The Convergence of Cyber and Physical Security in the Built Environment

There was a time when physical security and cybersecurity could largely be treated as separate disciplines. Physical security protected people, places, and assets. Cybersecurity protected networks, applications, and information.

That separation is much harder to make today, especially in the context of exponential growth in the number of networked physical security devices over the past two decades.

Cameras, physical access controllers, integrated sensors, and other physical security technologies have become network-connected devices. A camera is no longer simply an analog security device mounted on a wall. It runs firmware, which serves as its embedded operating system. It also has an IP address, connects to a network, acts as a web server, it authenticates users/applications and it communicates with servers. It has become another technology endpoint.

That connectivity creates tremendous capabilities, but it also means physical security systems can be exposed to many of the same vulnerabilities as other networked technology.

When a Cyber Risk Becomes a Physical Risk

The relationship between cyber and physical security works in both directions.

Consider an access control application server. If an attacker compromises an administrative account, they could potentially gain the ability to control doors, disable alarms, or modify access permissions. A cyber incident has suddenly become a physical security problem.

The reverse can also happen. If someone gains unauthorized physical access to a telecommunications room, they may be able to connect an unauthorized device to the network. If that access goes undetected, the physical security breach could provide an entry point for a larger cyber incident.

The potential impact becomes greater when security devices share networks with other technologies. A compromised security device on a flat network could potentially provide access beyond the security system itself.

Security convergence risks associated with Industrial Control Systems (ICS) are especially high because such devices live at the intersection between the physical and cyber infrastructures. Think of a water district: they have Supervisory Control and Data Acquisition (SCADA) systems to monitor and control water pressure; chemical feed and dosing control systems to automate the injection of chemicals to disinfect the water supply, and distributed control systems to manage desalinization or wastewater reclamation. Physical security devices are considered to be sensitive security operational technology (SOT) devices, which must be hardened from the cyber security perspective.

This is why the conversation can no longer stop at whether a security system performs its intended physical function. Project teams also need to understand where that technology sits within the larger digital environment and what happens if it is compromised.

Security Design Is More Than Device Placement

The growing connection between cyber and physical security is also changing what needs to be considered during design.

Most security practitioners understand that putting an access control device on a plan, for example, is only part of the equation. An emergency egress door may need to satisfy life safety and accessibility requirements while also accounting for locking hardware, request-to-exit devices, emergency release, fire alarm integration, and the access control logic behind it. Even at the door level, legacy unencrypted reader wiring and easily cloned proximity cards must give way to encrypted OSDP communications and cryptographic credentials. Similarly, a camera may be appropriate or even required for security purposes, but its placement and configuration can create both privacy and compliance concerns depending on the environment. In healthcare, for example, project teams need to understand where there is an expectation of privacy and how applicable policies, standards, and regulations affect the design.

These decisions require more than a security consultant working independently. Security, IT, facilities, operations, and other stakeholders need to understand how the system will integrate into the building and the organization’s broader technology environment.

Cybersecurity Starts With Technology Selection and System Architecture

Network segmentation is a key risk mitigation consideration because it can limit the blast radius of a cyberattack. If a security device runs vulnerable firmware and sits in a flat, unsegmented network, an attacker who compromises the device gains a foothold into the entire infrastructure and they can move laterally across the network.

Firmware is a critical factor for the cybersecurity posture of a Security Operational Technology (SOT) device. Because it acts as the device’s operating system, if there are vulnerabilities associated with its firmware, they can be exploited by an attacker. Therefore, we should always recommend/specify products from manufacturers who have a track record for actively reporting and mitigating vulnerabilities. Typically, a security integrator will not upgrade a device firmware unless it’s a contractual obligation to do so.

The use of TLS Certificates is fundamental for securing modern physical security infrastructure. Leaving SOTs unconfigured or relying on default or self-signed certificates introduces massive network and data liabilities because communications with the rest of the ecosystem cannot be trusted. Digital certificates secure the security ecosystem through several mechanisms:

• Enforcing Network Access Control (Zero Trust Onboarding). Unmanaged network ports are an invitation to intruders. Without enforcement, an attacker could simply take the network cable from a camera and plug it into their laptop and gain direct access to the corporate network
• Preventing Device Spoofing and Lateral Movement. Without certificates, an attacker can spoof a camera’s MAC address so that a malicious laptop can impersonate an SOT device. Once inside, an attacker can move laterally to breach other systems
• Requiring Cybersecurity Hardening During Commissioning. Integrators may not deploy digital certificates or update firmware unless contractually required. Explicitly documenting these requirements in Division 28 specifications and verifying implementation during commissioning helps ensure security controls are in place before system handover.

