The digital transformation in physical security
- 2. 1 Paolo Sciarappa INDICE INTRODUCTION 2 CHAPTER 1 4 The evolution of the context and the management of information 4 1.1. Information overflow and human factor.......................Error! Bookmark not defined. CHAPTER 2 9 PSIM Systems 4.0 9 CHAPTER 3 19 Big Data & Information Management 19 3.1. Descriptive Analytics ..................................................................................................19 3.2. Machine Learning.......................................................................................................21 3.1. Physical Security as a service (PSaaS)........................................................................29 3.2. Cyber Physical Security...............................................................................................30 Conclusion 32 Bibliography:........................................................................................................................33 Sitography: ...........................................................................................................................33
- 3. 2 Paolo Sciarappa INTRODUCTION To fully understand the digital transformation of Physical Security, it is necessary to analyze the context in which it has evolved by retracing the phases of its evolution and its relations with other sectors of security. Through this analysis I will illustrate the profound changes it has undergone, the new opportunities and its new role in security. You can have the best firewalls and change control procedures; you can have regular electronic penetration testing against networks and applications; you can audit your source code and lock down your servers. However, if an attacker can physically penetrate your premises and access information systems directly, these strategies won’t protect you 1. Will Allsopp Its contribution to the protection of information has been revalued in recent years, thanks to changes introduced with technological innovation. The Physical Security evolves slowly, without major technological and organizational changes until the two thousand years, the passive security that had been the historical protagonist in the implementation of countermeasures gives way to the active component, less expensive and more rich in novelty. We are in the phase that I would define as analogical and autarchic. The organizational component was and in many ways, even today, appears backward and focused on classic models. With the two thousand years begins the process of digitalization of Physical Security and its evolution from the autarkic phase to that of close synergy with the world of technologies and distributed networks, up to the sharing of information with the other business organizational units. Even the skills evolve, the technological component changes rapidly to require skills closer to the 1 Will Allsopp Unauthorised Access: Physical Penetration Testing for IT Security Teams 2009
- 4. 3 Paolo Sciarappa world of Information Technology than to the classic analogue world. The organizational structure remains unchanged. The digital transformation that has recently begun has led, in some cases, to a profound transformation of business organizations, starting from the processes up to the information flows. Physical Security has undergone an unprecedented innovative drive in recent years. The combined use of new technologies has produced new tools, whose evolution is constantly growing. As we will see many of these technologies are common to different areas of application, IoT and Big Data Analytics are an example. Thus new scenarios are opened, far from the self-sufficient models of the past. The convergence of IP networks and the migration of old sensors and applications from the world of proprietary networks to that of TCP-IP has certainly encouraged this transformation. Digital transformation does not exhaust its effects in technologies, it imposes a revision of organizational structures, procedures and human capital. We will see how the latter is the weak link in digital transformation. If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.2 Bruce Schneier The difficulty in finding the skills necessary to manage both the change and the operation could undermine the undoubted positive effects of these new models that must be accompanied by a careful analysis of the new risk scenarios. The approach to identifying and planning countermeasures has undergone major changes. Today, the risk analysis not only takes into consideration new threats, the result of technological evolution, but is based on more stringent disciplines that take into account the controls required by the various standard management systems and European Data Protection Regulations.
- 5. 4 Paolo Sciarappa CHAPTER 1 The evolution of the context and the management of information. A multifunction supervision systems have spread since the 2000s. Systems for managing access control, intrusion detection, fire detection and video surveillance are often integrated into a single application. The benefits appeared immediately evident because through the use of a single interface it was possible to manage an event in its entirety: analysis of the intrusion, control of the possible access and visual feedback, all in a single front-end. To this was added a series of facilities for remote site management: many of the operations that were handled by personnel located in different geographical areas, were progressively centralized in a few Security Operations Center. The construction of modern buildings has contributed to the expansion of these integrated systems, but with a logic that is far from the one to which they were inspired, in many cases the integration did not take place or was partial. The combination of these systems has led to an exponential increase in the information to be managed. This element is important for understanding how and how much informational excess, if not properly managed, can compromise the safety of people and assets. Failure to integrate subsystems has played an important role in the inflation process, along with other factors related to elements intrinsic to sensor technology. Unfortunately, in some cases the Security project had an excessive focus on cost reduction rather than on real management optimizations and analysis of related risks. The technological component was also overestimated, without considering that data management was still manual. Progressively the field sensors related to the various safety subsystems have evolved by multiplying the information and using more intelligent and sophisticated technologies that require in turn more and more specific skills, both for their installation and for the configuration. The situation is clearly
