Welcome everybody to today's CIT Tech for Business podcast.
Today we're sitting down with Todd and Kyle and we're talking about all things physical
security.
Why don't you guys kick it off by introducing yourself and telling us just a little bit
about the history of physical security first SMDs.
Hi, thanks, Kelsey.
My name is Kyle Edderman, the President and CEO at CIT.
And I am Todd Sorg.
I am CIT's Chief Operations Officer and I am also the Chief Information Security Officer.
I can do a real brief overview of physical security and then Kyle can kind of expand
on it.
So physical security has been around for decades.
It's really what you've expected to be.
Obviously there's many different layers of physical security that have gone on throughout
the years.
So if you're looking at the traditional things and you'll see this in a lot of traditional
businesses, but it was fencing, it was how did you do landscaping?
What does the lighting look like?
Cameras on buildings, et cetera.
And then things have just kind of been evolving as of late.
So as you can start to see upticks in cybersecurity issues, you're starting to see physical security
be a component of what's needed in today's modern defense as well.
Yeah, I think that speaks to it.
I think we're all familiar with your key locks, your key codes, your different ways to protect
the perimeter physically around the side of it.
And definitely a lot of modernization around that has been sorely needed because unfortunately
people, nobody criticizes it until they need it or there's failure of it.
And then they wonder how they ever got to that place.
So I think it's very topical to speak through it given the state of events, last few weeks
out of it within schools, but obviously other buildings, there's just a lot of it.
It is I think an underserviced area that people take for granted or neglect.
Just kind of out of sight, out of mind.
Yeah, great.
Just kind of giving some more history.
I know traditionally the way that the tools have been deployed have been really for that
physical security.
It was really protecting the main things that organizations need, people, assets, that type
of thing.
I used to work in a manufacturing facility and the way that everything was was heavily
controlled.
The intruder was basically where the majority of physical security were focused.
We did have some things that came into play.
So obviously we did have cameras in place and whatnot.
I kind of wanted to dig into this one in particular.
I laugh because if you've been in any kind of business for quite a while, you've probably
dealt with what I did.
So my security system there was very disparate.
So alarms are separate from the cameras, which is separate from badging, which is separate
from so on and so forth.
My camera systems, I tried several of them, really struggled with a lot of them.
They're clunky.
They're not intuitive.
A lot of times the backups don't work.
The recordings are muddled when you go back and try and define something in particular
that can be difficult.
Kyle, what have you seen in the industry?
Yeah, kind of same.
I think you usually see very antiquated technology driving many of the legacy systems.
They have either very old or near end of life operating systems in the backside that drive
these things.
They tend to be outside the scope of a traditional IT support.
They're usually handled by maintenance and then they present potentially cybersecurity
risks because of that, because they're generally outside of the management side of it and they
tend to be supported by a security company.
Again, that isn't necessarily IT focused.
They tend to be just mismanaged and underserved in multiple level sides on it and the technology
seems a lot to be desired.
Like you said, Todd, my experience looking at it is when you needed a video, they would
go pull the video.
Not only is it painful and time consuming to find the footage you're trying to find
if there is some suspected incident, it takes forever to find.
Then when you get it, it's usually so grainy and poorly viewable that you can't use it
anyway.
You just went through all this expense and setup and all these systems only to find out
that you really couldn't use it anyway.
That's kind of to my point where it just feels like it's out of sight, out of mind for many
organizations when you start looking at it.
It was a checkbox at some point where maintenance guys said we need a camera system.
They went and found something.
It's to be price point first and feature function is just not viewed.
They just take it on a price basis and they put it in and hope they don't need to use
it.
That's just not an acceptable way to handle your physical security.
It requires usability.
Yeah.
I love the checklist comment.
If you've heard any of the podcasts previously, we talk about compliance an awful lot.
Where you see strong physical security tend to be in those organizations where they have
some sort of compliance already.
That'd be your banking.
That'll be some of the healthcare.
One of the industries that's incredibly good traditionally with physical security is schools.
However, we saw some issues last week that would prove that that's probably not nearly
as strong as it could be.
