Technology & Security Officers Collide: The Future of Security in an Internet of Things

Transcription

1 Technology & Security Officers Collide: The Future of Security in an Internet of Things Executive Summary The private security industry is a low margin, high churn business, often perceived by its customers as a grudge purchase and a necessary evil. It s a receiver rather than conceiver of innovation, getting most of what s new and exciting from governmental defence spin-offs. Will the introduction of the Internet of Things change this? In this paper we ll investigate what are some of the fundamental challanges with the way security is presently provided, examine what we mean by the Internet of Things and look out how it s likely to effect the security industry. You should read this paper if you work in security and want to be able to speak with authority to stakeholders about how the Internet of Things will effect them. It will help you plan for the future and spot new opportunities. Like in all industries, the rise of artificial intelligence connected via the Internet of Things to an explosion in sensors, will see a move away from human to machine labour in the security industry. Humans will still have their place, perhaps because their role is so varied that automation is uneconomic. This doesn t mean the end for the security officer it does mean however that present security providers need to become truly technology savvy and start using their people to gain the upper hand. 1

2 TABLE OF CONTENTS INTRODUCTION 2 SECURITY MARKET TODAY 4 WHAT IS IOT? 6 IOT AND SECRITY MARKET 12 CONCLUSION 16 2

3 3 Introduction If the IoT becomes all it promises then there will be no industry untouched by it. Knowing how it will affect the security industry will help you take the right strategic decisions and allow you to talk with authority about how it will effect your company and its relationship with customers, partners, investors and employees. To give you some idea about how big a deal the IoT could be, consider this, one estimate made by a household technology name put its prospective value at four times that of the present information technology sector, that means it could be worth over $10 trillion! How will this impact the security sector? To answer this consider how another area familiar to us all is now thinking about their future with the IoT; supermarkets see the IoT as potentially completely redefining their relationship with their customers. The following is an excerpt from a conversation I had with a board director of a large listed supermarket: We are beginning to view the customer not as a human but as the device. It won t be a person deciding to make a purchase, devices will automate much of the purchasing process, leaving humans limited to approving one off purchases but little more. This means if you re unable to talk to the device then you re unable to talk to your customer. It s a paradigm shift, where I.T. is at the heart of every supermarket. How will this translate to the security sector? Will it mean greater automation and fewer people employed?

4 4 Security Market Today The security market has changed considerably over the last few years, whilst the threat of high impact, low probability physical events (terrorism) has increased budgets, the greatest economic draw on business budgets has been cyber security. If you speak to most security systems and guarding providers they ll say there has been some spike in spend but they all recognise that most organisations now put cyber security ahead of physical security, both in terms of vulnerability and spend. Five years ago not many people had heard of Insider Threat or Social Engineering, today you ll see human behaviour at the heart of security concerns; the 2016 ASIS international conference had over one third of its content dedicated to organisational behaviour. How the traditional physical security providers fits into this new landscape is still unclear, some businesses now have a combined head of physical and cyber security but this approach isn t reflected with security providers who are still separated between physical and cyber. Security Challenges The security sector suffers from a number of challenges, namely: Security Guards they re unreliable People like you and me are unreliable. Organisations continue to rely on people that are paid very little to perform inane and repetitive actions. The problem is that many of these actions have consequences if they re incorrectly performed. We know people are unreliable, for example 90% 1 of road traffic accidents happen because of human error. We can t be relied upon to remain focused. It s inevitable where organisations rely solely on people to safeguard their assets that mistakes will happen. Take for example the last match of the English Premier League in May 2016 when a security contractor left behind a fake bomb in the toilets of Manchester United s football ground, Old Trafford. The error cost the club something like 10 million. Simple error with serious consequences. Would it be as an expensive an error if a similarly paid cleaner left their mop in the toilets? Security Guards they re expensive We re also quite expensive, you could build a house for the cost of employing a security officer around the clock for one year. 1 Bob Joop Goos, chairman of the International Organisation for Road Accident Prevention.

5 5 Systems Market Saturation Access control, intruder alarms and CCTV are far more reliable than people and over their life cycle can be far cheaper however, adoption of these technologies has slowed considerably. The market is mature and many organisations are working with disconnected legacy systems that are being maintained rather than upgraded or expanded. Software analytics promises to support the control room function but in the end the resolution and alert of events still comes back to one thing, people (who we know are unreliable, expensive etc.). Cyber people There s a huge industry working on countering and cyber attacks through clever software however, over 50% of cyber security threats originally manifest from human error 2 ; people sending files to insecure personal addresses, leaving information accessible for others to see, unconsciously introducing viruses and poor password protection. Tackling undesirable human behaviour is one of the biggest challenges facing people charged with securing their organisation s digital assets. 2 IBM Security Services 2014 Cyber Security Intelligence Index

