Converged Security Mgmt Will Simplify IT And Physical Security

The strategy of putting in endpoint security solutions for specific information security threats is gradually being replaced by a Converged Security Platform that can help streamline the handling of online and physical information security threats . Ranjit Nambiar, Director of Sales, Identity and Access Management, South Asia- HID Global, in an interaction with Biztech2.com shares some potential usage areas of converged security and how it can help enterprises bring down costs.

Why are the traditional approaches to security not enough for the enterprises, and why do they need Converged Security Management?

Traditionally, approaches to security have been inclined to focus on keeping the bad guys out. Hence, security was concentrated at the perimeter of the organisation i.e. the physical points of entry. The assumption was that if you stopped the bad guys from getting through the doorway, then everything inside the building or facility was safe. But, even if you protect access to doors internally, what happens when people inside the building take important devices such as laptops, PDAs, and other handheld devices outside of the building if they need to work at home or from a different office? These devices may contain important data on the hard disk, and they can also be used to access the organisation’s network remotely.

In such instances, the organisation needs to ensure that access to computer logon and the IT network is secure. But, the fact is that even today most organisations still try to protect their IT systems by relying on passwords alone. Passwords alone are not really secure because they may be easily guessed, shared or even stolen through phishing attacks, keyboard loggers or trojans.

The market is now moving towards convergence for identity and access management, in which end user identities and access to an organisation’s assets, physical or logical, will be managed in a more convenient and seamless way. Convergence primarily centres on the deployment, use, and management of a single card or token used for secure access to physical buildings and the IT network.

How can converged security management help the various industry verticals?

Highly regulated industries such as banking, pharmaceutical, local government, police and defence may decide to incorporate converged security solution for some, or even all of their users.

In healthcare, where doctors, nurses and clinicians need to access patient data, safety and privacy are paramount. For instance, the hospital will want to ensure that only qualified clinicians are allowed to access applications that can be allowed to use prescribed drugs.

In manufacturing establishments, controlling access to the production processes is a priority. Take a food production plant for instance, if the wrong ingredients are added or in the wrong amount then this can negatively impact food quality, thereby damaging a company’s reputation, and even worse have health and safety implications. Access to dangerous or sensitive machinery such as a drill, cutting machine or laser also needs to be controlled. Again, the need to uphold standards of health and safety and quality come into play. Converged Security Management plays an important role in meeting these requirements.

Can a converged approach help in bringing down the costs?

Cost savings is a natural benefit as a converged approach, in a way, consolidates other discreet end point security solutions. It may seem surprising at first, but using two-factor authentication solutions, especially those based on converged badges can actually save organisations money. And, that’s a really important benefit in today’s tough economic climate.

Besides cost, what are some of the other benefits offered by Converged Security Management?

Convenience is the major advantage of Converged Security Management. Most IT security systems fail because they are either too complicated for users, or users find ways around the security system. If something is easy to do users are more likely to comply. By securing access to the IT network with the existing physical access badge that they already take to work, the user is offered a much more convenient and natural alternative. There are fewer things to carry around and as such fewer things to forget.

Also, typically organisations that use password-only authentication tend to impose stringent password policies to compensate for the fact that passwords alone offer very weak protection. These policies may mandate the use of complicated passwords, very long passwords, or passwords that contain special characters. Moreover, these passwords may need to be reset every 90 days, and users will not be allowed to simply re-use old passwords. This makes passwords difficult to remember and cumbersome to use. So, what happens in practice is that users either write their passwords down - which comprises security - or they forget their passwords altogether which results in them having to call the IT help desk to have their passwords reset. Recent surveys by IT security analyst Gartner have shown that on an average 40% of calls to IT helpdesks relate to password resets.

Compliance is another critical area where the enterprises can benefit from using a converged card for physical and logical access. This enables users to comply with the company’s internal IT policies or the industry regulatory requirements.