- 6. 5 Paolo Sciarappa more critical when the number of subsystems is high. Finally, system information is added to report server, pc and network connections. We have thus arrived at the full digitalization of security systems, a huge flow of information to be cataloged and managed, a prerequisite for what will then be the "digital transformation". Internal procedures, reserved for insiders, often do not take into account the changed reality regarding the management of alarm events, technical support and escalation procedures. This management is extremely complex and heterogeneous and requires more and more specific preparation and a strong attitude to "Problem solving". Technological support is certainly at the base, but discretionary scope is always fundamental, at least in large companies. The theme of alarm management is different in the control centers of the Security firm, where alarm signals are more homogeneous and standardized. Often these are cumulative alarms of smaller entities, even if the number of remote sites managed is significantly higher. Often the sense of security is directly proportional to the level of innovation used to guarantee it. The term innovation already has a positive meaning in itself, but to really benefit from innovation, the most appropriate technology must be used, taking into account the organizational context in which it will be applied. First of all, therefore, a careful and in-depth analysis of the risk that must surely start from threats, but must also evaluate the effects of countermeasures in organizational and management terms. The assessment activity subsequent to the application of countermeasures, what I would call "Responsive impact assessment", is fundamental for measuring the degree of efficiency and effectiveness in the organization's response to a critical event. If the information flow is such that it cannot be absorbed efficiently, the derivative risk could be higher than the initially calculated one. It is not just a process of improvement, already computed in the Deming cycle, but of a different and essential activity to the point where it can determine the degree
- 7. 6 Paolo Sciarappa of applicability of a countermeasure that could even worsen the level of risk initially calculated. Often the System Integrators suggest guided procedures (wizards) to support the operator in choosing the operations to be performed. I do not think this is the right way, I think it is more effective to make security operators responsible for choices by developing skills and professionalism. In any case, the criticality in the management of information is focused on the interpretation of the data rather than on the reaction. 1.1. Information overflow and human factor The expansion of centralized systems associated with a short-sighted installation logic that does not take into account the possible use of correlation elements, has led to an excessive granularity of the alarms. Moreover, in some cases, the tendency has been to bring back to the operator's console not exactly security alarms, even if at the service of it, an activity that should remain in charge of maintenance services. To these are added false alarms, in addition to the improper alarms that derive from authorized accesses. False alarms, some of which derive from external factors and related to environmental conditions, are a real safety disaster. Many false alarms also derive from a bad or non-existent maintenance, others still from installation faults. Finally, there are false alarms resulting from incorrect classification.
- 8. 7 Paolo Sciarappa The immediate consequence of this informative excess is the reduction in the level of attention or the misinterpretation of events, which leads to increased exposure to risk for company assets and people. To give an idea of the volume of data flowing to a business center of a large company, I can list some related to the reality of Vodafone Italy. 20.000 intrusion and environmental sensors 1200 card readers 36.000.000 transits per year 1400 cameras In this context the role of those responsible for monitoring alarm events is complicated, the skills and professional skills required to manage such a situation are very challenging. As I said, in addition to problem solving and team working skills, specific technical skills are required. The proactivity and professionalism of the operator become fundamental in order to be able to manage a situation of this type, in fact a great capacity for
- 9. 8 Paolo Sciarappa analysis and intervention is needed, both to maintain efficient systems and to guarantee a prompt reaction when necessary. We will see later the great help that the digital transformation brings, but in any case the high degree of discretionality in the decisions will not fail. In this context, procedures play a key role, reducing and simplifying processes and reporting in favor of a greater focus on objectives and KPIs.
- 10. 9 Paolo Sciarappa CHAPTER 2 PSIM System 4.0 Physical Security Information Management (PSIM) systems are software platforms designed for the purpose of unifying information management, supporting security operators on the decisions to be taken in the face of a critical event and providing aggregated elements for the Security Managers in order to can evaluate the efficiency and effectiveness of security systems. They are used to collect, analyze and correlate data from various subsystems and security devices. These are relatively recent solutions, but only for a few years have they found widespread use, albeit in different forms and with non- uniform technological solutions. Their evolution is at the base of the digital transformation that has affected the sector and that is why it is necessary to correctly understand the purpose and their practical declination. They are the starting point for the revolutionary management of information obtained from the large amount of data coming from the various systems involved, subsequently extended by the analysis of open sources. The application of business intelligence and the principles of information management has marked a change in the vision of an isolated world. It is therefore a double-track, informative and technological revolution. The evolution of these systems towards ICT has helped to standardize information making it more usable to other business units and at the same time allowing to draw from other units. This interaction facilitates the assessment activity for the verification of compliance with the guidelines imposed by international organizations for the standardization of processes. The purpose of Physical Security is primarily the protection of people, then the protection of data, systems, equipment, facilities and other tangible and intangible assets of the company. This is why it is essential to seek full integration with all company systems that can contribute to achieving these
