesting data from thousands of cameras and doors, intrusion sensors, radar technologies, intercoms, and more across facilities and remote sites – into one view.

This has benefits for physical security teams in the first instance – they can more efficiently manage security policies, monitor events, and run investigations, for example. But from a convergence perspective, this structure also simplifies data management for IT and SecOps by consolidating security system data, critically important for securing IoT devices.   Indeed, today Australian businesses are well alive to the ways in which they can be harnessed to make their existing IoT arrays more valuable – from optimising operational efficiencies to offering predictive capabilities and paving the way for more strategic decision making.

When all physical security data comes into one platform, teams can gain meaningful business insights. Data flows into an intuitive platform, providing a shared view for consistent decision-making across the enterprise. Seamless integration and a standardised data format also provide consistent paths to extract and export information to external databases or data lakes. This streamlines data sharing, enhances collaboration, and enables efficient utilisation of security information within the broader data ecosystem.

In addition, a unified platform that offers rich data visualisation can display data in maps, charts, or histograms, rather than in databases and spreadsheets. In highly regulated industries, this can help teams get to the real work faster, find valuable insights, and uncover unexpected issues. Teams can identify patterns in security incidents and better understand how current security strategies measure up. From there, they might find opportunities to enhance incident response or make cost-saving improvements to standard operating procedures (SOPs).

While organisations face several fundamental challenges when they work to increase IT/physical security team collaboration, unifying physical security systems can help ease convergence while also unlocking the power of security data.