Client Briefing:  System Integration; Pros and Cons

I am frequently asked why I am often unsupportive of requests by my clients to design a fully integrated alarm, access control and CCTV system. For sure, the alarm and access control systems should be integrated. It is important that when a valid card is presented to a reader that the lock release AND the alarm contact on the door shunts, avoiding a forced door alarm. Without integration, it would be necessary to turn the alarm contact off independently.

But why do I oppose integrating the access control and CCTV systems?  The reasons aren’t that complex, really. I am a security professional. I have been for half a century. The really good security professionals have one thing in common. We are all paranoid. We get paid to be paranoid. Our primary role in life is to think of things that can go wrong with our security and prevent them from happening. We can never allow ourselves to become over confident or make assumptions that we couldn’t be a victim. Our job is never done.

In the old days, just a few years ago, we all dreamed of a day when one computer sitting on the desk of the security manager ran everything, we dreamed of what computer professionals came to know as convergence when everything from your company mainframe to your refrigerator were all integrated on a single network.

In my consulting practice, I specialize in providing security for facilities with high value and often irreplaceable assets. No one has ever questioned why I include guards, locks, alarm systems, CCTV systems, non-security employee training, background checks, internal audits and other countermeasures. None of these are routinely integrated. But as soon as our security systems became networkable, there were those who wanted to network them. Because I oppose integrating everything that can be networked, I am considered to be a dinosaur.

In 2006, I told the National Conference on Cultural Property Protection that within the lifetime of most of the museum security managers in the room, we would see the first billion-dollar art heist from a museum. I also told them that it would probably be caused by a hacker who hacked into the museum’s network, attacked the access control system, brought down all of the museum’s integrated security systems, and then physically walked in to the museum and carried out the goods. It’s going to happen. When it does happen, it will almost certainly be the result of a cyber-crime and not only will we not know who did it, we won’t even know how it was done.

When we are free to design a security system for our clients using our own stringent design criteria, we specify that the alarm and access control system operate on a dedicated network and not on any shared network. We specify that the CCTV system be a stand-alone system that is not integrated with any other system and that it, too, function on its own dedicated network. And for museum clients, we specify that the object protection system be totally separate in every way, even reporting to the off-site central station via its own dialer.

What do my clients lose by allowing us to design the system this way? Nothing! Absolutely nothing.

I’m then generally told that with a fully integrated alarm, access control and CCTV system, when an alarm occurs, the event calls up without human intervention on the master monitor providing a higher level of efficiency for the control room operator who may be distracted.

I then generally counter with the argument that the very same efficiency can be achieved without integration.  Here is an example: I want to know when someone walks down a fire stairwell and exits the building via the exterior door at ground level. With a fully integrated system, this is accomplished when the door opens, tripping the magnetic contact on the door. This sends signal to the control panel’s inputs which then trips an output on the panel sending a software instruction to the CCTV system to retrieve the video and display it on the monitor after sounding an audible alert to wake up the security officer who is monitoring it.

But how can this happen with a non-integrated system?  With modern digital CCTV systems like the Acuity-vct that has proven to be so reliable in museums, a camera can be aimed at the door, employees can pass by the door all day long in view of the camera without tripping the alarm, but when someone opens that door, the alarm is tripped because the CCTV system is capable of detecting motion on the very top of the door above the head of employees passing below.

The next comment I receive is something like, “Well, yes, but that is a workaround.”

Of course, it is. But the fact is that I don’t have to integrate the two systems to accomplish the very same thing in the vast majority of instances. And a failure of one system doesn’t negatively impact the other system.

So, let’s look at what I lose by integrating the systems. Here is a list:

If the network fails and everything is on the same network, everything fails, or at least it fails to get through to the control room.

Similarly, if the network goes down for maintenance, everything goes down.

