Of all the types of threats physical security teams face, insider threats are among the most serious and potentially expensive.

IBM’s Cost of a Data Breach Report 2023 found that data breaches initiated by malicious insiders caused more financial harm than breaches with any other initial attack vector. The 2023 Insider Threat Report (from Cybersecurity Insiders and Gurucul) found that “74% of organizations say they are at least moderately vulnerable or worse to insider threats.”

In the face of this danger, physical security teams rely heavily on various connected devices to keep their organizations safe. However, because these devices typically aren’t monitored and maintained consistently, excessive downtime and other performance issues can prevent them from providing the uninterrupted defense organizations need. In addition to hurting these devices’ availability, a lack of proper device management makes them vulnerable to cybercrime. 

To protect your organization from insider threats, it’s critical to monitor and manage your physical security devices in ways that minimize downtime. Hardening and maintaining those devices properly is also important to ensure that they don’t simultaneously create new and lucrative attack surfaces for cybercriminals to target. This post will explain why both of these goals are crucial and how you can achieve them.

How do insider threats take shape, and why are they so serious?

Insider threats can present a wide variety of nightmare scenarios for organizations, both in terms of physical security and cybersecurity. To mitigate this risk effectively, it’s important to consider both its breadth and the reasons for its seriousness.

Some insider risks facing organizations come from malicious employees, vendors, and service providers—individuals who may be motivated by financial, ideological, and/or personal factors. But insider threats also include the danger that a well-meaning insider inadvertently enables an external attacker to target their organization successfully.

Both types of danger are particularly serious because of the access insiders have. They often have access to sensitive locations, equipment, information, and inside knowledge of their organization’s operations. And because an insider’s colleagues are presumably more inclined to trust them than a stranger, they (or the criminals taking advantage of them) can operate with a significant home-field advantage.

Employee education and training are crucial to minimizing the risk posed by unwitting insiders. But protecting an organization from malicious insiders requires other preventive measures.

Why are the stakes of physical security device management so high?

Like external threats, insider risks can be significantly reduced using a wide range of connected physical security devices, including surveillance cameras, access control systems, alarm systems, and more. A robust fleet of these devices can help detect and record crimes and have a powerful deterrent effect.

But even with the best physical security system, it’s important to consider the risk of downtime and other technical issues that can prevent a device from transmitting or recording. Problems can occur either within these devices or in other parts of their ecosystem, such as a network switch or video management system (VMS). The risk increases dramatically if your devices aren’t properly maintained.

Without automatically tracking the status of their connected physical security devices around the clock, organizations risk any downtime continuing for an extended period before even being discovered. And even once downtime is discovered, diagnosing (if necessary) and resolving the underlying issue takes additional time.

No less alarmingly, connected physical security devices that aren’t managed correctly can be vulnerable to hackers. To ensure that your physical security devices protect you from on-site crimes without adding to the cyber risks you face, it’s critically important to ensure that they run consistently and securely.

How can you ensure your physical security devices actually protect you from insider threats and other risks?

To ensure you can count on your physical security devices to protect your organization from insider threats, maximizing their uptime is crucial. To do so, monitoring these devices around the clock is essential, helping you rapidly detect downtime and other technical issues. You also need to have fast and efficient ways to resolve any technical problems that arise and maintain your devices properly to minimize the frequency of downtime and other technical issues.

Meanwhile, to ensure that your physical security devices don’t leave you vulnerable to cybercriminals, they must be hardened and maintained in line with best practices. This entails rotating passwords, upgrading firmware, managing certificates as needed, and replacing outdated devices that have passed their end of life or service. It also involves tracking your devices and the processes they run, to check for anomalies that could indicate that a device has been compromised by cybercriminals or offer them an easy target.

Why don’t more organizations take all of these necessary steps to protect themselves from insider threats and other risks? Given the scale and variety of organizations’ fleets of connected physical security devices, many simply find that the massive amount of work involved in hardening, monitoring, and maintaining all of those devices is too time-consuming and expensive to be feasible. 

So, how well does your organization protect itself against insider threats (and other dangers) by managing its connected physical security devices? And if there are gaps, how can you address them effectively? 

To illuminate questions like these, we at SecuriThings have created a five-stage maturity model that breaks down the journey organizations take as they progress towards an enterprise-ready approach to physical security. Take our two-minute self-assessment to find out where your organization stands and what your next steps should be.