Blogs

The last blog I wrote, “What your connected smart home IoT devices are really doing,” highlighted the fact that there are no security standards for IoT manufacturers to follow when creating networked devices. This should cause concern or at least pause for people using such devices, especially in their homes. But, just how aware are consumers about potential risks and do people actually trust the devices they use every day? 

ASecureLife conducted a survey of 300 Americans nationwide to determine how much participants trust the technology they use regularly in their homes as well as people’s biggest concerns related to smart home technology, home security and online privacy. The survey found:

1. A quarter of Americans are NOT concerned with being monitored online by criminals. This nonchalant attitude resulted in 23 percent of American households having someone victimized by cybercriminals in 2018, according to GALLUP. 

Additionally, in 2017, the FBI’s Internet Crime Complaint Center received more than 300,000 complaints, totaling more than $1.4 billion in monetary losses for victims. 

2. Americans are more concerned about being monitored online by the government than by businesses.

3. Two-thirds of Americans believe their smart devices are recording them. While it’s time consuming, and to be honest, boring, thoroughly read a company’s terms and conditions so you know what personal information that company is collecting from you, and how they’re using it.

Tip: Adjust the settings on your smart equipment to maximize your privacy. For example, turn off Amazon Echo’s “Drop In” setting to prevent the it from automatically syncing and conversing with other Echo devices. 

4. About one in five parents would let Alexa entertain their kids while they’re away. WOW! Parents are actually trusting their children’s safety and security to the virtual world!? (We’ll be discussing this later on in this blog post! Read on!) 

5. Seventy-five (75) percent of Americans believe smart homes can be easily hacked, but 33 percent have and use some type of smart home technology. This indicates that consumers are indeed buying these gadgets. In fact, a joint-consumer survey conducted by Coldwell Banker Real Estate and CNET found 47 percent of Millennials, aged 18 to 34 years, have and use smart home products. 

6. Women are typically more concerned with home security than financial security, and the opposite is true for men. Participants were asked if they fear a home invasion more than identity theft: 53 percent of women participants said “yes,” compared to 44 percent of men.

Participants were also asked which of the following they would rather do: stop locking your doors or change all your passwords to “1234.” Men’s responses were split evenly, while 59 percent of women preferred to change their passwords to this all-to-common numerical sequence. 

7. Americans aged 55 and older are more protective of their financial security than their home security; the opposite is true for younger people. Participants over age 54 were asked if they feared home invasion more than identity theft to which 70 percent answered “no.” However, participants under age 34 were more likely to fear home invasion. 

While all the findings were eye-opening, for me personally, the one that haunted me pretty deeply was the one about Alexa “babysitting” kids. It’s one thing for parents to allow their children to use Alexa under their supervision, but to allow minors to access Alexa while they are away can be extremely dangerous, in my opinion and based on the news we see every day concerning criminals hacking into security systems, devices recording home-based conversations, apps giving away data to advertisers, and the list goes on and on. 

Question for you parents out there: Would you allow your children to access Alexa when you aren’t at home? Why or why not? 

As more and more people connect IoT devices to their homes, making them smarter, living machines, the more fodder hackers have to breach systems and gain access to consumers’ personal identifiable information, or even gain entrance into their humble abodes. The fact is, no security standards exist for IoT manufactures to follow when creating networked devices. 

Lawmakers and states are stepping up, looking at ways to help protect consumers.

Industry talk of late about protecting owners of IoT devices have circled around the Cybersecurity Improvement Act of 2019 which would require the National Institute of Standards and Technology to develop new recommendations for device makers to follow. Even some states have created specific rules for IoT device creators to follow, such as California, that will require devices to be shipped with unique passwords or force users to set or reset passwords when setting up a device as of January 1, 2020.

But, are laws really the answer to this seemingly never-ending debacle? Shouldn’t the security industry come together as a whole to offer protection to consumers, their data and their homes? After all, we are in the business of protecting people while offering comfort and ease of living. I think a more proactive approach is in order, where device manufacturers step up to protect consumer data as well as empowering consumers to protect themselves.

A group of computer scientists from Princeton University and the University of California, Berkeley created a tool called Princeton IoT Inspector, an open-source desktop application that passively monitors smart home networks, showing potential security and/or privacy issues. It identifies all IoT devices on a smart home network, shows when these devices communicate/exchange data with an external server, and determines which servers these devices contacted and if those communications are secure. According to the IoT Inspector website, the goal is to answer three questions:

1. Who do your devices talk to?
2. What information is gathered?
3. Are the devices hacked?

Sounds great, right? Well, there are two cautions to be noted when using this tool. First, device names are included in the data sent, so that data will be accessible by Princeton. The app asks users to consent to this the first time the app is used. (Tip: Make sure your devices don’t include your name or any other personal identifiable information. If they do, rename them.)

Second, the research team is using a specific technique the “bad guys” typically use called ARP spoofing, a type of attack where a malicious actor sends false Address Resolution Protocol (ARP) messages over a local area network. Personally, I think it’s creative and smart to use the same techniques to beat the bad guys at their own games, turning malicious acts into something good. Just be sure you trust Princeton should you decide to use this tool. 

Currently, Princeton IoT Inspector is only available on macOS, but there is a waitlist for Windows, which will be released next month, and Linux to be released the week of April 24th, 2019.

ISC West 2019 wrapped up on April 12 in Las Vegas after another record-breaking year in terms of attendance, according to Mary Beth Shaughnessy, Event Director - ISC Events and Unmanned Security Expo at Reed Exhibitions, who spoke to Security Systems News on the SSN Media Stage during the event.

