CONVERGENCE OF LOGICAL AND PHYSICAL SECURITY SYSTEMS
INTRODUCTION
Up to now, majority of organizations have their physical and logical access systems operating as independent structures, with each being run by a totally separate department. The information technology security system, which controls access to information technology infrastructure including mail servers, the internet, database applications and web servers was managed by the department of information technology. The physical security system, which incorporates door access into buildings, systems of life support such as CCTV and Fire, and the badging process of employees, was run by the department of facilities (Mehdizadeh, Y, 2003).
Currently, security operations involve the guarding of buildings and equipment in addition to protection of networks, taking care of issues of privacy, and risk management. The interrelation between the aspects of the security initiatives necessitates consolidation of the two security systems. Such a convergence of the IT and physical security functions is important in achieving an efficient security system (Mehdizadeh, Y, 2003). However, such an operation is also lined up with disadvantages.
This paper looks at the pros and cons of combining the IT and physical security functions in a medium to large-size firm with complex IT system requirements and a global footprint. It also analyzes the fundamental components of an IT security system and explains how their integration supports and enhances the overall security profile of the organization.
PROS AND CONS OF COMBINING INFORMATION TECHNOLOGY AND PHYSICAL SECURITY FUNCTIONS.
Combining logical and physical security systems has several benefits. One of the benefits of the convergence is improved efficiency. Management of an employee’s entire credentials enables the enterprise to control the time he/she was badged, the facilities and systems they can access and the events that take place when the employee is transferred, terminated or leaves (Slater, D, 2005). The use of one data repository enables data that enters the system once to be reproduced throughout the entire organization. This enables common administration for users, credentials and privileges across both the physical and the IT fields; hence less effort and reduced possibilities of omissions or oversights when an employee leaves, is contracted or gets some change of access permission(Eugene, E.E, 2007, p.83). Another advantage of this convergence is the reduction of cost. A combined security system abolishes the necessity of local security guards; rather, guards can monitor the security system throughout using a central location. From the same central location, burglar alarms are monitored, thus obviating the need for outside contracts made with other third parties (Slater, D, 2009). Video recording is also done on server disks rather than on digital video recorders, which are far much more expensive. Elimination of the guards and moving the systems used to monitor security and burglary in-house saves a lot of money (Slater, D, 2009).
The system’s audit trail is yet another important benefit of the convergence. This audit trail can be greatly helpful in forensic investigations. For instance, in a security event, a detailed security log shows the computer that was used, the password and username, and the person who had access to the building. Moreover, a centralized data repository is helpful for real time systems monitoring (Mehdizadeh, Y, 2003).
Another benefit of this consolidation is the development of the corporate badge, which is a form of common identity used in corporate mergers. This badge provides “global roaming” in which one card enables access to all facilities worldwide in accordance to the granted authorization (Mehdizadeh, Y, 2003).
The convergence also gives the organization a much more versatile staff. This is because the system enables cross-training of the agents in an organization, thus making them aware of fields that were not in their job categories before. Employees who are assigned to certain projects become cross-trained while doing the job. This improves security and response time and enables the staff to cover each other, lowering staffing costs and giving the team members higher career opportunities (Slater, D, 2009). The convergence of IT and physical security systems also comes with disadvantages. One such disadvantage is that the security system requires knowledge which is beyond the domain of security. Most of the elements necessary for integration of logical security systems have complex setup and configuration steps which have to be carried out by a knowledgeable individual. Security departments must therefore rely on IT departments for assistance with several security project aspects. However, there exists a big communication gap since the personnel of each of the departments lacks knowledge of the other department’s domain. Solving this problem is difficult due to existence of the fear of possible loss of control or power to the other department (Eugene Schultz, E.E, 2007, p.84).
