The concept of zero trust security has long been adopted and implemented in the cyber and IT worlds. The premise of zero trust is that no identity, end-point device, node or other element is to be trusted by default. Rather, every user, device, application/workload, and data flow must be continually validated using multi-factor authentication before access or other system responses are allowed, even if they have been trusted in the past.
As the cybersecurity and physical security worlds continue to converge, it has become critically important to apply the same zero trust principals to traditional physical security and surveillance systems. The zero trust model is the best approach to minimizing the risk profile of any organization or facility.
The physical element in cyber breaches
It is important to understand the role that physical security plays in cybersecurity breaches. Many of the most high-profile hacks were caused by an individual getting direct physical access to a server, IP phone, laptop, or other network access point. The art of social engineering, or cleverly manipulating guards and others to allow access to an uncredentialed person, has been perfected by today’s hackers. These criminals know that the easiest way to get into a network is through direct physical access. They are skilled in talking their way into a facility using expired or copied ID badges, falsified emails or other invalid credentials. Once they are inside the controlled perimeter of a facility, in many cases there are no additional access controls keeping them from entering any area they wish. Unoccupied offices, server closets, intercom phones, laptops and other connected building and security systems are prime attack surfaces that are rather easily accessed. A hacker has only to plug in a cable or flash drive to rapidly steal information or download malware to the system. This further elevates the need for more robust physical-cyber security protections to be put in place.
Ironically, cyberattacks on the physical security systems are one of the most preferred methods of penetrating organizations’ networks. Gartner predicts that cyber-physical system security breaches will cost businesses over $50 billion by 2023. The recent cyber attack on a leading video surveillance cloud provider demonstrates the severity of the situation, whereby 150,000 customers’ network cameras were compromised. In an editorial covering this breach that appears on SecurityInfoWatch.com, one hacker commented that they often use networked physical security systems as portals into corporate networks because the physical security and IT personnel are not on the same page with one another, and that this reported breach is “just the tip of the iceberg.”
The truth of the matter is that physical security systems and connected building systems such as access control, video surveillance, HVAC, etc. are typically operated by security and facility managers rather than IT admins. These physical systems are less fortified that IT infrastructure used for traditional business applications, making them a soft target for hackers. Consequently, PIAM is fast becoming the new perimeter and cornerstone of Zero Trust physical-cyber security.
Enforcing a zero trust physical security model
The job of implementing and enforcing a zero trust model for physical-cyber security to meet risk-reduction objectives is ultimately the responsibility of security and/or building management. To do so, the following policies and practices need to be put in place:
- Identify and prioritize risky users and access processes that pose a threat
- Establish identity assurance through a strong multi-factor authentication architecture
- Track behaviors of known risky identities
- Limit lateral movement within a facility
- Enforce least privilege at every access point
- Discover misconfigured security access policies to maintain continuous compliance across the entire organization
- Enable sharing of KPIs to improve risk analysis and investigation between physical and cyber security teams
- Audit PIAM utilizing metrics with dashboards that are shared with other stakeholders including executives
- Leverage deep learning techniques and automation that eliminate the need to create complex correlation rules
- Never trust, always verify
The Zero Trust security model has been a strategic initiative in the traditional cyber/IT world for many years now. However, in the physical security and facility systems world, Zero Trust security is still an alien concept even though one in 10 data breaches involves a physical component. Implementing a zero trust physical-cyber security model, with continuous verification of identities and privileges to determine access and other system responses, is an essential step towards minimizing risk across the enterprise.