- 11. 10 Paolo Sciarappa goals. The logic of silos is a legacy of the past and is no longer suitable to defend companies from new threats, such as cyber-attacks and terrorism. The integration with the other business units takes the form, for example, with the sharing of data from HR, Information Technology and Safety systems. By sharing the same repository for identity management, with the alignment of physical and logical accesses and with the implementation of a shared account management process. The company badge is an example of possible technological convergence. It can be a multifunctional tool used for time and attendance tracking, for secure printing, as a payment tool, as a container for biometric information and for accessing IT resources. The ISO / IEC 27001 standard (Information Technology - Security Techniques - Information Security Management Systems - Requirements) requires the verification of a series of controls, the feedback of which is simplified in the presence of an open system and integrated with the other business units in which processes are shared, tracked and validated in an appropriate and consistent manner. These controls, aimed at achieving precise objectives, affect both the system intended as a requirement for achieving objectives aimed at protecting information of the entire business, and the system as a source of data to be protected in terms of confidentiality, integrity, availability and compliance. The PSIM systems also contribute to ensuring compliance with the administrative responsibility of the companies (see also Physical Cyber Attack) and the US legislation (Sarbanes Oxley Act) for listed companies. This conformity is achieved with the positive feedback to the controls imposed by the rules and which can have first and natural feedback precisely in the PSIM systems, also designed for this purpose. The General Data Protection Regulation (Regulation (EU) No. 2016/679) under Article 32 - Security of Processing - requires that the controller and processor should implement appropriate technical and organizational measures to
- 12. 11 Paolo Sciarappa guarantee a level of safety commensurate with risk requiring restoring of availability and access to personal data in a timely manner in the event of a physical or technical accident. Article 32 goes further explaining that when assessing the appropriate level of security, account should be taken of the risks associated with accidental or illegal causes of destruction, loss, alteration, unauthorized disclosure of information or access to personal data transmitted, stored or otherwise processed. This regulation emphasizes the importance of preventing unauthorized access to data. It is therefore evident the key role that the Physical Security assumes and of how it can be supported by the modern PSIM in the protection of data against malicious actions that aim to exploit the vulnerabilities of the company. As we will see later, the PSIM systems meet the requirements of the management systems in the part dedicated to the improvement of processes and products, as they measure their efficiency and effectiveness. Example of aggregated representation of system events.
- 13. 12 Paolo Sciarappa In fact, one of the purposes of the advanced PSIM is to provide an aggregate and continuous representation of the efficiency and effectiveness of the systems, also with reference to predetermined KPIs. This allows not only to immediately identify the areas at greatest risk and evaluate the effectiveness of maintenance contracts, but also to effectively target the budget on the areas most exposed, reducing costs with the introduction of new technologies or new models of protection, more efficient than those that were most likely fallacious. It is a process that ensures a more accurate risk analysis by helping to make corrective actions more incisive or by assessing the coverage of residual risk with alternative measures. The evaluation of a Physical Security project (technologies, human resources and procedures) must also be based on performance, this indicator allows us to understand how well it is operating in ensuring the achievement of the objectives by an organization. The technological component does not have a precise standard of reference. In the original idea, the PSIM systems would have had to take the place of the individual under supervision systems with the double advantage of being able to be supervised with a single monitor and to provide summary information through the correlation of several events. A prerequisite for the unification of the systems is the availability of the producers of the various devices to provide the necessary protocols for their integration. This is a crucial point that has prevented, until today, the diffusion of these systems. The use of these platforms is very expensive because it does not allow the elimination of the individual subsystems, but is added to the existing ones. These are enterprise solutions aimed at critical and complex realities, which is why single-brand solutions have found greater favor in companies, an acceptable compromise to ensure the integration between their proprietary subsystems and to be relatively open to information sharing. On the other hand, they present some technical and commercial problems, they do not offer tailor-made security solutions in relation to the various company needs, the software platforms are linked to the proprietary hardware and do not offer very advanced innovative solutions. The constraint to the proprietary hardware is very strong and often does not allow the use of the most modern and efficient devices. Surely the
- 14. 13 Paolo Sciarappa most critical problem is perceived on the commercial front, the economic tie based on the investment necessary for a change of product or supplier is very high. The result is a very delicate and unbalanced relationship with the supplier, especially for systems that integrate building management functions. Finally, they are more oriented towards data collection than their analysis, even if in this sense recent developments seem very interesting and promising. Many PSIM solutions currently on the market do not meet the classical criteria that these systems are brought to: freedom in the choice of underlying products and control of field devices. Instead, they focus on the collection, organization and analysis of the data made available by the various systems, including open sources on the internet. These are very interesting vertical solutions, especially in cases where it is not possible to integrate existing systems at the level of field devices. However, the return on investment is not short-term and is measurable mainly in terms of greater resilience and compliance. The case of more advanced PSIM systems is rather different. These can be used as the only vertical solution; in fact, the field sensors are managed directly by centralizing the data coming from the field. Example of data collection relating to badge readers.
