Security Sales & Integration

September2013

SSI serves security installing contractors providing systems and services; surveillance, access control, biometrics, fire alarm and home control/automation. Coverage in commercial and residential product applications, designs, techniques, operations.

Issue link: https://securitysales.epubxp.com/i/166764

Contents of this Issue

Navigation

Page 89 of 175

SECURING FEDERAL GOVERNMENT BUSINESS to infuence a decision that might require executive support, time for additional product testing, funding for software development and fees for third-party validation. Integrators need to frst educate themselves, and then understand how this will afect their go-to-market solution set. Tere are numerous companies claiming FIPS 201 compliancy. Being able to separate fact from fction is not simple when pulling together the products to deliver a compliant system. Even if settled on the end-to-end solution, being able to educate sales representatives, engineering personnel, feld workforce and, fnally, the customer is challenging. "My boss told me to get our systems to be HSPD-12 and FIPS 201 compliant. What exactly does that mean?" Whether you have heard that exact quote or one similar, your ability to respond to your customer is going to depend on the homework you've done and signifcant preparation. Referring back to customers that have multiple hats to wear, they are looking to the industry professional for clear and accurate guidance. Taking control of your future means having a feld organization that is knowledgeable and prepared to answer this question. Another topic of interest in the industry centers around the General Services Administration's (GSA) guidance regarding the Approved Product List (APL) and the list of HSPD-12 pro- viders identifed to support the installation and maintenance of the relevant FIPS 201 components/systems. GSA plays a major role in the management of buildings for the federal government and its related infrastructure, such as physical access control systems. Since this journey to become HSPD-12 compliant began some nine years ago, there have been considerable monetary eforts expended by all involved to meet this requirement. Tese include industry meetings, government policy clarifcations and updates, technology enhancements, and untold hours of dialogue and debate in company conference rooms. GSA is going through a change to revamp its classifcation categories for the approved products it has listed to be used on an HSPD-12 system. Having a list of compliant products, cross-listed with other products for integration and service providers to support will help minimize the confusion. However, it will not eliminate all the problems, as success will still be dependent on pulling everything together correctly. Te testing of the fnal product to ensure it meets the requirements is also critical. Tis is no diferent than being granted an Authority to Operate (ATO) for a Department of Defense (DoD) system. Perhaps this scenario can best be conveyed analogously: Just because a cake requires egg, four, water, oil, vanilla, sugar, a pan and an oven, doesn't HOW TO HELP GOVERNMENT CLIENTS MANAGE IDENTITIES M uch of physical security operation revolves around the basic concept of making sure no individual in a facility or on a campus is ever where they are not supposed to be. For many organizations, this is mission-critical with little to no margin for error. For example, in government facilities controlling physical access is largely a homeland security issue, while for private access businesses it can be the difference between fnancial success and failure. In either case, the core objective is to protect people, property and assets — none of which can be accomplished without stringent identity management processes in place. With concerns of vandalism or workplace violence, intellectual property theft, liability and other security issues rising in frequency, the need to control and manage identities is the frst line of defense for any organization. To address the matter, the focus on physical access control systems (PACS) has shifted beyond basics such as card readers or turnstiles to IT-based physical identity and access management (PIAM). These systems deliver far more advanced functionality that encompasses ongoing knowledge and authentication of every identity who may be present in a facility or on a campus, based on their current access privileges in real-time. This can be a vast undertaking, particularly in organizations with multiple locations, hundreds of employees, or a heavy concentration of vendors, contractors, and personnel with very specifc, limited and variable access privileges. What makes this immense organization, verifcation and ongoing updating possible is the 86 / SECURITYSALES.COM / SEPTEMBER 2013 By Ajay Jain convergence of physical security and the IT world, and the ability to automate PIAM systems via software. Automating PIAM systems makes it possible for an organization to set rules, controls and policies that are maintained and updated instantly, and to onboard every identity and maintain correct authorization and provisioning for every identity in real-time. The software that can accomplish this monumental task utilizes PACS virtualization — whereby the software fnds and connects devices and controllers with identity databases/networks, and virtualizes all required functions like switching and routing as PACS. Every device and system, and every identity database and watch list — no matter the vendor, brand, source or protocol used — becomes another set of data points for the overall PIAM solution to incorporate. What is important is that now all these formerly disparate products and systems can be polled, programmed and controlled via a single platform. It's the most effcient means of integrating an enterprise-level PIAM solution across any size organization despite the location and number of facilities it entails. Ultimately, this total control of PIAM enables the user to create a virtual frewall around and within the organization — making it possible to address the most basic (and most important) of all security concerns: ensuring that no individual is ever where they are not supposed to be. Ajay Jain is President and CEO of Quantum Secure (quantumsecure.com).

Articles in this issue

Links on this page

Archives of this issue

view archives of Security Sales & Integration - September2013