Security convergence

In the context of the Internet of Things, cyber threats more readily translate into physical consequences, and physical security breaches can also extend an organisation's cyber threat surface. According to the United States Cybersecurity and Infrastructure Security Agency, "The adoption and integration of Internet of Things (IoT) and Industrial Internet of Things (IIoT) devices has led to an increasingly interconnected mesh of cyber-physical systems (CPS), which expands the attack surface and blurs the once clear functions of cybersecurity and physical security."[6]

According to the WEF Global Risks Report 2020, "Operational technologies are at increased risk because cyberattacks could cause more traditional, kinetic impacts as technology is being extended into the physical world, creating a cyber-physical system".[7] According to the United States Department of Homeland Security, "The consequences of unintentional faults or malicious attacks [on cyber-physical systems] could have severe impact on human lives and the environment."[8]

Notable examples of attacks on internet connected facilities include the 2010 Stuxnet attack on Iran's Natanz nuclear facilities and the December 2015 Ukraine power grid cyberattack.

“Today’s threats are a result of hybrid and blended attacks utilizing Information Technology (IT), physical infrastructure, and Operational Technology (OT) as the enemy avenue of approach," notes former CISA Assistant Director for Infrastructure Security Brian Harrell. "Highlighting this future threat landscape will ensure better situational awareness and a more rapid response.”[9]

Traditionally distinct, or 'siloed', approaches to physical security and cyber security are viewed by proponents of security convergence as unable to adequately protect an organisation from attacks involving both cyber and physical (cyber-physical) dimensions. The organisational aspect of security convergence focuses on the extent to which an organisation's internal structure is capable of adequately addressing converged security risks.

According to the Cybersecurity and Infrastructure Security Agency, "physical security and cybersecurity divisions are often still treated as separate entities. When security leaders operate in these siloes, they lack a holistic view of security threats targeting their enterprise. As a result, attacks are more likely to occur".[1] "Many of the conventional physical and information security risks are viewed in isolation," states a PricewaterhouseCoopers document Convergence of Security Risks. "These risks may converge or overlap at specific points during the risk lifecycle, and as such, could become a blind spot to the organisation or individuals responsible for risk management."[10]

In a survey of more than 1,000 senior physical security, cybersecurity, disaster management, and business continuity professionals, the ASIS Foundation study The State of Security Convergence in the United States, Europe, and India found that despite “years of predictions about the inevitability of security convergence, just 24 percent of respondents have converged their physical and cybersecurity functions.”[2] The survey also found that 96 percent of organisations that had converged two or more security functions reported positive results from convergence, with 72 percent reporting that convergence strengthened their overall security. Overall, 78 percent of those surveyed believed that convergence would strengthen their overall security function.

Citing the work of Jay Wright Forrester on systems thinking, Optic Security Group CEO Jason Cherrington argues that a system of systems approach provides a useful lens to understanding how security sub-groups within an organisation contribute to an organisation's overall security goals. "In an ideal SoS world, organisations would see their security as a collection of task-oriented or dedicated systems that pool their resources and capabilities together as part of an overall system offering more functionality and performance than the sum of its parts. Importantly, oversight of the overall system would ensure that any gaps between its component systems are identified and failures avoided."[11]

The increasing prevalence of hybridised cyber-physical security threats has driven the parallel emergence of a range of converged security solutions that cover both cyber and physical domains. According to Jason Cherrington, "in contemporary security threats we’re seeing a convergence of physical and digital vectors; and that protection against these hybridised threats requires a hybridised approach."[11] According to the United States Cybersecurity and Infrastructure Security Agency: "Organizations with converged cybersecurity and physical security functions are more resilient and better prepared to identify, prevent, mitigate, and respond to threats. Convergence also encourages information sharing and developing unified security policies across security divisions."[6]