- 15. 14 Paolo Sciarappa They replace single-brand integrators integrating third-party subsystems with obvious benefits in economic and performance terms. They allow the use of a wide range of products at lower and technologically more advanced costs. Another plus of these systems is given by a greater penetration in the correlation of data, indispensable for the management of critical events in real time. The correlation of data offers undoubted benefits. In reality very complex the number of information to be managed is enormous and it is for this reason that the events are classified according to their importance and managed accordingly. However, there are many events that, if evaluated individually, are not to be considered critical, but if analyzed in a broader context and properly correlated they assume a different gravity and provide important information that would otherwise escape the attention of the operator. Then there are other cases in which the correlation allows a faster response, with the consequent reduction of the impact on the business. The correlation should be multilevel, bidirectional and multifunctional. The information is presented to the operator by correlating more input data and is processed automatically generating outgoing events to multiple systems belonging to different functional areas. For this reason, the choice of these evolved PSIMs, which I would call 4.0 in parallel with the recent industrial innovations, must be adequately evaluated and with transversal skills. The practical examples of correlation are innumerable: The logical access to a defined critical production system could be granted only in the presence of a transit on the turnstiles verified by the access control system. On the other hand, logical security systems should inhibit remote access using a PC stolen from the company. This is only possible with an information exchange between different systems and that are normally
- 16. 15 Paolo Sciarappa managed by figures not belonging to the same functional unit. The information exchange should also concern the operators of IT call centers that should not provide assistance on these PCs, I refer for example to the request of a recovery key for a PC with BitLocker Drive Encryption (function that allows to encrypt the data of a PC). The applicant's identification is often summary and not formal. Safety also benefits from these correlations. The authorization of a badge for access to a technical site may be subject to the execution of prevention and protection courses or the compliance of the security documentation. We think of the break-in of an internal gate, the signal could come to the operator with the resumption of the affected area and with the indication of the name of the transgressor. The recognition is possible by correlating the data obtained from the access control system to the entrance of the building with the biometric recognition carried out by the video system at the time of the break-in. An alarm that signals the opening of a safety exit, an often recursive event in some environments, correlated with the information on the directionality of the movement previously analyzed by the interested cameras, provides the operator with an immediate indication of the seriousness of the event. Also sensors normally used only when the system is inserted can provide useful information, if related. A volumetric sensor that activates in a restricted access area, without having detected a previous authorized transit by the access control system, in a reasonable time unit, is reported to the operator as a serious intrusion event. The sensors themselves can provide an indication of the state of occupation of the building in case of evacuation. In other cases, the correlation is used to increase the reliability level of sensors subject to false alarms, for example generating an alarm only following the signaling of several sensors pertaining to different subsystems: the signaling of
- 17. 16 Paolo Sciarappa an intrusion detected by perimeter IR barriers in AND with that coming from the video analysis of the camera. The growth prospects of the PSIM systems are very promising. According to Frost & Sullivan, a multinational consulting and economic analysis company, the global PSIM market will grow 20 times between 2011 and 2021. Transparency Market Research expects growth at a compound annual rate (CAGR) of 18.7% between 2016 and 2024. Lastly, the recent report by the research firm Wiseguy confirms the growth trend, even if with a more contained outlook, the compound annual growth rate is expected to be between 14% and 15% in the 2016-2020 period. The development of these systems is determined by the economic and financial sustainability of companies and their sensitivity to new risks related to the era of digital transformation. Despite the growing cyber threats and physical security by terrorists and illegal organizations, many companies impose continuous savings targets, probably against a perceived low probability, compared to the occurrence of the event. However, the impacts could be very heavy, especially in terms of interruption of business activities and brand reputation. New threats require new tools to address risks in a holistic security concept. This is an investment in risk management that should be carefully analyzed. Without forgetting that the operational centers also supervise alarms that are not a direct consequence of malicious actions; the delay in managing a fire / flooding alarm or neglecting a bulletin issued by the civil protection could have serious consequences for the safety of people. Managing information efficiently and effectively means anticipating and therefore preventing the occurrence of accidents. This does not mean that the positive effects cannot be evaluated concretely. Using two indicators such as the Total Cost of Ownership (TCO), which measures the initial cost of purchasing the software and the cost of maintaining it, and the Return on Investment (ROI) that measures the gains of an investment compared to its cost, emerges an interesting fact.
- 18. 17 Paolo Sciarappa PSIM systems are not for everyone and have not always been convenient. There have been cases in which there were some features that turned out to be useless or non-existent and for this reason they were often negatively evaluated by end users as well as for the excessive functionality and complexity of use. Finally, in some cases the integration and centralization of legacy systems has been achieved at very high costs. Today, advanced PSIM solutions can integrate and centralize a larger number of solutions and products and are easier to manage, enabling faster and more efficient deployment and utilization. The ability to use the most cost-effective and innovative products without binding to a single brand or supplier leads to tangible returns on ROI. Added to this are the cost reductions due to higher efficiencies (vigilance reduction, business intelligence, greater resilience, ecc.). Il cost of ownership can be significantly reduced if the system is not closed or owner. The initial costs are lower compared to the mono-brand integrated systems, also due to greater competition. Those related to its maintenance are also reduced both because the value of installed products is lower and therefore positively affects the maintenance contract, and because 'normally evolutionary maintenance includes software release upgrades.
