Twice in a 30-day span in October and November, the U.S. woke up to widespread internet outages. And while most Americans were full of angst because they couldn’t access Snapchat, Reddit, and Amazon, the question on the minds of many in the security industry was whether cloud-based security systems were down as well.
A DNS error that occurred on Amazon Web Services on Oct. 20, and a crash of Cloudflare on Nov. 18 due to an internal software failure, coupled with the rapid shift to cloud-based security systems that depend on internet connectivity for proper functionality, made it seem like a reasonable question. It also seems like a question that may be asked by many security end-users of their integrators and consultants.
Such events that capture public attention can become an opportunity for integrators and consultants to serve as a trusted resource of vital information for customers who aren't sure what it means to their security systems...but what do you tell them? I asked for answers from one of our industry’s cloud-based security pioneers, Steve Van Till, the founder and CEO of Brivo.
Van Till was quick to point out that outages are not an all-or-nothing proposition. “Many physical security systems continue to perform their core functions even when the internet is down,” he says. “Access control systems, for example, are usually hybrid systems in which a local on-prem device can still lock and unlock doors using a cached data set. Changes and updates typically require internet connectivity (and cloud application availability), but most customers make fairly infrequent changes; so for outages that last minutes or even a few hours, this is not a ‘fatal flaw’ in the architecture.”
So what does become compromised? “Like every other cloud service, physical security applications depend on the internet and application availability for wide-area communications to stakeholders, such as texts, emails, in-app notifications, as well as other platforms like Slack, WhatsApp, and Signal, to name a few,” Van Till says. “These comms obviously don’t work when there are massive failures of internet or platform infrastructure.”
He stresses that integrators should remind customers that for access control systems, the most important emergency capability is lockdown. A properly configured lockdown system includes local, analog switches (emergency buttons) that do not require any internet connectivity.
As for cloud-based video systems, Van Till says most use an on-premise bridge or gateway device to buffer video feeds from cameras and perform analytics functions locally before sending video clips to the cloud for storage and distribution. “That makes them hybrid systems (like access control) that continue to perform their core functions even when cloud or internet availability suffers,” he says.
The Caveat
Armed with reassurances to customers about basic functionality, their peace of mind can be restored; however, Van Till says there is a caveat: It is AI-driven agentic systems that perform without human intervention. As we covered last month in Security Business, many companies are turning to agentic AI solutions to handle mundane business functions.
“Companies that have replaced staff with AI tools and agents face a new risk – if the internet or platform becomes unavailable, none of those workflows will execute,” Van Till says. “Companies relying heavily on agentic security operation centers or other agentic workflows will need to ask themselves: how much of this do we want to handle locally now that we've let go of the people who used to do it?”
About the Author
Paul Rothman
Editor-in-Chief/Security Business
Paul Rothman is Editor-in-Chief of Security Business magazine. Email him your comments and questions at [email protected]. Access the current issue, full archives and apply for a free subscription at www.securitybusinessmag.com.