The information technology capabilities of security systems have grown tremendously over the past decade, resulting in both intelligent devices and intelligent systems. Emerging technology has taken intelligence to a new level with systems that run on top of or alongside our existing systems and that
• respond to events based upon situational awareness,
• provide actionable data in context of the situation,
• identify remote and global situations and events before they create a local impact, and
• keep critical information from being effectively buried when systems are overwhelmed with high quantities of data, such as occurs with an earthquake, tsunami, or power outage.
The existence of such systems impacts security systems integration in four ways.
1. System design and planning must no longer be divorced from security Concept of Operations (CONOPS) design. It has always been important to develop security operations and response scenarios for system design and testing purposes; now it is critical to effective use of advanced security technology.
2. With intelligence embedded in our security systems from the lowest to the highest levels, we must pay specific attention to the roles of intelligence at all system levels during system design and planning.
3. Existing systems used for alarm monitoring, access control, video surveillance and communications can be leveraged instead of replaced, to provide significant new security operational capabilities. This extends the useful life and ROI of existing systems.
4. Powerful and flexible intelligence is often rules-based. In many cases a lot of thought and effort is required for rules development, even when selecting or combining pre-existing rules. There are also resource and scheduling requirements for the development and field testing of rules that must be accounted for in project planning.
Fortunately we do not need to become experts in computers and information technology to effectively design and use systems containing advanced intelligence. We simply need to understand the design and deployment requirements.
For design, we need to identify the roles that these technology elements can play in our systems and their impact on our security operations, both day-to-day and in incident response. That enables us to develop functional requirements for the systems and devices we intend to use. For deployment, we must collaborate in detail with the system provider regarding scheduling, training, system commissioning, field testing and future technology upgrades relating to the intelligent aspects of our systems. Otherwise we won't really get the results that we and our security stakeholders are expecting.
The Roles of Intelligence
This article is the first of two that will discuss the roles of information technology and intelligence in our security systems. We'll start by examining the basics at the system and device level. Next month's article will examine intelligent system capabilities from a strategic security management perspective.
We need both perspectives if we are to identify the ways in which intelligent security technology can help us not only improve our organization's security profile, but also increase the effectiveness and efficiency of our efforts. These are important objectives because, like many divisions of businesses, security is being asked to do more with less. The right application of intelligent security technology can help with that.
Intelligent Devices and Systems
A device is considered “intelligent” when it is controlled by one or more processors (computer chips) integral to the device. One example is a dual-technology motion detector, which uses both infrared and microwave to increase its reliability. A more complex example is a video camera that performs auto-focus, day-night adaptation, pattern recognition, and alarm notification, and which also sends e-mail with attached images.
The processor chip in an intelligent device uses a combination of stored data and real-time data from sensors to make device control decisions. The series of steps the processor uses to make these decisions is called an algorithm. An algorithm is commonly defined as a procedure or formula used to solve a problem. A device may have one or many algorithms.
In an intelligent device, algorithms take raw data and process it to produce actionable data. One characteristic of actionable data is its timeliness. Even if the data is correct, if it is not available in time to be effectively applied, it is not actionable.
Where Is the Intelligence?
In today's security systems, intelligence can be found at four levels:
• across systems
• within systems
• between systems
• in field devices
Table 1 describes the roles intelligence plays at each of these levels.
Table 1. Intelligence in security systems.
Intelligence provides new functionality not available in any individual system. This is an area of emerging technology that uses the information available from multiple systems to provide situational awareness; present data in context; automate security operations workflow and incident response based upon security policy; provide text-based and graphical reporting of a wide spectrum of local, regional and global security metrics; and provide automated incident reporting that assembles relevant data from multiple systems into a comprehensive incident report available in real time.
Intelligence provides advanced system functionality. For example, advanced video systems can track and display people or objects as they move from one video camera's field of view to another's.
Intelligence provides system interoperability. Hardware gateways (such as those for connecting access control/alarm monitoring systems and building controls or other systems) and middleware (software used to connect systems that “talk” different languages) fall into this category. While devices and software in this category meet the technical definition of intelligence, they are not always thought of as “intelligent” because there is very little or no real-time data analysis involved in their functionality. In many applications—but not always—data is simply passed through from one system to another.
Intelligence enhances the device's functionality, as in the earlier examples of the dual-technology door motion detector and the auto-focus, day-night camera.
It is not necessary to know the technology details underlying intelligent systems features in order to use them. However, it's a good idea to know the key concepts and related terminology involved, to keep from getting lost in literature or discussions that touch on the technical side of things.
Advanced Systems Intelligence: Analytics
In plain English, analytics is the use of computer processing to make sense out of a bunch of raw data. For example, speech analytics can be used to identify a specific speaker (voice identification), or to identify the words spoken (voice recognition). Business analytics provides information to support decisions and planning. A bank would use business analytics to balance its loan-making practices in terms of risk and profit, analyzing types of borrowers, types of loans and size of loans.
Security analytics is any type of analytics used to provide actionable data to support security decisions, security planning or a response to a situation or incident. It includes business-type analytics (such as supporting security metrics for management purposes), but it is more commonly associated with specific technology, as in the case of video analytics.