One of the things I wanted to go through briefly is there are some things that organizations
that may be renting space as well will lean towards the landlord saying hey, you're the
one that needs to make sure that the landscaping is in place, is there fencing in place, those
kinds of things.
Of course, you still have some things that you need to do to make sure that you work
within their restrictions as well.
Cameras, can I put them wherever I want, so on and so forth.
That does create some potential issues as well.
Going back to schools in particular, we do a fair amount of reviews of banks and schools
and whatnot.
For the most part, I would say that most of the schools are in a very strong spot.
As things went into lockdown through COVID, you probably saw this across industry as a
lot of physical security did take a tick up, but they do a very nice job for the most part
of trying to make sure that they funnel kids through the front door.
They do have a whole bunch of people that are locking down doors.
You do have to come in, you do have to validate who you are, check in, et cetera, et cetera.
There is a lot of stuff in there.
However, since there's such a large group of individuals that are coming and going on
a regular basis, it's really hard to ensure that the tools are in place.
Of course, everybody knows schools have budget issues.
It's very difficult to get everything that you need all the time.
A lot of those are the human component of it as well.
Yeah, I think that's very appropriate.
You just deal with so many.
The schools have very good security from what you go through.
As you get to the backside, there's just an advancement technology that they could benefit
from that would provide different, taking it beyond just the perimeter doors and having
sensors and other solid cameras in the schools and having accessibility to law enforcement
and other sides outside the ability to easily share footage with public safety.
I know we're going to bring it up.
We haven't necessarily always provided a lot of manufacturers, but we use Furcata as one
we use side of it.
One of the great features of this, it's a cloud-based solution.
It does allow for the ability to easily share a link to live cameras with outside entities.
In the case of a school where you have an incident occurring within a school, the ability
of law enforcement to have eyes in the school live to be able to see would allow for proper
assessment of what exactly is going on.
They don't have to guess.
They could have live footage available to them easily.
In most schools, the camera systems are behind the doors of the school.
Very limited visibility into it.
There's just some nice powerful use cases of why this updated technology makes a lot
of sense.
Touching on that, some of the things that we've seen over the last several years is,
again, no surprise if you're in the industry and technology in any case, in any case, in
fact, your daily lives, 4K is a thing, right, so 4K cameras are a thing.
If you're looking for that in specific areas, whether that's entrances or your parking lot,
for example, at CIT, we've got a 4K camera facing the main entrance to our building so
we can pick up license plates if we needed to.
Again, if we had a scenario where we wanted to share that kind of feedback to somebody,
the police for example, we could absolutely do that.
We can timestamp it and quickly scroll to it, etc., etc.
That type of technology has ramped up dramatically.
Kyle touched on sensors as another area where we've seen a dramatic improvement.
Kyle mentioned Fricata.
I want to expand on it just a little bit as well.
It's weird for me to say there is a disruption in physical security, but honestly, I feel
like they've really done a nice job.
They haven't looked at physical security as disparate components.
It's not an alarm system that goes to whomever, ADT, alarm.com, whoever the case may be.
I guess that's actually the same company, but you hit my point.
That doesn't go separate.
Then you've got your camera separate.
Then you've got your sensor separate.
You have your badging separate.
They kind of looked at it as a complete thing.
In fact, one of the fewer things that they just recently did, as you mentioned with the
schools in particular, is they're starting to get into remote locks and system lock down
and alarming and wireless alarming and all kinds of stuff.
They're kind of taking a full view of the world and saying, what does physical security
look like?
I don't know if we need to summarize a lot of those pieces, but since I'm talking, I'll
just keep going for a little bit.
Where they really focus on and where we were really paying attention to it was the camera
system.
We've got the high-end cameras.
They're new.
They're up to date.
The storage of it is all cloud-based.
There's a local component of it too.
That part is really not problematic.
They do have badge access, which is really nice if you're looking at the integrations
that go with it.
You can use a specific badge access and tie that back to a camera.
As I mentioned, the timestamps are there.
I can look and see that that is the individual.
I can go look at that camera, potentially get a picture of somebody if I needed to.
I could see if tailgating is going on as an example.
