Where IT and physical security responsibilities intersect

The growing involvement of IT departments in physical security introduces another consideration: The two groups may operate under different policies for maintaining network-connected equipment.

(In the accompanying video, Axis Communications' Ryan Zatolokin explains who is responsible for keeping security cameras updated when IT and physical security departments follow different maintenance policies.)

Zatolokin said the relationship should be a close partnership, with physical security identifying operational and protection requirements while IT ensures devices comply with organizational cybersecurity policies.

“Security knows what doors need to be secured, what other operational efficiencies need to be looked at, but IT ultimately knows what their cyber policy is, what their IT security policy is,” he said.

Problems can arise when those policies are not aligned.

For example, an IT department may require devices on its network to be updated every six months, while the physical security department follows a different maintenance schedule.

“Who continues to make sure those updates are done?” Zatolokin asked.

If IT manages the devices, its maintenance policies may be implemented consistently. If physical security is responsible, the same requirements may not always be carried out within the expected timeframe.

The challenge, he said, is establishing who has responsibility for implementing those policies over the long term.

Cloud management can simplify maintenance

Cloud-based device management is one way to reduce the administrative work associated with maintaining cameras across an organization.

Zatolokin said cloud platforms can automate software updates based on schedules, apply updates when new versions become available or allow administrators to initiate them manually.

Those capabilities can help security and IT departments establish maintenance policies without requiring personnel to update every camera individually.

“If you go to each device one by one and you try to update it through its web browser, that’s going to be a very, very time consuming practice,” he said.

Device management tools can instead update hundreds of devices in minutes, reducing the time required from both departments.

“And that saves a lot of time. It saves IT time, it saves security time, and I think it makes it much more realistic to address the challenge of maintaining all these devices,” Zatolokin said.

Automation, however, does not eliminate the need for organizations to determine which departments establish maintenance requirements and who is accountable for carrying them out.

What happens when nobody takes responsibility?

Although manufacturers, integrators and end users all have roles in maintaining network-connected cameras, Zatolokin said organizations can still manage those responsibilities effectively when one party takes the lead.

The greater concern is what happens when no one assumes that role.

“When no one takes ownership, nothing happens,” he said.

Zatolokin described that situation as potentially the worst outcome, particularly when devices remain in service without anyone accepting responsibility for their ongoing maintenance.

“I think as long as, even if one party takes the lead in this, that’s still pretty effective in terms of taking care of those devices through their lifetime,” he said.

The underlying issue, he added, is when responsibility remains unassigned.

“But I’d say the gap, the true gap, and I think you exposed it with your question, is when no one wants to own that device. And I think that is, that’s a challenging situation.”