Security convergence

13.02.2006
In many respects, the physical and information security groups that coexist within companies are as different from each other as J. Edgar Hoover and Bill Gates.

Physical security staffs predominantly consist of former law enforcement officials who report to legal, compliance or risk management departments, whereas information or logical security departments typically have employees with technical backgrounds who are part of the IT organization. Physical security divisions tend to focus on the three G's -- guards, guns and gates -- while logical security groups usually concentrate on safeguarding information systems.

There are a few companies where the two entities are structurally connected, but most are not. Still, a growing number of executives have recognized the value of having these groups collaborate to share tactics such as loss-prevention techniques for retailers or the use of card systems to restrict personnel access within a facility.

According to a survey of 8,200 IT and security executives in 63 countries conducted in March and April of 2005 by PricewaterhouseCoopers and CIO magazine, 53 percent of organizations have some level of integration between their physical and IT security divisions. That's up from just 29 percent in 2003.

"People are recognizing that the two groups can't stay in their own towers," says Anne Rogers, vice president of marketing at the Information Systems Security Association (ISSA), a not-for-profit international organization of information security professionals and practitioners.

Collaboration can be as simple as having an information security group send an e-mail warning staffers about a fast-moving Internet virus while the physical security group posts signs around the building as a secondary reminder, suggests Angel Cruz, chief information security officer at Freescale Semiconductor Inc. in Austin.