Then it goes a lot further too.
We can get into sensors and what does sensor data look like.
Can I go to a bathroom again towards schools and see if somebody was triggering a vape
sensor in the bathroom?
We can see who came and went and potentially narrow down the list of potential people we
needed to talk to as an example.
Yeah, I mean, there's just the modern systems that you see.
Like the ricotta size introduces artificial intelligence into the side of it.
It has facial recognition.
It brings all these technologies together.
It's IT-focused.
It leverages the power of the cloud side of it for accessibility.
That's really what makes it, I think, a disruptor side to it.
The old traditional physical approach of just we're going to put a DVR in a room somewhere.
We're going to just feed a bunch of data to it and just hope nothing happens to it.
Todd mentioned backups.
I mean, that's just not functional.
It just really leads to a lot of headaches for the people and the users who try to access
it and use it.
There's just so much more value into looking at a more and a bigger holistic view of the
value of the physical security, the information that it can provide.
One of the use cases came out of the pandemic side of it was the heat mapping.
Being able to load up having a floor plan of a workplace and being able to understand
where people congregating at and it'll actually show you where it's detecting the most people.
You know where people are congregating, where you're having large groups, areas of the building
that are being used, areas that are not.
It's just a lot of valuable information above and beyond just the security side of it, just
the overall use of the building and seeing where people are being utilized, whether you're
having congregations of people.
If you ever wanted to know if Todd and I were ever together at a side of it within our system,
they can use the facial recognition and detect where Todd and I were together.
So it's just a lot of good connections, not that Todd or I are dating or anything, but
just the ability side of it to be able to recognize where things are happening.
There's just a lot of valuable use cases to the system far beyond just saying we think
that we had a break in at 2 a.m.
There's just a lot of other practical applications to it.
Yeah, I kind of wanted to dig into the facial recognition because I do think it's something
that is of potential concern for a lot of people.
There is a privacy component of it and there are things that if you're looking at tools
like Fercata or others, they are trying to solve business needs with it, but there is
a privacy component of it too.
So while it can be a bit pervasive where we're tying individuals to pictures and doing facial
recognitions and seeing when people come and go, there are legitimate reasons to use it
too.
We talked about it in the school scenario, the deny list.
If somebody comes in, they're trying to check a student out of the school and they're not
on the database or they're a denied or they're a person of interest or something along those
lines.
Situations like that, that facial recognition is actually an incredibly powerful tool set.
Speaking of which, I kind of wanted to expand on use cases.
There's a lot of them.
I've mentioned several, obviously the heat mapping for the pandemic.
There are reasons potentially, again, this is more camera focused, but it does count.
There's a people flow tool set that they're offering as well.
So somebody like retail or potentially hospitality would have the capability of looking at what
the flow of people looks like and potentially make changes to what's going on in that particular
organization, whether that's how the retail flows and they want to move people through
the building differently or whatever the case may be.
Another one that I wanted to mention in particular is theft.
Used to work at an organization that used to do a lot of storage outside and there was
a lot of theft going on, the equipment that was external to the building.
And while there were cameras in places, same struggle, right?
It was recorded, but you're scrubbing through data hoping to find something that moves or
ticks and modern tools have the capability of separating vehicles from people to et cetera.
So I have the ability to dig into it specifically, but we deploy a solution like Ricotta and
it has the ability to stop that theft and its footprints.
They've also talked about how they're starting to work with the alarm company.
So again, kind of that integrations with other tool sets where they can potentially react
much faster.
You can see an event before an alarm goes off or here's another great one.
Use case where was triggering an alarm that a back door was being opened or something
along those lines.
Use the camera system, zip to that particular moment in time, see there's nothing going
on internal building, external, there's no intruder.
So it's probably a false alarm allowed the organization to do a deep dive into it and
found out that the wind was causing the warehouse door to vibrate in and out.
And that was what was triggering the alarm.
But it's great to have that integration so I can figure that thing out without having
to deploy the police.
Yeah, there's just, it is, it is.
If you've ever used those legacy systems and you move to one of these modern systems, look
at it.
