ISONAS' Crystal Matrix at a glance.

Easily Support Seasonal Schedules with ISONAS Access Control System

source: ISONAS

Are some of your clients affected by seasonal changes to their facility's schedules?

Seasonal variations are common for organizations such as:

• Schools and Libraries
• Park Districts
• Amusement Parks
• Sports Facilities
• Churches
• Recreation or Tourism Business

Many of these organizations will wnat to pre-plan and pre-program the upcoming schedules into their access control system, so that the schedule's transition times are seamless and worry-free. The Crystal Matrix application supports these types of requirements with the Permission Groups feature.

Crystal matrix Permission Groups for Schools

A high school might use the Permissions Group feature of Crystal matrix to schedule the full summer activity sessions before the end of the school year. Prepare the system for band camp, 2-a-days football practice, teacher development workshops, and adult education seminars. All pre-planed and pre-programmed before the school's staff begins its summer break. As the summer calendar progresses, the access control system automatically adjusts the system's business rules to allow the proper people into the school, at the proper times.

Click here for more details on this solution

Understanding how to use Crystal Matrix Permissions

To effectively use the Crystal matrix Permission Groups feature, you shoul dhave a solid understanding of how Permissions are defined within the system. Below are links to short training videos that explain the process of setting up Permissions within the ISONAS system.

Basic Crystal Matrix Configuration

Advanced Crystal Matrix Configuration 

There's a "People Element" to security we seem to be forgetting...

Social Engineering, the USB Way 

source: darkreading.com

Those thumb drives can turn external threats into internal ones.

The folks at DarkReading recently got hired by a credit union to assess the security of its network. The client asked that they really push hard on the social engineering button. In the past, they'd had problems with employees sharing passwords and giving up information easily. Leveraging their effort in the report was a way to drive the message home to the employees.

The client also indicated that USB drives were a concern, since they were an easy way for employees to steal information, as well as bring in potential vulnerabilities such as viruses and Trojans. Several other clients have raised the same concern, yet few have done much to protect themselves from a rogue drive plugging into their network. So the DarkReading guys wanted to see if they could tempt someone into plugging one into their employer's network.

In the past they had used a variety of social engineering tactics to compromise a network. Typically they would hang out with the smokers, sweet-talk a receptionist, or commandeer a meeting room and jack into the network. This time, they knew they'd have to do something different. Employees were talking within the credit union and were telling each other that somebody was going to test the security of the network, including the people element.

So DarkReading tried something different by baiting the same employees that were on high alert. They gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with their own special piece of software. One of their guys wrote a Trojan that, when run, would collect passwords, log-ins and machine-specific information from the user's computer, and then email the findings back.

The next hurdle was getting the USB drives in the hands of the credit union's  internal users. Simply enough, they made their way to the credit union at about 6am to make sure no employees saw them. They then proceeded to scatter the drives in the parking lot, smoking areas and other areas employees frequented.

Once the drives were seeded, it was time to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desk.

Upon calling the guy who wrote the Trojan and asking if anything was received at his end, it was revealed that slowly but surely info was being mailed back to him. It would have been lovely to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, the unknowingly running the piece of software cleverly hidden away by DarkReading.

After about three days, they figured they'd collected enough data. Upon review of their findings, they were amazed at the results. Of the 20 USB drives planted, 15 were found by employees and all had been plugged into company computers. The data  obtained helped to compromise additional systems, and the best part of the whole scheme was the convenience. Everything that needed to happen did, and in a way it was completely transparent to the users, the network and credit union management.

This little "giveaway" takes security loopholes a step further, working off humans' innate curiosity. Email virus writers exploit this same vulnerability, as do phishers and their clever faux websites. The credit union client wasn't unique or special. All the technology and filtering and scanning in the world won't address human nature. But it remains the single biggest open door to any company's secrets.

Disagree? Sprinkle your receptionist's candy dish with USB drives and see for yourself how long it takes for human nature to manifest itself.