I can buy a very expensive access control system from a company like Lenel or Software House and make assumptions about the security it affords against hackers. After all, these systems are used on military bases, the Pentagon and even the White House. But when I install third party sub-systems on them, I create vulnerabilities. Take the incident report writing feature all major access control system manufacturers offer and which sends an email to the supervisor when an incident report is filed. When that email message is sent out through the firewall, a vulnerability is created. Every system or sub –system that you integrate with the access control system creates a vulnerability in some way.

So, in short, a single point of failure is created for systems intended to prevent this and add-on sub -systems create unique vulnerabilities.

When the CCTV system is integrated with a system as critical as my point monitoring and access control system, I cannot use other features on the CCTV system that create even more vulnerabilities such as monitoring remote cameras over the internet or through a wireless connection. But these features are readily available to me if the CCTV system is hacked because the mission critical access control system strays up and running.

So how can the segregated CCTV system help me if my access control system is compromised by hackers, or just fails?  If your access control system fails for any reason and it is integrated with the CCTV system, they both fail and you are left with no remaining countermeasure. But if your systems are segregated and the access control system fails, the CCTV system stays up and running. One feature common to all digital CCTV systems is the ability to detect motion. Simply turn on the lights so your CCTV system continues to see the spaces you want to protect all night long, activate the full screen motion feature, and you now have a very capable motion detection system wherever you have a camera.

I’m then told by my client that they have only the very best computer security and that a hacking or other cyber-crime like a denial of service attack is virtually impossible here. Remember what I said about a good security professional being paranoid. Remember that I said that a good security professional will never become complacent or over confident in his security? IT people need to learn this and stop being so cock sure that there are infallible.

Tell that to the Pentagon which has been hacked repeatedly, or the CIA and NSA whose deepest secrets were stolen by hackers. Tell it to Microsoft, a company with some of the best minds and deepest pockets in the business because they have been hacked. Yahoo lost 3 billion user accounts. Adult Friend Finder lost 412 million user accounts with over 20 years of data. eBay was hacked and 145 million user account details were lost. Heartland Payment Systems lost 134 million credit card records. Target lost 110 million credit and debit card account records. TJX lost 94 million credit card account records. JP Morgan Chase was hacked and 76 million households and 7 million businesses lost critical data. Then there was the U. S. Office of Personnel Management (formerly known as the Civil Service Commission) which lost employee records on 22 million people including those in sensitive positions for the CIA. And Sony lost 77 million user accounts that put their network down for a month. Don’t get me started about Equifax!

I could go on and on with a list of Fortune 500s that have been hacked in spite of having the money to hire only the best computer security experts. Are you sure that your company IT people are up to the task of protecting your assets? Of course, they aren’t. As new software is introduced, new vulnerabilities are introduced. We will always be vulnerable, no matter how good your hired guns are at their job.

It is my opinion that too many people integrate their systems and appliances on their networks because they can. They do it because doing so has been the Holy Grail for so long and it is they who are the dinosaurs. They do it because it’s “cool”. They do it because they don’t know the real risks that they create. They do it because they haven’t thought the issue through.

Before you make a decision to integrate your access control and CCTV system (or other systems, for that matter) ask yourself exactly what you lose by not integrating.  Ask what you gain by having totally segregated systems. I don’t care one bit how inconvenient it is for my security control room operator if he has to send an email to the supervisor to give notice of an incident and sending that email is not automated. I pay him to do his job and we have done it quite well for decades without full automation. My responsibility is to make absolutely certain that I do not leave a vulnerability where none existed before. I never assume that it won’t happen here. And I never put all of my eggs in one basket.

Steve Keller

Steve Keller is President and Founder of Steve Keller and Associates Inc. located in Ormond Beach, Florida. The firm designs high tech security systems for the Smithsonian Institution, The National Gallery of Art, and 950 other cultural institutions worldwide. Steve Keller and Associates is an independent non-product affiliated consulting and security engineering firm. No security system designed by the firm has ever been compromised. 

White Paper: System Integration; Pros and Cons