DATE: July 23, 2018
There is no doubt that cybersecurity is having a substantial impact on businesses at all levels. The physical security industry is no different. But, where does the security integrator start to protect his business and the assets of his customer? Just knowing where to begin is daunting.
In the industry we’ve seen global scale cyber-attacks affecting hundreds of thousands of computers and IP devices in hundreds of countries. Everyone is impacted in some form or fashion by this growing threat. Ransomware attacks, denial of service (DDoS) attacks, hardware vulnerabilities, and back doors installed in IP devices just begin to scratch the surface of the lengths perpetrators go to hack into systems and steal data.
Recently, Tom Curtin with REPWORKS hosted a webinar sponsored by SIA, the Security Industry Association. Curtin is a certified expert in cybersecurity. He tells us that many well-known brands have experienced equipment hacks since 2013. REPWORKS is a LENSEC partner, providing representation for security integrators in the Northeastern United States.
Tom says, “Regardless of the device or manufacturer, there is no truly un-hackable device. Some of these companies have gone a long way to secure their products; some have created hardening guides; and, others have created standards and frameworks to protect their devices. We see a lot of company marketing materials that says, ‘we are un-hackable.’ That is not at all true.”
Best Practices
Curtin recommends going the extra mile to understand equipment and software vulnerabilities. Protect your reputation as a security integrator and provide the protection for your customer. It builds loyalty and satisfaction going forward. Here are a few simple tips that go a long way in defending your systems and those belonging to your customers:
- Keeping your computer antivirus updated is a simple task to improve protection.
- Computer updates are necessary to defend against hacks in the operating system.
- Updating firmware patches for IP devices is important to defend against cyber-attack to edge devices, such as cameras, printers, etc.
- Keep your backup files offsite to avoid ransomware snooping on shared drives.
- Update the firmware patch for your wireless router due to recent vulnerabilities in the WPA2 security encryption for WiFi access.
- Use strong, unique passwords for your network and IP devices and change them on a regular schedule.
- Hardening your equipment by disabling unused services will make it more difficult for hackers to get in.
- Bind MAC addresses and disable unused ports on network switches.
- Use Next-Generation Antivirus on your servers to provide superior protection against infiltration by hackers.
- Control network access by limiting the number of people authorized to use the security system network.
- Use 802.1x for your network protocol, requiring devices to authenticate before they can access the network and prevents unauthorized devices from tapping into the switch.
Cybersecurity Terminology
There are a lot of cybersecurity terms being used out there. Some can be confusing. For example, ransomware is a malicious worm that can move through your system of its own volition, encrypting your files as you go. The bad guy then holds your computer hostage, demanding a payment in bitcoin to release your computer data. Curtin says, “It would be ideal to not get infected, but if you do, the FBI tells us, ‘don’t to pay the ransom.’ There is no guarantee you’ll get your data back. More than likely, you won’t be able to break the encryption.”
Malware is an umbrella term that describes many typed of damaging software. Ransomware, trojan horses, and worms all fall under the umbrella of malware. Take some time to educate yourself on cybersecurity terms and best practices in defensive techniques.
The Responsibility of Risk
When an attack occurs, many parties become involved due to the risk responsibility. One might wonder who bears the burden of risk. Curtin explains the security installer is first in line to be held responsible, once an attack is implemented. This is because they are on the front line, recommending the manufacturer’s equipment and software.
Curtin addresses the security integrator and the risk they accept, saying “If you install software or hardware that is known to be vulnerable, that puts your customer at risk because you’re reducing their security posture. It puts you at risk, because when the customer gets angry, you’ll be the first person they go after, and then the manufacturer is up at the top of the chain. So, I would say the integrator has the most risk and is straight in the middle.” Tom recommends security installers to vet out their manufacturers by researching their equipment and software to identify potential risk before they choose it on behalf of their customers.
Protect Yourself
When you go to your customer sites and connect to their network, protect yourself by running antivirus on your computer. Tom tells us, “You don’t know what threats might be waiting for you within their network. You can keep from transporting their viruses to your network.”
There are certain things you should do to protect your liability. It’s also important to scan your network for vulnerabilities. Curtin recommends, “Once a month run a vulnerability scanner on your network – all of your computers. This will let you know if there are common vulnerabilities in your network.” Scanning your network regularly protects your customer and your reputation as a security integrator.
You can even consider insurance coverage for cyber liability. This protects you and your customer from the liability that comes with a cyber-attack.
There is a link for this webinar below. Look for additional information in the The LENSEC Perspective Newsletter – July 2018 for information about LENSEC’s recommendations for securing your network environment when implementing Perspective VMS®.
To contact LENSEC call (713) 395-0800 or email [email protected].
