All-Encompassing Platforms are the Best Security Strategy for Companies Converging Their Ecosystems

Cybersecurity has been a buzzword for some time now that cybersecurity measures are a priority for many companies. But organizations often forget the symbiotic relationship between digital and physical security controls in this digital age. These two aspects are often treated as isolated silos when, in fact, a holistic approach is needed for robust protection. An integrated system, where one login revokes or grants both physical and digital access, can enhance efficiency and reaction times. 

For instance, revoking or providing access to privileges to employees can be done in a single point, as opposed to utilizing different platforms. However, the convenience comes with a catch: putting all your eggs in one basket will attract hackers. The answer is creating balance and weighing the benefits against the risks. Finding the right solution requires the creation of a culture that permeates from the top down, affecting everyone in a company.

Having a deeper understanding of the intricate relationship between different types of cybersecurity measures and security controls is Scott Boss. He brings years of expertise on the subject. Boss is currently an Associate Professor of Accounting at Bentley University. He has his Ph.D. in Information Systems, which he obtained from the University of Pittsburgh. Some of his focuses include information technology, cybercrime, and computer security. He’s been published in various journals and is also a member of the American Accounting Association among many other groups.

He shared his thoughts on company best practices when it comes to keeping their information safe and private, and how a top to bottom all-encompassing feature provides structure and safer security. 

Boss’ Thoughts on Cybersecurity Measures

The Importance of Equitable Controls

“People don’t really mind controls as long as they know they’re being acquired equitably. You don’t get to bypass the controls just because of your position within the organization. Well, everybody minds controls because controls take up time, but people don’t mind controls as long as they know they’re being acquired equitably.

You don’t get to bypass the controls just because of your position within the organization. So this is the big problem. You ask a professor what he thinks and he’ll say most of the time, well, it The depends part is it depends on what the strategy of the folks are.

When you put everything together, it allows for it to be easily controlled. One of the things you want to be able to do with security, both physical and digital securities, you want to be able to be able to react quickly. For example, we have a person that we’re terminating with the company, either voluntarily or involuntarily.”

Speed and Efficiency in Revoking Access

“What we want to be able to do is bring them into HR and while they’re having their exit interview, all of their access is revoked. Being able to do that in one spot is much easier than being able to do it in 27 different spots on 27 different platforms, being either physical security, your payroll process, all the different links that you have within the organization. So it’d be nice to be able to do it.

One of the clients I had before my previous clients, I actually worked on, I mean, a single login where, I mean, you could go out and you could suspend people’s logins all at once. Being able to suspend their physical access has been very nice to be able to do that all at once, because sometimes we take away their physical access, we don’t take away their digital access, or we take away their digital access, we don’t have to take away their physical access. So, that’s the really good thing.”

The Double-Edged Sword of Centralization

“The really bad thing about it is now it’s all in one spot. And if I hack that, I’ve got everything. It’s a balance. You have to balance the risk versus the reward of it. And then how much are we monitoring it? How are we protecting it? Those types of things.”

Universal Application of Security Policies

“…Security has to apply to everybody. It has to apply to not just me as I’m coming into doing my day-to-day work, but it has to apply to the president of the company. There’s different levels of control you could have over people.

You can punish them and say, all right, if you don’t do this, I’m going to punish you. That’s a deterrence type of approach. But it works better if everybody is on the same page saying, hey, this is how we do things.

When people are coming into the building, do you let the piggyback throw? Or do you let, does everybody have to scan their card to go through? By piggybacking, you mean, I open the door and then I let you in.

If you’re going to do this, what you need to do is you need to make sure that everybody, people don’t really mind controls. Well, everybody minds controls because controls take up time, but people don’t mind controls as long as they know they’re being acquired equitably. You don’t get to bypass the controls just because of your position within the organization.

So you make sure that it applies to everyone and that everybody’s aware and that it’s a top-down approach…”

The Importance of Security Culture

“It’s a security culture as opposed to a top-down directive is that this is the way we do business. And what we’re doing is we’re really trying to make things better for the business and for all of you, because if it’s better for the business, you get paid more, we don’t have to worry about losses to cybersecurity incidents. Those types of things. Well, one of the big problems, whenever you are putting things together is the cracks in the connection. My physical security is no longer dependent just upon the physical security standalone box that I have. Now it’s dependent upon how secure my, my internet exposed assets are as well, because they all link through together. Having firewalls, they’re paying attention to updates, paying attention to bugs that we didn’t, I mean, nobody foresees bugs, but be, but updating quickly and paying attention that you can’t just let it sit and forget.”

The Need for Active Security Management

“Security management, both on physical and virtual have to be actively managed. That’s anybody who’s doing this knows that, but then there’s only so much time in the day.”

The High Costs of Inadequate Security

“But the real thing is that non-security management need to realize that this is really important because it gets very, very costly, especially when things start to get integrated because you don’t just lose. We have one room that’s insecure. Now our old building’s insecure and our old building, plus our server is insecure, that type of stuff.”