- 19. 18 Paolo Sciarappa However, most large companies already use one or more supervisory systems, so would the purchase of a PSIM 4.0 justify the investment? In this case the investment is justified on the one hand for a reduction in the operating cost and on the other for greater efficiency and effectiveness due to a better analysis and management of information. This is the strength of these systems, above all thanks to the new business intelligence technologies applied to Big Data, which we will see in detail in the next chapter. In addition, the type of information available increases, from open sources on the internet, to environmental sensors installed on the territory and to information bulletins of government bodies. Using API components (Application Programming Interface, they concern the software programming and allow to simplify the dialogue between an application and another) and SDK (Software Development Kit) to interface search engines and social media you can obtain data that can be correlated with those obtained from the sensors obtaining information with high added value. In this way, the operational management, simpler and more immediate, is also improved, finally the use of modern web standards for the presentation and search of information reduces reaction times.
- 20. 19 Paolo Sciarappa CHAPTER 3 Big Data & Information Management As we have seen; the world of physical security is filled with cutting-edge technologies capable of producing huge amounts of data. In the Internet of Things era every object on the net can be a threat and at the same time help to provide valuable data for security. Then all the data coming from open sources and those imported from the other business units are added. The analysis of open sources is now essential to assess and understand the threats, especially the most recent ones such as Islamic terrorism and cyber- crime and to be able to proactively face natural disasters and fires that could cause serious damage to assets and facilities. as well as threatening employee health. It is therefore essential to have advanced technologies and techniques focused on data presentation and analysis, able to create value by bringing out hidden data, presenting aggregate and related information of rapid and immediate understanding. Large companies, especially critical infrastructures, are the most exposed to new threats. As we know the prevention and identification of appropriate countermeasures passes through knowledge. These new analysis techniques make it possible to make decisions with greater awareness and speed. 3.1. Descriptive Analytics It starts with the Descriptive Analysis which has its main support in the tools that allow to represent and describe reality, also in a graphic way, through the interpretation of data. Descriptive Analytics allows the graphical display of the efficiency and effectiveness of the organization's control and reaction center. For this purpose, dashboards, analytical reports and query tools are used.
- 21. 20 Paolo Sciarappa The Security Dashboard, an example of a graphical representation of events: È It is a system of indicators appropriately organized to provide selected and aggregated data on the data being analyzed, with the following characteristics: • Summary of the performance of intervention times and reaction times. • Status of employment of the company areas. • Status of application efficiency. • Summary of faulty sensors disabled and maintenance status. • Summary of the state of risk exposure. • Network efficiency status. • Status of efficiency of video recording systems and retention times. • Summary of alarms in progress. • Telephone queue summary and waiting times. Analytical reports and queries are used to extract and share specific information. They are very useful for evaluating the effectiveness of Physical Security strategies and effectively planning structural interventions by subjecting them to periodic reviews to assess the impacts of investments.
- 22. 21 Paolo Sciarappa 3.2. Machine Learning The manual analysis of huge volumes of data coming from heterogeneous systems to detect or prevent accidents can be a very burdensome exercise as well as little indicated if you are not clear in mind what to look for. Furthermore, traditional tools do not take the "context" scenario into account. The use of Machine Learning allows learning without explicit and preventive programming. The definition most accredited by the scientific community is that provided by Tom Michael Mitchell, director of the Machine Learning department of Carnegie Mellon University: «A computer program is said to learn from experience ‘E’, with respect to some class of tasks ‘T’ and performance measure ‘P’ if its performance at tasks in ‘T’ as measured by ‘P’ improves with experience ‘E’ ». These are algorithms capable of automatically improving the performance of results through experience. These algorithms are able to learn continuously from the data themselves and discover unknown information and unexplored views, identifying and extracting value without having been programmed to know exactly where to look for it. Thanks to this approach, the
- 23. 22 Paolo Sciarappa analysis also becomes a predictive tool (Predictive Analytics) that expands the time horizon of information, from present to future, thanks to the mathematical juxtaposition between the condition and the probability of the occurrence of an event. Even in everyday life we use algorithms to solve problems, even the simplest ones. In many cases, these are simple sequential instructions that allow us, through a series of operational choices, to reach the goal. But there are many problems that cannot be addressed in this way. Let's imagine that we need to implement an algorithm that allows us to distinguish the various animal species. One way could be to write a series of physical characteristics of each species and then make the algorithm apply the rules by classifying the animals. We can decline a large number (shape and distance of the eyes, number of legs, etc.), but the results will never be satisfactory for the countless variables in the field. Machine Learning, on the other hand, uses a totally different approach, starting from input and output and letting the machine understand the relationships between them and ultimately give the algorithm a result. In the case examined, if we provide the system with thousands of animals already cataloged, he will identify the criteria for classification and will alone classify them, the more data he will have available and the more accurate his classification will be. The role of the human being is only to define how the program will have to learn, to choose the examples and the information to be stored and how to apply the knowledge in order to make decisions. The same concept is applied by systems Example of possible relationships between the objects being analyzed