Most people just get huge smiles just because of that quick ability to be able to just immediately
see the information you're trying to look for, get it quick, share it easily, easily
accessible and being able to access that information from remote that you're kind of talking about.
I mean, you know, you always run into these issues where it's at 2am.
And if you got to get out of bed, VPN into the office, and try to get on the DVR, and
then try to go through it by, you know, that could take you 20 minutes.
If somebody's in the building, they're probably up and gone in 20 minutes before you even
told them to get to the police.
A lot of companies are already calling you, you know, they don't, they don't stay on there.
So you got, you only have a few minutes to be able to assess what exactly is going on
before you ask for those police to go out.
And if they come out frequently, you know, they're going to start charging you for it.
So you know, being able to have something that's very quick and easy, something you
pull up on your mobile phone, that's easy to get to be able to make an informed decision
to say, I'm confident nobody's in the building, and be able to look at it.
And it easily pays for itself.
The modern systems are definitely worth more, but functionality is undeniable.
I mean, it's, it's a whole nother stress here.
Yeah, I agree.
I'm sorry, Todd, not to interrupt, but I am anyways, I know we're talking a lot about
sensors.
So you mentioned vape detectors within schools.
So what other sensors, you know, might be available out there that, you know, some industries
would have some use cases for?
Go ahead, Kyle.
Oh, heat, temperature.
You know, water, other particles, other air particles, so early smoke detection, those
types of things, all environmental sensors, so you can detect a lot of those early motion
sides of it.
We tend to, you know, the restrooms in schools is typical for the vaping side of it, you
can detect vaping or smoking in the school sides with it, but it can go into server rooms
and other areas or other temperature sensitive components in there.
So you can have temperature alarms or other air particle changes in the environment that
could be occurring to get off of those triggers.
So there's a lot of, a lot of other potential nice uses for it.
And again, if you, if you pair it with a camera, you now have easy view to say, I'm getting,
it looks like there's potential some smoke or some alarm in this room.
Having a camera in the room, you can now put visuals on it too, to say, okay, is there
something going on there or, you know, somebody leave a window open or something else.
I mean, you can potentially pick up on something without you having to hop in the car, drive
to the remote site, take a look and see what's going on.
Yeah, the kind of expanding on sensors a little bit, there's, there's obviously humidity.
So heat humidity, that would be good stuff for like your server rooms if they are secluded
and segregated and secured.
Hey, physical security, who'd have known?
But it also has, I believe it's got a noise one as well.
So manufacturing, it can get extremely loud on the manufacturing floor.
And there are some requirements that organizations do need to be able to comply with in those
situations as well.
And so some sensors will help with those things in addition to one of the things that's really
popping up more frequently, as you see more and more sensor data come into organizations
is the ability to pull all that data and make sense out of it.
That's getting an alert that says server room and I'll use CIT, the Woodbury office in that
particular server room is high, there may be some additional things that I would want
to look at and potentially a desktop or a dashboard.
And so there, there are a lot of tools out there that are coming along and starting to
help you visualize what that sensor data means and whether there's trending that goes with
it and that type of thing.
So you will know, did it spike?
Did the AC unit die?
Whatever the case may be.
And of course, as you see smart buildings come along, that's a big thing that's going
with it as well.
Yeah, absolutely.
One interesting use case that came out with the modern side was getting back into that
ability to share a link to a camera with an outside entity or a person side of it was
within a manufacturer side of that.
And they were a contract manufacturer and they're there wanted to use the cameras for
their physical security, but also be able to have cameras by the product areas where
are the on the floor where their products being manufactured and allow the company that's
contracting them to be able to visualize and see the product being made, you know, to use
that as a differentiator in the market.
So it's just a real unique use case of, again, using the cameras for security, but it also
then added some additional value for their, for their customers to be able to have visuals
and something easy to see that was just done through a web browser.
And they can just have that live link for it.
So there's just a lot of cool things that just always keep kind of popping up because
of the unique capabilities of the product.
That's cool to have an ROI on one of your physical investment.
So one of the things I guess we should probably talk about too is the securing of a tool set,
especially since we're talking so heavily about a cloud-based tool that we use in particular.