6 6 What is the IoT, how will it change the security landscape? The IoT will potentially do two things to address these challenges: 1. Remove our reliance on people 2. Introduce a new security frontier to fight on In the following section we ll explain what we mean by IoT and then explore the new front upon which new security risks will be fought. What is the internet of things? The Internet of Things is the network of physical objects devices, vehicles, buildings and other items embedded with electronics, software, sensors, and network connectivity that enables these objects to collect and exchange data. The IoT allows objects to be sensed and controlled remotely across existing network infrastructure, creating opportunities for more direct integration of the physical world into computer-based systems, and resulting in improved efficiency, accuracy and economic benefit The concept of a network of smart devices was discussed as early as 1982, with a modified Coke machine at Carnegie Mellon University becoming the first internet-connected appliance, able to report its inventory and whether newly loaded drinks were cold. Wikipedia You might have already experienced in every day life the following examples of the IoT: Connected bus stops that your phone can use to tell you when the next bus will arrive. Home owners with connected heating systems that can be triggered remotely by mobile apps. Home security systems that can stream live pictures to your mobile phone of a home intruder

7 7 What industries will be effected by the IoT? Fig 1 shows the possible number of connected devices across different industries 3 : Estimated number of connections White Goods Devices (Billion) LPWA 2/3/4G Smart Metering Consumer Electronics Building Security 10 Building Automation 5 Wi-Fi Zig Bee Industry Health Year Cities Car It s clear at the IoT has a large role to play in building infrastructure, however its introduction is unlikely to be uniform. One source told me it would cost something like to retro-fit a device to each lamp post, with one street having up to 100 lamp posts each the cost could be prohibitively expensive for most. Expect therefore to see the technology built into new and upgraded buildings and infrastructures, in particular look out for the term smart cities, where the IoT is a strategic element of the workings of the environment. 3 Angel David, Garcia Barrio, Etisalat Digital Services

8 8 How will it be possible? LPWA There s a number of competing networks that can host the IoT. Fig 2 is one representation of how existing networks will compliment the new Low Power, Wide Area network (LPWA). Fig 2. LPWA WWAN (1000+) City & Nationwide 2/3/4G Range (m) WLAN (100) Local Area Networks Wi-Fi WHAN (10) WPAN (1) Zig Bee Bluetooth Data Rate (Mbps) It s likely the IoT will use various networks to transmit information. Fig 3 shows a comparison between the need and the network that will be used: Fig. 3

9 9 When looking at an IoT device these are the things to consider: Battery Life Geographic location Device cost Transit mode Message delivery Latency Scalability Data rage Security Of these the most important will likely be: Battery Life Geographic location Device cost The aim will be to bring device cost down to less than $1 with a battery that lasts the life of the product.

10 In Europe, 6 billion connections, more than 1 trillion 10 How s the IoT likely to grow around the world? Fig. 4 shows the possible value and connections by : Fig. 4 Latin America: 62 million connections It is estimated that 99.4% of physical objects 5 are still unconnected to the Internet, leaving huge room for growth. 4 Source: IDC 5 Schedler, Swisscom,M2M conference

11 11 The new Security Frontier By end of 2018, 20% of Smart Buildings will have suffered from digital vandalism 6. Already there has been a number of IoT security breaches, consider: October 2014 millions of smart metres in Spain are compromised February million BMWs are effected July million Chryslers recalled If you think the internet is a security minefield wait until the IoT really gets going, imagine a device that monitors your cooling system for the life time of that system, say 15 years. You re faced with the following challenges: Keeping devices up-to-date with new security risks when they re out in the field will require a high amount of effort. How many producers of these devices will be around to support them over the lifespan of these devices? How many owners of IoT devices will service them continuously over their life span? With so many devices in operation signal storms are a possibility, with some devices unable to communicate successfully. As Sean Fleming of Nokia s Sean Fleming, IoT Business & Ecosystem Development says, IoT grows the potential attack space, with security now being the number one challenge of the connected car. In this environment trust will be of paramount importance. 6 Gartner s 2016 Top 10 Predictions

12 12 IoT and the Security Market Manned Guarding, security systems, cyber security, domestic and commercial security, all will be effected by the greater level of connectivity and capability that represents the IoT. Below is how we see the security market being affected, it s worth bearing in mind what Niels Bohr said: Predictions are difficult, especially about the future. Home security market By 2022, the average household with two teenage children will own approximately 50 Internet connected devices 7. These devices can be brought together by a hub, a central control point. One such hub can be your TV. Samsung have built into their SMART TVs the ability to act as an IoT hub and with them having 1 in 4 TVs in the modern home, you can see they have a good starting position. Fig 5 illustrates how the home can be changed by the IoT. Sensors: Smoke, CCTV, Flood, Intruder IoT Gateway - 3g Network Alerts Alarm Receiving Centre - insurer manages Cloud Hosting - Object Management Platform 7 Manfred Kube, Gemalto