Most large organizations have username/password credential policies such as password strength and credential rotation frequency. Since they are web servers, SOTs authenticate users using credentials; however, policies for SOT credentials are typically not enforced by the customer’s IT department because in many cases, they don’t have visibility over them.

Solutions At Scale

Let’s take a moment to consider the complexity of SOT ecosystems at large organizations to understand how difficult it is to manage SOT cybersecurity: multiple floors, multiple facilities in multiple cities, and in multiple countries. Some sites have outdated network infrastructure where not every device is routable, which requires rolling a security integrator truck for a simple task such as upgrading camera firmware, and that’s assuming the manufacturer is still maintaining the firmware. Even when devices are routable, firmware upgrades and password rotations are typically one at a time for each device, and with customer SOT footprints well into the thousands of devices, this can become a full time job for a few security analysts.

Over the past few years, a few solutions have been developed to mitigate this issue at scale. Some of our customers have already implemented security cyber hygiene solutions such as Viakoo and SecuriThings to automatically upgrade device firmware, rotate passwords, and obtain TLS certificates. Those who pair their implementation with a more nuanced device selection process to improve lifecycles, as well as architecting properly segmented networks, have been more successful in mitigating SOT cyber risks. Unfortunately, some security integrators don’t suggest or recommend these solutions to end users due to fear of losing service business when automation replaces lucrative truck rolls and manual labor.

Handover Isn’t the Finish Line

Some of the biggest vulnerabilities can emerge after installation.

At the end of a project, an integrator typically hands the system over to the owner or security team. At that point, it can be tempting to assume that because the system is working, the job is finished.

But who has the credentials used during installation? Is the firmware current? Were unused accounts, services, and protocols disabled? Were the manufacturer’s hardening recommendations followed?

These are relatively straightforward questions, but they can easily fall through the cracks when responsibilities aren’t clearly defined.

Changing credentials at handover is a simple but important step. Teams should also validate firmware, disable unnecessary accounts and services, use secure communication protocols and encryption where appropriate, and confirm that devices meet both manufacturer hardening recommendations and the organization’s internal cybersecurity policies.

Network design matters as well. Physical security devices can be segmented from other network traffic, unnecessary switch ports can be disabled, and devices can be limited to communicating only with the systems they actually need. A camera that has no reason to communicate directly with the internet, for example, should not necessarily have that ability.

Who Owns the System?

One of the most easily overlooked issues has little to do with technology: ownership.

Physical security systems now sit somewhere between the traditional responsibilities of security and IT. The security team may own the system operationally but depend on IT to manage servers, operating systems, network connectivity, patches, or cybersecurity policies. IT, meanwhile, may assume those responsibilities belong to security or the integrator.

When everyone assumes someone else is handling an issue, no one may actually be handling it.

Roles should therefore be established early. Who administers the system? What network will it reside on? Who patches it? Who responds if it fails? What happens during a cyber incident? Who is responsible for maintaining devices after the project is complete?

Those conversations should happen during design, not after construction.

Think Beyond the Project

Perhaps the biggest shift is recognizing that physical security technology should be treated more like IT infrastructure throughout its lifecycle.

Installing the system is only the beginning. Cameras, access control devices, servers, and other components require ongoing maintenance, patching, updates, and eventually replacement. A device can still physically work while becoming a cybersecurity liability because its software is no longer supported.

That also makes lifecycle planning a financial consideration. Owners should understand not only what it costs to install a security system today, but what will be required to maintain and eventually replace it five, ten, or more years into the future.

As physical security technology becomes more connected, the distinction between cyber and physical security will continue to narrow. That does not mean security teams need to become cybersecurity teams, or vice versa. It means the two need to communicate.

Bringing the right stakeholders together early, clearly defining ownership, selecting technology with its full lifecycle in mind, and treating SOT devices as part of the IT environment can help organizations manage that convergence. Because today, protecting the building and protecting the network are increasingly part of the same conversation.

TEECOM Can Help

TEECOM supports the design of integrated security systems that enhance safety, awareness, and operational control. We coordinate with project teams to align security technologies with architectural, operational, and user requirements. Our early engagement helps ensure systems are effective, scalable, and seamlessly integrated into the built environment. Contact us to learn more about how TEECOM can assist with security systems in your next project.

About the Author

Esteban Zohn is a Principal, Senior Consultant at TEECOM with more than 20 years of experience in physical security strategy, technology integration, and global security program management. He has managed multimillion-dollar security portfolios, advised Fortune 500 leadership, and led international teams in deploying advanced security systems. Esteban specializes in bridging physical security and cybersecurity to help organizations manage risk and build resilient, integrated security programs.