- 24. 23 Paolo Sciarappa that identify spam e-mails or profile our preferences to propose results that are closer to our expectations. Not within the details of the various learning mechanisms or other more complex and sophisticated techniques, this may suffice to imagine the great prospects of these new technologies on security and in particular on Physical Security. If Big Data Data Analytics techniques allow to give a synthetic form and extract useful information from the mass of data coming from different systems, Machine Learning is able to amplify this process and take a further step forward in understanding the associated phenomena to these data. Think of access control systems, this technique is able to analyze millions of transits and detect any anomalies in real time. For example, identify subjects whose behavior is abnormal and represents a deviation from the standards. A person who is in areas not frequented and not compatible with his access profile (visitor, employee or external). Abnormal transits in relation to time or the space in which they are detected, we think of the same person who is transiting at the same time in two different locations. Or an anomalous occupation of spaces, excess or poor employment. Denied transits always referred to the same person, etc. But above all something that we did not expect and we ignored its existence or criticality. There are also many applications for anti-intrusion. Statistics allows us to model the behaviors expressed by the data and the identification of non-linear Graphical representation of how machine learning handles a large amount of data.
- 25. 24 Paolo Sciarappa correlations of events coming from multiple sensors. This technique can be useful to bring to the attention of the operator sensors that behave abnormally, especially if related to data from other systems. They are an alarm bell and indicate maintenance problems or malicious actions. Even more interesting is the possibility of creating predictive models. A predictive supervision system is able to analyze the data both taking into account factors endogenous to criminal action and environmental. We can derive a model of attack correlating endogenous factors that could for example result in an intensification of access to the site in the days before theft for maintenance activities, suspicious movements near it or false perimeter alarms. Taking into account external factors, from the deterioration of the environmental context to the analysis of the time slots in which the accidents occurred, etc. The analyzed data come from different systems, from the analysis of open sources, from the information made available by law enforcement agencies and research institutes. Video surveillance plays a decisive role in the enrichment of databases and will be even more so in the future. This sector is the one that has benefited most from the technological development, in the last decade it has undergone a real digital transformation and it is the one from which we still expect a lot. The cameras have become security sensors, intelligent units that process images for us and interpret the content. This kind of approach is based on algorithms that can be supervised or learned from historical data. Using the data repository as a starting point, the algorithms generate behavioral and predictive analyzes, giving, in fact, the possibility of anticipating possible risk situations. Carmine Buono Head of BigData Area in Crisma Security
- 26. 25 Paolo Sciarappa The algorithms used for image analysis and comprehension are increasingly sophisticated and able to identify complex behavior patterns with an ever increasing level of reliability (loitering, panic disorder, tracking, overriding, crossing zones, flow direction, face recognition, etc.). The search for events in video recordings has been greatly simplified, from smart search techniques that offer targeted results on certain areas of camera framing to the latest techniques that allow you to view events in different moments in a single image, where each subject is labeled with an indication of the time in which it appeared on the scene. The big step forward was made with the introduction of metadata, a kind of text that describes what happens in the video. Some examples: suppose you have to check the correct use of an island for the collection of waste to prevent them being abandoned outside the bins. A traditional system using a dedicated algorithm could record the scene and notify us of the event. With the metadata we will have: notification of the event and its visual observation ... - Type: Vehicle - Class: Truck - Color: Green - Plate: XXX - Recurrent: YES - Number of people: 2. GPS-based video analysis sensors are also able to provide the GPS coordinates of the target and place it on a map. If we install cameras in a store, carefully positioned, we can derive a series of data that go beyond the security needs and that could be useful to other business units: with the available data it is possible to obtain the average observation time, providing information on a sort of "Rating Index" of the window display. Elaborating a supervised algorithm with the support of historical data about the phenomena of the shoplifting suffered we will be able to identify behavioral models typical of those criminal actions. In this way, thanks to the techniques already described and with the use of more complex techniques such as Deep Machine Learning we can be alerted in advance in case of suspicious behavior that could anticipate a criminal action.
