Physical Security in the Cloud is it Secure?

Steve Van Till writing in SDM magazine (registration required) tackles the question: If physical security is moving to the cloud where it can be accessed on demand by anyone anywhere (even with restrictions), how do we keep it secure?

Van Till considers the question in three stages:

• Define the varieties of cloud computing in use today
• Explain which models offer the best fit for physical security
• Suggest some ways to keep the cloud secure for these applications

Assuming that the number of physical security solutions using public clouds will continue to grow, what are some of the approaches the industry (or customers) can do to make sure these applications are as secure as possible?

First, there’s an old rule of thumb that says your security is only as good as your last security audit. Vendors need to perform standardized audits, and customers need to insist on them. Within the federal market, this audit requirement has been institutionalized in FISMA (Federal Information Security Management Act) and more recently with FEDRAMP, which has a specific cloud focus.

Second, there are many best practices that the cloud industry has already started advocating. Physical security service providers should incorporate these best practices into their own offerings. One of the best sources for this type of information is the Cloud Security Alliance.

Finally, buyers always need to take at least some responsibility for the security of their purchases. Ask questions. Ask about audits. Ask where the data is hosted. Ask whether the service has undergone penetration testing. There are many “top 10 cloud security” lists on the Web — download a few and learn the hallmarks for recognizing good, secure cloud offerings for your physical security solution.   read it all here

Announcement From An Endangered Species – An Independent PSIM Vendor

Mitch Vine gives his take (registration required) on the future of independent PSIM vendors.

IPVideo Corporation, of Bay Shore, NY, an independent PSIM solutions maker is a long time veteran in the PSIM business. With 15+ years of experience in the game, they have a lot of experience to offer. Like many PSIM companies their initial products have been heavily influenced by the needs of a small number of large clients. In their case a large project for Con Edison was big influencer.

IPVideo announced a C3 Fusion^TM PSIM, a new release of their product that tracks alerts and alarms, helps plan new procedures, gives operators a work list for a specific alert situation, tracks open tasks, and generally provides tools to help deal with a busy operations centre. After a situation has been resolved, C3 fusion keeps the data in a database for later review or forensic analysis.

Their product can be used to supplement a 3rd party VMS, or used with IPVideo’s own VMS.

Although software functionality is the center of the IPVideo’s announcement, we believe that the real story is in the integration expertise that the company brings to a large end user. Any Fortune 500 company integrating video, access control, intrusion etc. across many large properties is going to need some serious customization/integration work. They will have a ton of legacy issues that will defy any simple off-the-shelf approach.

The functionality in the software demo is only a starting point for a large project. Focused vendors like IPVideo will do anything to make a large client happy. We suspect that the flexibility of their approach, and the motivation and ability of their staff to accommodate the wishes of a large client is worth at least as much as the base functionality.

In spite of the title of this article – we think that independent PSIM vendors will continue to play an important role. Even though we view them as software vendors, their role as system integrators is critical. We expect to see more of these service oriented vendors emerge.

UPDATE:  John Honovich  tweets: any vendor who sells VMS and PSIM is not independent, ipvideocorp is no more independent than verint/rontal.

I think John missed the point here.  IPVideo Corporations  independence creds are based on the companies private ownership and open business model, not the fact the they do or don’t have their own VMS.

Axis Cameras and DynaView VMS link campus security across Islip district

Having faced serious security threats in the past, Connetquot Central School District of Islip, NY has implemented a district wide security system. 

The entire Islip installation is controlled by the intuitive DynaView video management system from IPVideo Corporation.  Axis Communications published an extensive review of the project in the following case study.