To Protect and ServeBy Baselinemag | Posted 2003-09-01 Email Print
Modernizing Authentication — What It Takes to Transform Secure Access
Many companies are keeping a lid on security spending, but that doesn't mean they're standing pat.
That can mean consolidating responsibility for security under a single department to drive tougher bargains with security service and equipment providers. It can mean making perimeter-security technologies such as video and access- control systems work with existing corporate networks and building-control systems. It can mean more security guards prowling hallwaysbut fewer sitting in lobbies monitoring screens.
A survey of 199 corporate security managers by the Conference Board showed that, in 2002, the median increase in security spending by corporations was 4% above 2001 levels. Even after the terrorist attacks in New York City and Washington, D.C., on Sept. 11, 2001, 63% of enterprises said they spent less than 1% of sales on security.
At communications-gear supplier Avaya, digital cameras are replacing conventional cameras in watching the premises. Why? The cost of the new cameras is more than offset by the benefits of transmitting their output across the company's existing data networks.
"You can save a lot of money if you use the existing LAN or WAN as much as possible," says Marene Allison, Avaya's director of global security.
Not long after the terrorist attacks, the Basking Ridge, N.J.-based company centralized responsibility for security planning and spending under a single organization headed by Allison. She immediately reviewed all of the contracts that the company's various offices had negotiated independently for security guard services. After consolidating those contracts with a few vendors and renegotiating deals, Allison lowered Avaya's annual spending on security guards by 25%.
Willie Hall, director of security at the 56-story Renaissance Tower office building in Dallas, is also using digits to capture, communicate and store images. By hooking his existing analog cameras to digital video recorders, Hall says, he'll be able to store images more inexpensively on disk and more easily expand his network of cameras from 80 to a planned 128.
Such shifting of spending reflects tight times. "Security spending is rising faster in some industries, and organizations are spending more to secure buildings than on hiring, but overall the slow economy has made it difficult for many companies to increase security budgets much," says Thomas Cavanagh, a researcher at the Conference Board. Financial-services firms and utilities reported the biggest increases.
Public agencies, though, are among the organizations feeling pinched financially.
Consider Santana High School in southern Californiawhere, on March 5, 2001, a troubled student opened fire on classmates, killing two of them. After the incident, district officials formed a task force to study school security. Then, state, federal and local officials came up with money to put more guards and police on campuses, augmenting the district's own security guard staff.
Two-and-a-half years later, Grossmont Union High School District, which oversees Santana, is now considering a plan to reduce spending on security guards. The school district is moving to a digital surveillance setup that, it is hoped, will cut down on vandalism and theft while reducing the need for security guards on each of the district's 11 campuses, according to Jack Blaylock, the district's director of technical services.
He has been testing Sony cameras and Cisco networking hardware so security guards and police can monitor activities on campus from personal computers. Because the cameras have their own Internet addresses, they can each be accessed and controlled remotely by authorized security personnel.
Blaylock is not yet convinced the new video surveillance system will compensate for the staff cuts. "We have six guards, and they want to move that back to two," he says. "How are we going to replace what these guys do?"
The video cameras will allow security to pan a wide area and zoom in on specific areas. With the old fixed camera setup, he says, "troublemakers got to know what was in range and what wasn't." With the new system, however, they won't knowat least immediately.
Organizations are also beginning to tie card key and biometric systems for controlling access to buildings into their networks. Traditionally, building-control systems from manufacturers such as General Electric and Johnson Controls have been used mainly to regulate heating, cooling, air circulation and power consumption in large buildings. But by integrating automatic door locks, access control systems and even video into these systems and running everything on the corporate network, organizations can use a smaller staff to monitor building services from their PCs.
"This lets us make better use of the security people we have," says Dean Barrett, building manager of the Kansas City Convention and Entertainment Centers, which has integrated a Johnson Controls building-control system with door locks and access control systems. "Like every municipality, we're facing a huge staffing issue. We just don't have the money to add people."
While allowing video, access control and other security gear to share existing corporate networks does have its advantages, it also can bring complications. Information technology staff, say security managers, often balk at granting video or building control systems access to the corporate network, worried these systems will create capacity and security problems.
At Avaya, Allison anticipated such problems even before suggesting running video over the corporate network. She made sure the information technology department was included in a corporate steering committee set up to plan security.
Technology project leaders "need to know in advance what the bandwidth and continuity requirements will be for security applications," says Allison. "We need to communicate and plan because we're not going to be able to just throw money at security."