The Clash of the Titans; Physical Security and IT Security

IT departments are no strangers to turf wars, but is the one shaping up between those overseeing computer networks and those in charge of physical security about to get really ugly?

Unlike past tussles between say, voice and data communications teams, the contest between IT security and those involved in everything from fire alarms to video surveillance to door-lock access controls tends to involve people who might never have had any reason to cross each other's paths.

Converging physical and logical security: A good idea or not?

"It typically takes a C-level executive to force these organizations to work together," says Tom Flynn, director of marketing in North America for smart-card maker Gemalto. "The fact is there are different entities in a corporation for physical and logical security… We see turf wars happening."

Merging physical and logical security is seen by advocates as a cost-saving step and a natural evolution for facilities maintenance and guard operations, where door-access equipment and video cameras are increasingly IP-enabled, and a smart card-based badge could be used by employees to access both buildings and computers. But resistance to convergence runs deep among traditional physical security managers, who are wary of IT departments taking control. And even IT security experts voice concerns that it's risky, with some strongly opposed to the idea of physical security operations, such as video surveillance streams, riding on the same IP corporate network as the rest of the business.

"Physical security has been about closed systems, but with the move to IP-based systems and connecting campuses there's the need to have the IT and security department involved," says Steve Russo, director of security and privacy technology at IBM's global technology services group. He says there can be advantages in integrating physical security with logical and transactional systems to give management a better picture of what's occurring, especially in retailing. And although network capacity is a concern, it's possible to share an IP network for logical and physical security, he suggests.

"Is there a risk associated with combining it? Absolutely," Russo acknowledges. But he adds: "The logical-security people are looking at threats to the environment. And where we see the interesting spark is that they can take information about physical events and turn it into operational use."

But there's often a cultural rift existing between the physical security department for facilities management, with their isolated closed networks, and the IT department with its systems administrators and security specialists trying to keep scores of Internet-accessing computers and applications running safely.

"With IP-based access control, the 'turf wars' tend to be marginalized once the IT folks realize that a system like ISONAS' PowerNet reader is actually a network appliance," says Steve Rice, Vice President of Sales and Marketing for Colorado based ISONAS Security Systems. "It demands little in the way of network capacity, resources to install and can be supported like any other IP device. The benefits of integrated video, access control and/or other building control systems include a combination of additional detailed information available from a set of closely integrated functionalities (ex. have a picture of personnel involved in an entry event plus network confirmation of the credential information timed exactly to the video feed) as well as the simplicity of dividing what functionality to integrate on a customer by customer basis. This is due to the relative ease of integration with a true network software-based system. So the physical security requirements are met with a minimum of IT resource."

These differences in viewpoint are often heard in the physical-logical security convergence debates. But one of the most ardent advocates for convergence might be Ray O'Hara, executive vice president of international operations, consulting and investigations at Andrews International, which is in the traditional physical security business of "guns, gates and guards," as he puts it.

"The traditional security person and the cyber-security side are both hands-on and doing things for the betterment of the organization," says O'Hara, who recently became president of the board of directors of ASIS International, an organization for security professionals.

But today the physical-security technologies are evolving to the point where "the traditional people need help from the IT people," O'Hara says. There is often discord and mistrust between the physical and logical security divisions. But that needs to be overcome by possibly combining reporting structures so they can more easily collaborate or by setting up a "risk council" to have regular discussions with business managers, he suggests.

IBM's Russo says protocol issues point to the need for standardized compression techniques and transport in physical-security equipment, as well as standard XML-based definitions so that important meta-data can be shared. "Physical security is transitional right now," Russo says, pointing to both the Physical Security Interoperability Alliance and OASIS as organizations trying to further interoperability standards that would add convergence and make it worthwhile.

But to date, Flynn says he is only aware of a handful of large enterprises in the oil-and-gas industry, such as Chevron and Exxon, and pharmaceutical giants such as Pfizer, that have adopted converged smart cards for physical and logical security.