Another disadvantage of consolidating the security systems is the complex issues brought about by the fact that they offer several benefits which are non-security. The systems of such newly introduced benefits throughout an organization necessitate the extension of the elements of information technology and physical security systems infrastructure for purposes which are non-security. This brings about complicated issues for procurement, budgeting, deployment as well as the systems’ ongoing use. This also greatly expands privacy issues (Eugene Schultz, E.E, 2007, p.84).
The high cost of combining the two security systems is also a significant setback of the operation. Many organizations may lack adequate capital to carry out the necessary steps in consolidating IT and physical access systems, and an effort to achieve the same may result in retarded performance on other sectors of the organization due to financial constraint.
FUNDAMENTAL COMPONENTS OF AN INFORMATION TECHNOLOGY SECURITY SYSTEM
A logical security system is made of the following key elements:
User IDs- these are also known as user names, logins or accounts. They are distinctive personal identifiers used by a computer program’s agents where the program can be accessed by two or more users. The identifiers are created on brief sequences of numeric and alphabetic characters, and they are either chosen or assigned by the computer’s users (Kovari, P, 2005).
Authentication- this is the procedure employed by the program or network of a computer to check a user’s identity. Blind credentials lack identity but can still access the system. Identity confirmation is important to access control, a concept that grants access to authorized users and denies it to unauthorized users (Kovari, P, 2005).
Biometrics authentication is measurement of behavioral or physiological features of users for confirmation of their identity. The physiological aspects used are hand measurements, facial patterns, fingerprints, voice patterns, irises and eye retina scans. As an agent registers, some characteristics are taken and developed by a numerical process. This digit enters a database and features of users who attempts matching the stored characteristics has to match them to some given minimum error rate. The aspects of behavior used are speaker recognition, typing pattern recognition, signature recognition and gait recognition (Mehdizadeh, Y, 2003). When one registers into a system, some of their physiological features are taken and developed by a statistical algorithm. This digit is then placed in a database, such that anyone who tries matching the stored characteristics has to match them up to some minimum accepted error rate (Korari, P, 2005).
Physical keys- this refers to objects that are used to verify the identity of the person holding them. These include metallic keys used for unlocking computers, hardware devices plugged into computers so that they carry out certain programs, and smart cards having fixed microprocessor or memory (Korari, P, 2005).
When these components are integrated into the security system, they work together with the services granting access to company IT resources for example database permission, connectivity to the internet, access to the web, and e-mail. Authentication is then used for granting access of the resources depending on directories and the policies of access control for determining who can access what resources (Mehdizadeh, Y, 2003). The IT and physical security systems interact using infrastructure services installed by the department of information technology. This for instance enables a door reader to become connected to a fire protection system which is in turn tied to a CCTV system that is controlled by the physical security system. While physical security operations focus on protection of people, assets and structure as well as monitoring movement of assets and individuals throughout the buildings, logical access system controls access methods, monitors tenancy and perimeter intrusions, and enables the security personnel to easily monitor the entire security system as a single entity (Mehdizadeh, Y, 2003). The integration of IT components into the security system of an organization thus greatly supports and enhances the overall security profile of an organization.
CONCLUSION
The convergence of physical and IT security systems is beneficial to organizations, with some of the benefits including increased efficiency, reduced cost and provision of a more versatile staff. The convergence also has disadvantages, which include high costs of consolidating the systems as well as the system’s requirement of knowledge which is beyond the domain of security. Apart from the comparison between the pros and cons of the convergence of physical and IT security systems, the components of an IT security system have also been analyzed in this paper, and an explanation given on how their integration supports security operations in an organization; leading to the conclusion that integration of IT components into the security system greatly enhances the overall security profile of an organization.

References
Eugene Schultz, E. E. (2007). Risks due to convergence of physical security systems and information technology environments. Information Security Technical Report, 12(2), 80-84
Kovari, P. (2005). Red Paper: WebSphere Security Fundamentals.
Mehdizadeh, Y. (2003). SANS Institute: Convergence of Logical and Physical Security.
Slater, D. (2009). Physical and IT Security Convergence: The Basics. CSO, 1-4.