- 27. 26 Paolo Sciarappa Deep Learning is a particularly advanced learning technique that uses a neural network with several interconnected layers, where the result of a processing creates a model which in turn is used to analyze the following data, greatly increasing the processing capacity. It can perform classification activities directly from the images obtaining results that previously seemed impossible, sometimes exceeding the performances obtained by man. On the Google Teachable Machine website, you can directly test how a system trains based on starting data and how the recognition system can then match specific results. Suppose we have to monitor the access of a building where we assume terrorists are present: monitoring access with traditional technologies would require many people and an important organizational economic effort. By installing a high-resolution camera that resumes the street or the square where the target building is located we will be able to analyze the scene with an overall view and at the same time in detail the entrance. In this way we will be able to know how many people have entered, the time spent, the car's license plate and the personal details of the subjects, after identifying them by comparing the photos in other repositories. Once identified, the system will automatically provide the details for each access. Further recognition aid is given by deep learning facial recognition algorithms that are now available in applications such as search engines, designed to find missing persons in movies. In the previous case, installing an audio sensor near the access, perhaps in a car parked nearby, it will be possible to identify the subject even from the voice. Google has recently filed a patent for which a program is able to associate the voices to the faces, using the use of machine vision algorithms and a typical Machine Learning approach. Siamo We are therefore beyond the first generation of facial recognition software that measured the distances between the various points of the face. The goal is to teach a computer to perform a natural activity for humans: identifying and recognizing the content of an image. Returning to the example made to demonstrate the usefulness of data correlation, a camera resumes the entrance of a building equipped with turnstiles, the access control system allows you to associate a name to each
- 28. 27 Paolo Sciarappa face framed by the camera and can do dozens of times a day for months. With this volume of data the Deep Learning can learn very quickly and with a minimum gap. To this are added modern zoom-enanched techniques, researchers of Google Brain, the division of Mountain View that works on algorithms of intelligence, has developed a system able to increase the resolution of extremely grainy images, to reconstruct their shape and structure. The scenes of CSI films where magically the grainy images are reconstructed with a simple click and that today make the professionals smile, a tomorrow not too far could be a reality whose implications, in the forensic analysis, would be of enormous importance. Today's cameras are real intelligent units capable of carrying out increasingly complex tasks, so the algorithms can be moved to the camera, limiting bandwidth consumption and computing power centrally managed, thus reducing costs. A start-up specialized in automated solutions for the external inspection of vehicles has implemented a physical security system that analyzes the bottom of vehicles to detect threats such as bombs or weapons, completely replacing human intervention. Digital scanner to inspect the undercarriage.
- 29. 28 Paolo Sciarappa In the rooms of the private security firms there are hundreds of cameras to monitor the counting operations, another application for Deep Learning could be to identify the correct behavior model and report any deviations thus avoiding the revision of hours and hours of recording. Digital Transformation has also introduced new products at the service of safety, imported from other markets and born for different purposes. For example, the MEMS chip used in many smartphones as an accelerometer makes it possible to translate the accelerations caused when climbing over an enclosure in an alarm. A new type outdoor sensor uses advanced radar technology and intelligent algorithms to detect intruders, also offering the angle of motion, size and speed of objects. Furthermore, by providing the exact location, it allows you to filter by distance and is immune to events that often cause false alarms, such as moving shadows or light beams, small animals or insects. The detector can send the exact coordinates of the people or objects detected directly to the PTZ cameras, which can automatically enlarge the target without manual intervention. Network Radar Detector, target trajectory and detailed image, by Axis Communications. A separate chapter should be dedicated to the potential of smartphones, both as objects to be used to supervise security events, we are intelligent "sensors" able to collect data. A brief mention to explain the importance of these devices in the production of Big Data. They are equipped with many sensors able to
- 30. 29 Paolo Sciarappa collect data from the environment, produce their own, correlate them and send them independently, are part of the information security and with their data contribute to the creation of Big Data. For example, they are used to geolocate employees in critical contexts, as a tool for accesses and for assessing the degree of occupancy of the company areas, when associated with dedicated devices. They are a valuable resource in the analysis of open sources, contribute to the formation of news thanks to information sent online by users. 3.1. Physical Security as a service (PSaaS) The Cloud could not be missing, another element of novelty for Physical Security. It is a business model that provides for the outsourcing of one or more services where security is provided as a service delivered in the Cloud, without the need for expensive hardware, reduces the Total Cost of Ownership. Before entering into the merits it is necessary to clarify the perimeter of the outsourced activity. The first level includes the processing power and space for the various repositories, as well as the security application, the core business of those providing this type of services. The second level also includes the supply of field hardware installed at the customer. The third is the case of the total outsourcing of the service, leaving the customer only the operational management without alarm monitoring functions. Savings, scalability, resilience and innovation are the first concepts that come to mind when talking about Cloud, to this is added the great advantage of avoiding large disbursements in capital account. There are no insurmountable technical limits and probably bringing Cloud security could also be advantageous, but there are some factors we need to take into account. In medium and large companies the technological infrastructure is already present and is shared with the other business units, the virtual servers are scalable and allow the addition of new systems, modulating the resources as needed. In this sense there would be no significant savings as it does not need to create an ad hoc structure, but the existing one already interconnected with all the business units would be exploited. We are far from the "silos" logic and it is therefore necessary to
