Can a proper convergence strategy mitigate IT security risk? It is something all business stakeholders need to consider.

In today’s world, where a single security breach could spell catastrophe, how prepared are organizations to combat the intertwined threats looming over their digital and physical landscapes?

As technological advancements evolve, the spectrum of security threats extends beyond the digital sphere, encroaching on physical infrastructures and core organizational operations. Info-Tech Research Group emphasizes the necessity of a unified security architecture, merging physical security, cybersecurity, and other administrative realms like HR, legal, and compliance. Its most recent research and analysis, its “Integrate Physical Security and Information Security” blueprint, offers a structured three-phase approach to reduce IT security risk: Plan, Enhance, Monitor, and optimize to navigate this convergence. Though intricate due to proprietary and diverse technological landscapes, this integration heralds a robust defense against modern threats, embodying a modular, incremental, and repeatable process.

What initial steps should firms undertake to ensure a seamless transition towards this integrated security model? The path towards converging these diverse security networks presents challenges; how should firms adeptly navigate these to bolster their security posture?

Carlos Rivera, a Principal Research Advisor of Security and Privacy Practice at Info-Tech Research Group, provides insights into Info-Tech’s published research, expanding on the nuances of harmonizing digital and physical security infrastructures for an enhanced organizational defense mechanism.

Carlos’ Thoughts

“Our methodology basically goes into three primary steps, and it’s, you know, basically you plan, you make an assessment based on the output. You know, you should focus really on the outcomes more than a lot of people that focus on capabilities, but outcomes really are what you want to focus on. But after you plan and you do the assessment, it’s enhancing what you currently have, right? So, that is a kind of standard methodology. I know this sounds kind of boilerplate, but really, it’s taking a good look at what you have based on, you know, our methodology or a good control set, right? Using different models like Purdue, et cetera, to really gauge where you’re at and where you want to be at the end of the journey, right? So, you know, security is a never-ending journey, but this is a really good way to make an assessment and figure out what areas to focus on.”

How can firms ensure the highest levels of success and safety while converging their technology platforms?

“It’s all driven by risk, right? And definitely, in OT settings, you know, one variable that most organizations don’t have to worry about is safety, safety concerns. Another risk that I would say is with OT or IoT, as it were, things that could, you know, impact somebody’s life. They can have like medical devices, et cetera. This is really the value of the convergence, right? If you have a mindset of, I’m going to publish policies; I have a governance framework for my organization that really is extended to your OT infrastructure, right? And you’re holistically looking at a program from an organizational top-down perspective.

That’s really the value of convergence. It’s not really flattening, as some would think, the infrastructure and creating risk. It’s minimizing risk by building on the synergies that you probably already envision with your IT security program.”

What key challenges do you see from firms trying to do this, and how can they navigate them?

“One of the most common ones, to be honest with you, it’s probably a no-brainer, but it’s really just bringing all the key stakeholders to the table to have a conversation, right, about what the objectives are. That’s before you do any kind of technical evaluation. Come up with a charter about what the convergence is about. We have pretty good documentation methodology on getting you started and having the right conversation. We also have a list of stakeholders that we recommend having as part of that conversation, but then have a methodical phased approach on what you feel are the biggest risks and how you feel like you’re going to solve those risks.

Our methodology encourages you to use business language. That’s the best way to talk to stakeholders. You’re not going to drive this change from the bottom up. You’re going to drive it from the top down. And we recommend using something like COBIT and align your strategic goals for that convergence with business language like COBIT to make it really easy to understand what your mission is.”

Article by James Kent