What does that typically look like from your experience?
On the, on the access to the tools, the self side of it, you know, since it is cloud-based,
I mean, we obviously apply the same security structure that we do to any of our other cloud
system sides of it.
It has a multifactor, it's federated side of it.
So we have single sign-on and multifactor to access those sides.
We have, you know, we have logging up who accessed, there's tons of permission levels
to be managed by group assignment as far as allowing people to certain functions within
it.
So they can allow them just a certain set of cameras or all cameras or location sides
with it, same thing with the security.
So there's a lot of granular components to it to make sure that the product has security
of access, which obviously is very important.
Yeah.
And expanding on it briefly, we do integrate it with a lot of the other tools that we already
have, like Kyle mentioned for us, that make sure that what we are doing as our core infrastructure
and security tools are all mapping all the way through the tool set.
So it is very robust.
And I'm sure several people saw there was an issue last year with Vercata in particular,
and at least worthy of discussing is they found an issue, they addressed it quickly,
their communication was strong, and because it is a cloud tool set, it really allowed
them to quickly pivot and resolve issues that are out there.
So that typical cloud, all of those things that you get from cloud environments directly
applied to a physical security tool set as well.
And again, the ability for them to address those issues and get on top of it was very
impressive from my point of view and still going strong.
Yeah, I think kind of the last part on the cloud subject side, Todd, and you mentioned
it briefly about having some local storage for these things, is the unique nature that
the storage is actually in the cameras themselves.
So when you're viewing, when you're actively going to a viewing session, you're going straight
to the cameras.
So the amount of bandwidth that it uses to go to the cloud is actually minimal because
you're basically sending thumbnails, small subsets of the visible so you can understand
what's there unless you choose to archive to the cloud, which you can do.
It's using very limited bandwidth.
It's just small thumbnails.
And when you actively view, then you're using a live stream to that one camera you're viewing.
So it's not actively constantly drawing a large amount of bandwidth, which I think is
just a very nice design structure to it.
You're segmenting out your storage by camera basis side with it.
And there may be certain cameras you want longer term storage with, and you can elect
to do that as well.
You can have certain cameras with larger storage and you can have longer retention and or obviously
you can still archive to the cloud at certain sites too.
So they really have a well thought out structure to how the handle going to the cloud because
as Todd mentioned, these are 4K cameras.
That could be a lot of bandwidth if you were not using some kind of local storage.
Yeah, so just closing thoughts from my part or from my point of view is I feel like there
is disruption going on in the industry.
It is not something that should just be taken lightly.
The nice thing about the modern tools is they can be deployed as needed.
So if you needed cameras, you can start with cameras.
If you need badging, you can start with badging.
If you want to do guest sign on, you can do all of those things as subcomponents.
Or if you know you've got things that you need to complete, of course, the tool is capable
of joining all of those items together and will really give you a nice unified solution.
The other nice thing about the cloud is that new features come early and often.
It's quick for them to be able to deploy them and offer them to the customers as they see
things transitioning, which is pretty awesome as well.
Yeah, and in physical security, that's pretty much been unheard of.
You know, you just put it in there and 10 years later you may look at it again.
So it again tend to go unnoticed until they're needed.
But knowing that you have something that's constantly evolving and updating is, I think,
incredibly important.
Awesome.
Thank you, Todd.
Thank you, Kyle.
I think that's a lot to chew on and really there's a lot of features that just happened
in there.
So do know that we're always here for any and all questions.
Just via email at info at cit-net.com.
Also, we do have a lovely forum filled out on our website.
You can find all of our podcast episodes at cit-net.com backslash podcast.
These guys love to talk and I know today we went a little bit heavy into Mercado, but
only because we use it and we love it.
We do have a demo coming up on June 9th free.
We're not asking you to give us anything, but it is a really cool tool set.
I love peeking out and seeing the dashboard of just all the really cool things it can
do.
So by all means, go Google it.
Hit us up via email.
We're always willing to chat and we will look forward to chatting with everybody next week.
Thank you all.
Thanks.
Videos includuche