- 31. 30 Paolo Sciarappa interconnect the systems to facilitate the sharing of information, which of course is easier if the system is located within the company. Secondly, the "open system" logic that underpins the PSIM 4.0 systems that would lead to single-supplier solutions would be lost. Finally, one could not do without the field hardware related to the various security subsystems. However, there are cases that are an exception, where great scalability and speed of execution are required, in a context that does not require particular interactions with other systems. The financing of operating expenses in place of capital expenditure may be useful in other contexts, for example if all the infrastructure is allocated within the company. In this case there would be a double benefit, not having to deal with large initial investments and not having the problem of technological updating due to the fact that the supply and installation of the security systems would be remunerated at the fee and renewed at the end of the contract. 3.2. Cyber Physical Security Cyber Security attacks are increasingly complex and sophisticated. The theme must be tackled on two levels. The first is that information theft can take place not only online, but directly accessing IT resources. The second refers to the fact that the vectors used for the attacks also concern the physical devices beyond the technological ones. The IOT and the development of physical security systems towards IT has introduced new vulnerabilities, while we assume that a PC or a server must have an antivirus and that we must implement a series of security measures both at the application level and on the Operating System, we do not do the same for physical security systems. Cameras, sensors, badge readers, etc. they are potential points of access for every hacker, both to access corporate networks and to be used as a point of attack to other structures, or to take control of the security subsystems to guarantee free access to data held by companies. It is therefore necessary a
- 32. 31 Paolo Sciarappa specific preparation able to evaluate these threats and support a business intelligence activity able to collect and analyze information through all communication channels, including dark web.
- 33. 32 Paolo Sciarappa Conclusion La Digital transformation does not end with the introduction of new technologies, it requires a complete revision in the way of managing information. For Physical Security it is a period of profound changes and the 4.0 enterprise is an opportunity to create greater value. Not only a support to ensure companies achieve their goals, reducing, addressing and overcoming risks, but also ensuring greater resilience to business activities and contributing to an enabling security in the digital transformation process. The new Physical Security project facilitates core activities and contributes to enriching information assets which in turn create value, both in terms of income and greater compliance. A more functional, smarter security that is more capable of adapting to changing human needs than limiting exercise. A physical security not only focused on technological innovation, but more attentive to the human factor. Many of the targeted attacks on companies are made using phishing or social engineering techniques, so we must also invest in information and training. Without physical security, any other protective measure may be ineffective, the weakest layer of protection is the one that determines the level of security. It is therefore necessary to tackle emerging threats with a multidisciplinary approach where information is at the same time our main asset to be protected and our best ally.
- 34. 33 Paolo Sciarappa Bibliografia: Wil Allsopp, Unauthorised Access: Physical Penetration Testing for IT Security Teams. Published by Wiley & Sons 2009, ISBN: 9789470747612. Abdulmalik Humayed, Jingqiang Lin, Fengjun Li, Bo Luo: Cyber-Physical Systems Security. IEEE Internet of Things Journal, 0.1109/JIOT.2017.2703172. Guy Harrison, Next Generation Databases: NoSQLand Big Data. Apress 2015 Lawrence Fennelly, Effective Physical Security, Butterworth-Heinemann 2016 Robert M. Clark, Simon Hakim. Cyber-Physical Security: Protecting Critical Infrastructure, 2017 Springer. ISBN 978-3-319-32824-9 Kevin D. Mitnick e William L. Simon, L’arte dell’inganno. Feltrinelli 2013 Clarence Chio e David Freeman, Machine Learning and Security: Protecting Systems with Data and Algorithms. O’Reilly 2018 MISBN-13: 978-1491979907. Bruce Schneier, Secret & Lies - Digital Security in a Network World. 2000 SBN13: 9780471453802 Sitografia: 2018 Data Breach Investigation Report https://www.verizonenterprise.com/verizon-insights-lab/dbir/ Investigare su immagini e video https://www.safetysecuritymagazine.com/articoli/investigare-immagini- video/ Riconoscimento facciale con la computer vision https://it.mathworks.com/discovery/riconoscimento-facciale.html Cosa sono i Metadata https://www.securindex.com/downloads/2d9964f182edaa529967ea2be2a2ffc 4.pdf
- 35. 34 Paolo Sciarappa UNIFICATION: Bringing Security and Operations Together With PSIM https://www.sdmmag.com/articles/91566-unification-bringing-security-and- operations-together-with-psim Big Data e Machine Learning: trovare risposte nei dati https://www.secsolution.com/articolo.asp?id=536 Physical Security and Why It Is Important https://www.sans.org/reading-room/whitepapers/physical/physical-security- important-37120 Why Integrate Physical and Logical Security? https://www.cisco.com/c/dam/en_us/solutions/industries/docs/gov/pl- security.pdf