Analytic techniques strive to duplicate humans' ability to think and reason in imprecise, non-quantitative terms. It is this ability—often referred to as fuzzy logic—that allows us to decipher sloppy handwriting or make decisions based upon the complex factors in a tricky situation.
Systems with security analytics use some or all of the following methods, often mentioned in product literature, to process data to obtain actionable information:
• data filtration
• data association
• data correlation
• data fusion
Data filtration addresses high volumes of data to extract what is meaningful and important.
Data association matches up one set of data with another set of data, based upon predefined rules. Pattern recognition is a type of data association.
Data correlation is the identification of relationships among data that can be used to draw conclusions. For example, the existence of multiple objects in close proximity moving at relatively the same speed and direction indicates possible team activity.
Data fusion is a category of information-combining techniques. It is a broad and advanced technical topic and also an emerging science (see www.data-fusion.org ). One form of data fusion combines different data from the same source (i.e. multiple versions) to get an improved result, as in comparisons of multiple handwriting signatures.
Another form resolves data from different sources that relate to the same target. For example, is it the same object on both cameras? This is sometimes called data integration.
A third form combines data from different sources to get an improved or new type of result. Human vision is used as a common example. Because each of your eyes has a slightly different viewing angle, you have depth perception and 3-D vision.
Simply put, situational awareness is knowing what's going on around you. The U.S. Navy defines it as “the degree of accuracy by which one's perception of his current environment mirrors reality” (https://wwwnt.cnet.navy.mil/crm/crm/stand_mat/seven_skills/SA.asp) . Security analytics provide pre-processed information to facilitate security personnel's rapid comprehension of a situation, allowing them to choose a course of action in time to be effective.
Figure 1 on page 26 is a conceptual diagram provided by Proximex Inc. (www.proximex.com) that illustrates how its Surveillant system provides command-and-control capabilities by establishing a layer of integrated security analytics across multiple traditional security systems and sensors.
For example, an access control breach alert can bring up the appropriate live camera and recorded video, the last X number of people who presented a badge, and the appropriate photos from the badging system, along with information from other systems. Instead of spending 10 or 15 minutes manually assembling information, security teams can gain nearly instant situational awareness and move rapidly from incident notification to suspect identification to suspect video tracking.
Workflow Automation: Beyond Command and Control
Workflow automation is not new in the business world, but it has not previously been applied to security operations due to the isolation of the typical security operation from the rest of the business. Now the development of the chief security officer position and the adoption of the enterprise security risk management perspective within global corporations have heightened the need for policy-based security management that can span the enterprise.
A system with security workflow automation capabilities, such as SAFE by Quantum Secure (www.quantumsecure.com) , can provide a means to define security policy, document company personnel roles and security stakeholders, and implement automated support for day-to-day operations as well as crisis management and incident response.
A security workflow automation system rolls out policies electronically to the appropriate recipients and can alert you if a newly-issued policy is not read and acknowledged by a specific deadline. Integration with various security systems can help track policy compliance and performance. For example, let's say the policy states that fire alarms must be acknowledged at the fire panel within 30 seconds and responded to in person by the facility's fire warden within 4 minutes. By integrating the workflow automation system with fire panels at corporate facilities, you can track response times and issue periodic reports showing the level of policy compliance.
Going beyond security incident response, rules can be defined to identify developing situations and to automate timely response according to policies. For example, by monitoring National Weather Service news feeds via the Internet, the system can provide early warnings to specific facilities threatened by a category 4 storm. It can automatically
• schedule a telephone conference for relevant company managers through Microsoft Outlook and notify you by e-mail and phone text message of the responses;
• query the access control system to identify personnel at affected facilities and notify them by e-mail and phone text messaging;
• push out relevant company policy for review by security staff and line managers responsible for the affected facilities, to prepare them to react appropriately.
Integration and Security Analytics
The list of security analytics applications, which you can tailor to the needs of your organization, is practically endless. And that's the main point: intelligent security analytics capabilities like those described here have added a whole new dimension to systems integration.
What type of intelligent analytics will you use at the device level and the system level? Is there a rules-based process that you can update, or does any adjustment require a factory technician? What information inputs for analytics are required locally at facilities and centrally at headquarters security operations? Where should the system analytics outputs go? What about situations that analytics rules don't cover—how will they be identified in real time? Can you leverage your existing security systems using automation systems like the two described above? Should you keep your old devices or purchase intelligent replacements? These and many related questions should be addressed in the course of considering the use of today's advanced security technologies.
Not only do intelligent systems provide tactical response capabilities, they provide a bridge between strategic planning, policy and security operations. As security systems have become enterprise in scale, wide-scale strategic deployment of intelligent systems is possible with enterprise-level benefits, including enterprise-wide security metrics management, cost control, and continuous process improvement. All of these benefits will be examined in detail in the next issue's article, “Security Integration: High-Level Drivers.”
Ray Bernard, PSP, CHS-III is the principal consultant for Ray Bernard Consulting Services (RBCS), a firm that provides high-security consulting services for public and private facilities. Mr. Bernard has provided technical advice in the security and building automation industries for more than 18 years. He is also founder and publisher of The Security Minute 60-second newsletter (www.TheSecurityMinute.com) . For more information about Ray Bernard and RBCS go to www.go-rbcs.com or call 949-831-6788.