After the attacks of September 11, 2001, there was a renewed interest in an area known as “converged security.” This relatively straightforward concept called for the merging of the physical security and information security domains to address multi-domain attacks and leverage the strengths of each domain.  For example, physical security folks are often better at investigations due to their more people-centric focus.  Many are former law enforcement officers and are familiar with the techniques needed to identify the perpetrator and pull together information from disparate sources.  Alternatively, information security professionals are often better at those processes that involve automation, including anomaly detection and surveillance video analytics.  With that ammunition, along with the desire of federal, state, and local governments to spend money to bulk up their public safety infrastructures, vendors rushed to offer these fully integrated services. 

However, as time passed and the memory of 9/11 became less vivid, financial and technological realities began to set in, as did organizational inertia.  The cultural divide between physical security and information security professionals was still there, and there were no obvious or simple solutions to this massive but elusive threat.  While lots of video cameras were deployed, it seemed that this was too big a problem to solve.  We needed some more manageable use cases with threats that seemed more local.  While terrorist attacks could happen anywhere, the tools that the Transportation Security Administration needs at O’Hare Airport are much different than what the city of Cedar Rapids, Iowa needs to protect its local library.  Moreover, the latter use case is much more prevalent. What seems to be needed are scalable practical solutions that tie into existing infrastructure, and standards to help the process along. 

Along those lines, Dave Fowler with VidSys, Larry Barfield of XPT2, and Steve Hunt with CompTIA will be speaking at RSA on a topic titled “Putting Logic in Physical-Logical Security.”  In their sessions summary, they note that “security professionals from both the IT and physical security camps are already mapping out how to combine [Security Information Management] SIM and [Physical Security Information Management] PSIM to quickly provide more useful intelligence for responding to and resolving complex security situations. The new strategies that leverage the convergence of both security silos make it possible to combine technology, assets and expertise across the entire organization to change the security landscape from one of reactive one-on-one combat to pro-active risk management.”  

Whether the term is situational awareness, alert management, security information management, or some other variation, the notions behind it clearly indicate that organizations, particularly those in the critical infrastructure space, need a better view of their security posture and a more dynamic understanding of the threats that they face.  While designing security information management systems for information security threats was sort of a no-brainer due to the amount of information involved, the growth of video surveillance and centralized monitoring of both physical security systems for human intruders and building management systems for climate control and energy efficiency means that the need for PSIM systems cannot be far behind.  This session certainly offers insights to this growing and evolving market.