The security guard will ask you to sign in and hand over your driver’s license, but the badge reader next to the door behind him doesn’t care if you’ve ever been there before. Which raises a question: How well do you really know your networked devices?
The wall between physical and cyber security has already fallen
For many years, physical security and IT security were operating as separate silos; separate budgets, separate vendors, separate technologies and separate departments. In fact, they would very often report to different executives. This made sense when physical security systems were purely mechanical and information security was dominated by electronic systems. However, with the emergence of the Internet of Things, these worlds are colliding. Most physical security systems are now ‘IP-enabled’, which means they now sit on the network and have an electronic form to them.
How attackers actually use the gap
Many IP cameras are still being accessed with default credentials. The same is probably true for those access control panels still running the same firmware since the day they were installed. It’s not like these vulnerabilities are rare or overly complicated. They are the equivalent of low-security risk spare keys hidden under a pot plant beside the front door. And, just as burglars walk the streets trying front doors until they find one that’s open, attackers are constantly checking for known default credentials.
The vulnerabilities extend in both directions. Gain access to a building management system and you can open doors, turn off alarms, and freeze video as someone you’ll never see glances left and right and walks through a door. Gain physical access (and compare the relative ease of sweet-talking your way past a reception to brute-forcing a WPA encryption key) to find network switches, open ports, and unattended computer screens. Or even, as in one case I read about, sneak in at night and duct-tape a router under a desk for some relatively low-risk man-in-the-middle action.
IBM’s 2024 Cost of a Data Breach Report notes a 10% increase in the global average cost to a record $4.88 million. A good number of those breaches began with something as mundane as an open server room or a camera running factory-default firmware.
Start with an inventory you actually trust
You can’t secure things that you have no record of existing, and your list of assets is likely worse than you realize. We’re not just talking about laptops and servers. We mean every badge reader, every camera, every smart lock, every environmental sensor, every building automation system that connects to your network.
For each of those items, you ideally want to know what kind of thing it is, what firmware it runs, who’s responsible for maintaining it, and what it’s talking to. This is as dull as it sounds, but it’s also the most high impact thing you can do. If you skip it, all the other cool stuff you build is going on top of a trash fire.
Segment as many things as possible
Once you have a rough idea, cut as many things off as you can. That sounds overly negative, but what it means is: put all your physical security stuff – cameras, access control panels, building management systems – on a separate VLAN than your corporate IT traffic. Then set your firewall rules up so they don’t have inbound internet access unless they absolutely need it to do their jobs.
This won’t be enough on its own, but it will massively reduce the number of things an attacker can pivot to after they compromise a security cam. That’s because they won’t be able to just jump over to your finance systems or your HR database. It also tends to be something that’s cheap, fast and easy to get started with. Most decent pen testers will make this exact recommendation after a 30-minute call.
Apply zero trust to doors, not just logins
Zero trust may have originated as a network security concept – never trust, always verify – but it doesn’t have to end at the login screen. After all, a badge reader is just another form of login. Access control systems match who you claim to be against a list of who’s allowed where and when, which is analogous to authenticating your username against a list of who’s allowed to log into a computer when and from where. The principle applies just as well in both cases.
Just because someone has their valid badge on them doesn’t mean they should have carte blanche to wander every floor and every room. Least-privilege access should be the norm at a physical level as much as it is for computers. A break-fix contractor who needs access to the server room for a few hours should get temporary access that expires automatically, not a permanent badge entry nobody remembers to revoke. Monitor physical access the same way you’d monitor failed login attempts – a swipe of a badge at 3:00 am on a weekend should ring just as many alarm bells as a login attempt from an unrecognized device.
Bring physical alerts into the same room as cyber alerts
Many Security Operations Centers don’t include physical security events in their monitoring pipeline. Specifically, a failed badge swipe may not be noteworthy on its own, but when followed by a suspicious login attempt from a workstation near that door, it’s definitely worth your time. Your SIEM can’t spot that kind of time-sensitive pattern for you unless you feed it all the relevant data streams.
This is an easy win. Your old tools don’t even have to go away: most modern access control and camera systems have an API to query them for their logs or they write logs in a common format that the SIEM already knows how to deal with. Got badge readers sending logs to a syslog server over UDP port 514? You’re 90% of the way there.
Insider threats are where convergence gets real
It is harder for an external adversary to obtain physical access and network login credentials. An employee already has both. This is the simplest example of why insider threat is the driver of convergence: a disgruntled employee with a badge and a login is a physical and cyber risk that neither the physical security team nor the IT department can fully ascertain without help.
Unified monitoring overcomes this deficiency. When someone’s physical access and network use are both monitored on the same system, then patterns such as unusual access to a given area outside business hours followed immediately by a data dump become apparent, where they would not be flagged if the two sets of data are stored independently of one another. This is not about distrusting employees. It is ensuring that the few bad cases do not slip through the gap because nobody thought to take a whole picture.
Don’t forget your vendors are part of your perimeter
Any external security vendor you engage with, whether it’s the firm that implemented your access management tool or the supplier of your surveillance cameras, is essentially part of your overall security hygiene. The patch policies they adhere to automatically apply to you. The firmware update schedule they commit to is your time window of exposure.
Your vendor contracts need to make this very clear: How quickly are firmware vulnerabilities rolled out? What secure development protocols do they enforce? What are their responsibilities toward incident disclosure in the event of a compromise of their product? If a vendor can’t provide a crisp response to these questions, then that’s a signal in itself.
Building the roadmap without overloading your teams
Facing reality, most facility managers haven’t been trained in how to do network segmentation, and most IT teams don’t come equipped with a background in guard scheduling or camera maintenance. It isn’t usually successful, for example, to tell a facility team, “by the way, you now also run cybersecurity for the front gate.” What works better is to make a series of incremental changes, each of which taps into the skills and priorities of both groups.
Start with inventory, move to segmentation, then harden configurations across both domains, then integrate monitoring, then test the whole thing with a combined red-team exercise that attempts physical intrusion and network exploitation in the same engagement. That last step matters more than people expect – a penetration test that only checks network defenses, or only checks whether someone can walk past reception, misses exactly the seam you’re trying to protect.
For organizations that don’t have the internal capacity to manage both physical guarding and electronic security in-house, engaging a full-service provider like AG Security Group is often the more realistic path than trying to build that capability from scratch. That single point of accountability – where coordination between guarding, access control, and electronic monitoring happens within one structure – is often what’s missing when organizations try to bolt physical and cyber programs together internally.
What good convergence actually looks like
This doesn’t mean that you should immediately combine your physical security and IT departments and have them working together. This often leads to more issues than solutions. What it means is that you should have shared transparency: the same inventory of assets, segmented networks, monitoring systems, and contracts with vendors having the same obligations as you would expect from your internal team.
ASIS International has long advocated for security convergence in its standards, and the NIST Cybersecurity Framework provides a good foundation that can be applied to physical security governance. The framework already exists. What is missing in most cases is the drive to bring together two different teams that have worked independently for so long that it seems easier to just avoid interacting.
But making them work together is not an additional effort, it’s the effort. The network and the building ceased to be separate the day the first camera was connected to the Internet, and any other day you spend considering them as separate entities is an opportunity for an attacker to exploit this gap.