13 13 The domestic market is some way ahead of the commercial market because they have an environment where nothing more than Wi-Fi is needed. Domestic security system installers have a prime opportunity to introduce new sensors and provide a link to the home owners laptops and mobile devices, as well as an alarm receiving centre. Personal Security People tracking is likely to be common place in many industries, By million employees will be required to wear health and fitness tracking devices as a condition of employment 8. This is likely to incorporate tracking of people, particularly those at high risk and lone workers. It s also possible that people s wearable s will be able to detect people in distress. Commercial Security The IoT will mean at least three things for security: 1) More sensors At present a building will typically have access control of some description, along with CCTV, fire detection and perhaps an intruder system. With the price of sensors dropping and their life span extending there s the possibility that new sensors will become abundant and are used in far more areas for far more purposes than is possible today. You can imagine a perimeter having multiple movement sensors that could recognise threatening movements or assets that are hitherto untraceable (aside an annual audit), being tracked; the monthly fire extinguisher check could be a thing of the past. 2) Greater Interconnectivity At present there s a number of alarms that usually run through to a security control room, with the addition of more sensors comes the likelihood of many, many more alarms. Greater interconnectivity means more possible events, premises with multi-layered security may be able to have sensors at different points that when triggered in sequence create an alarm. It s surprisingly easy to pull together multiple sensory inputs onto one software platform. 8 Gartner s 2016 Top 10 Predictions:

14 14 3) New relationships discovered The aggregation of data across security systems presents a new opportunity to establish threat patterns. The three possible insights these can provide are: a) Connections putting together pieces of the puzzle b) Contradictions information disproving current understanding, giving rise to a new understanding c) Overcoming impasses information presenting unexplainable patterns that are then resolved Fig. 6 illustrates one way the IoT and the security officer may interact: Perimeter fence sensor triggered Investigation shows sensor to be correct, engineer sent to sensor location to repair perimeter fence Software receives sensor signal Security Officer alerted, investigates Wholistic Vision The interconnectivity of the everything is the essence of the IoT and it also presents an opportunity to look at the security sector in a wholistic way, combining the physical and the digital.

15 15 I was lucky enough to discuss this topic with a new start-up that was working on software that viewed the world as three sensors: Fig. 7 By bringing together all three sensory inputs the software can prioritise threats, so resource can be most efficiently deployed. The success of this vision rests on one thing, there being a sufficient economic case for connecting CCTV, fire detectors, PIRs, access control and intruders alarms to one digital backbone. There are of course already many interconnected building systems and the expectation may be that all newly manufactured security sensors are open protocol and easily accessed. The need to be compatible and interconnected lies at the heart of the challenge for the IoT, without openness, connectivity will be impossible.

16 16 Conclusion Throughout all industries we re seeing the rise of the machine, something like 80% of US trades on the stock market are made without human involvement 9, driverless cars are now on our roads and in twenty years expected to be the dominant form of transport. Why the move across the board? It s not just about cost or convenience, it s much more about our increased metacognition, our capacity to recognise the limits of our brain. This makes the move in the security sector away from security officers to electronic sensors inevitable. The IoT is unlikely to arrive like a juggernaut through the front bay window, announcing I m here, more likely it will arrive slowly and in many different guises. Artificial Intelligence All these things will come together and likely be subjected to artificial intelligence (simply put this is a machines ability to not only analyse inputs from sensors but to go back and address those sensors to ensure their performance is optimized), a little like a CCTV operative might change the positioning and focus of cameras to get the best possible view of hot spots. The speed and ability to self-learn makes artificial intelligence a compelling addition to the security team, it can handle the feed of thousands of sensors where CCTV operatives can handle only three or four cameras at one time. Call to action Security companies can capitalize on the IoT opportunity right now by becoming experts in security risks, rather than simply manpower providers. It s worth remembering there s no greater super computer on earth than the human mind. A security company that can demonstrate how it has used its staff to collect information, analysed this to provide insights, will be able to go back to their clients and tell them, we know about the IoT, and these are the risks it should be used to protect against. Final Word: Will the IoT Really Happen? There s three looming threats to the adoption of the IoT: 1) Lack of standardisation Without agreement on common rules both hardware and software may develop in various directions and never connect. 9

17 17 2) Fragmentation At present there s a number of networks and reaching any vertical alignment (from end device to recipient of data) relies heavily on partnering with a number of organisations. Without network consolidation roll outs of solutions will continue to involve multiple parties and with it represent a complex enterprise. 3) Non interoperability With fragmentation and a lack of standards comes the threat of non-interoperability, you buy a device for your home that doesn t work with your Smart TV, legacy devices aren t updated to work with the latest software roll-out etc. It s also worth noting that in many ways it s not whether the IoT will happen, rather will it really be noticeable? We re already surrounded by the IoT, go to a bus stop and you ll see NFC capability telling you bus times, go into most homes and you ll see as many devices as there are people. To give you a true pictures of the IoT take a look at Fig. 8 below 10 analysis, perhaps the IoT isn t that big a deal after all? Fig Ambroise Popper, Sequans Communications