“The show is bigger this year and we are looking at being up about 4 percent in attendance overall this year,” she said. “We’ve got a number of new areas that are growing. Our emerging technologies zone has grown over 40 percent from last year to this year. New companies are up year over year and our connected security area is up this year as well. Just overall participation with the security industry, in general, with all of the new technologies coming out — everyone is just anxious and excited to get their products in the marketplace.”

Shaughnessy confirmed what many of us were hearing on the showfloor, as exhibitors noted that their booths were jam packed with quality people each day. In addition, the education sessions were very popular again this year, with overall attendance up.

“The education this year is great, and it is all programmed by SIA,” she pointed out, noting that she is excited to continue the relationship with SIA moving forward. “We’ve had great attendance, up from last year, at many of the sessions … Some of the top sessions looked at the convergence of physical and cybersecurity.”

The following is a look at my time at ISC West:

Day One: Tuesday, April 9

Excited to be here in Vegas for ISC West 2019, the security industry’s biggest conference and trade show of the year.

Started day one on Tuesday with The Advance, The Security Industry Association’s annual membership meeting where SIA gave an update to a packed house on the state of the association, while also giving out several membership awards and voting in new members to the board of directors.

Scott Schafer, chairman of the SIA Board of Directors, hosted the event, which he called “the fastest hour at ISC West” and he was not joking, as a lot was covered in just a little over an hour’s time.

Schafer pointed out that in addition to the security industry’s continued solid growth, SIA is also in very good shape financially and in terms of growth on the membership side, which Schafer was confident will surpass 1,000 members any day now.

On the financial side, the association saw $7 million in revenue, with $6.4 million in expenses, leaving approximately a half million in surplus. Investments showed a 57 percent increase for 2018.

Schafer also pointed out that SIA signed a 10-year agreement with ISC Events with a 5-year clause, which he said is a “very exciting announcement” as the two have many events planned for the future with this continuing partnership.

SIA also gave out several membership awards at the Advance, including:
•    Member of the Year Award: Axis Communications
•    Chairman's Award: SIA Women in Security Forum
•    Sandy Jones Volunteer of the Year Award: Mark McCourt, Cobalt Robotics
•    Committee Chair of the Year Award: Chris Grniet, Guidepost Solutions

In addition to award presentations, Sal Mani, security systems manager for Google, spoke on the workforce imperative of developing cross-functional skill sets to stay competitive in the security industry.

New SIA Board members voted in at meeting include:
•    Greg Hill, Director, Intrusion Architecture, Johnson Controls
•    Kim Loy, Chief Marketing Officer, ACRE
•    Jody Ross, VP, Sales, AMAG Technology
•    James Rothstein, SVP, Global Security Solutions, Anixter
•    Brian Wiser, Regional President, Bosch Security Systems

Day Two: Wed., April 10

Started the first day of the trade show at the Hikvision Media Event, where Hikvision North America's Director of Global Public Affairs Michael Gutierrez, President Jeffrey He, Director of Cybersecurity Chuck Davis, and new General Manager for Hikvision USA and Hikvision Canada, Eric Chen, gave invited press an update on the current state of the company. Jeffrey He addressed some of the challenges that Hikvision faces, with growing anti-China sentiment, trade tensions, tariffs and government bans topping the list, noting that these “will likely impact us on the global front.”

Chen looked at how the company continues to grow and prosper in the face of these growing challenges, noting that in North America Hikvision business showed $7.4 billion in revenue and 18.8 percent in year-over-year growth in 2018, as well as 40 percent compound growth from 2010 to 2018. The company worldwide has approximately 34,000 employees, with 6,000 engineers, he noted.

Chen said the company is “still going to invest in North America,” focusing on SMB and the midmarket and “shifting from product selling to solution selling,” with retail and education two of the company’s biggest verticals.

While Hikvision continues to introduce new cameras, like the new 32MP multi-directional camera it unveiled this year, Chen pointed out that this year’s theme for ISC is “Focused on Your Success,” highlighting the company’s customer-focused programs.

Davis, who teaches ethical hacking and serves on the SIA cybersecurity committee, outlined the company’s cybersecurity strategy and milestones over the past few years, including the use of pen testing and ethical hacking for all cameras with a third party; the establishment of a cyber hotline in 2017; cybersecurity education roadshows (22 in the U.S. and Canada); joining FIRST.org, a global incident response organization and consortium; and creating a whitepaper that covers the testing and process of the lifecycle of a product before it reaches a consumer.

“This [white paper] is an important document for us to be transparent, and show that we are holding ourselves to a high standard,” said Davis, noting that Hikvision is the only company to have a code transparency center where “anyone can come and do an audit.”

Noting the importance of the network as the “first line of defense,” Davis said Hikvision’s SSL encryption process is held to the highest NIST standards, including the FIPS 140-2 standard.

Next, I headed over to the Genetec booth, where I spoke with Andrew Elvish, VP of marketing and product management and Derek Arcuri, product marketing manager, who outlined some of the company’s cool new features in the new version of Security Center, the company’s open-architecture platform that unifies video surveillance, access control, automatic license plate recognition (ALPR), communications and analytics. Some of the cool new features include customizable live dashboards, enhanced privacy protection features, a brand-new map-driven mobile app, and new functionalities that help users actively monitor the health of their system and ensure compliance with cybersecurity best practices. What makes Genetec stand out from the crowd, Elvish noted, is its “unified enterprise platform that gives a unique view into the data, allowing you to make informed decisions.”

Over at the FLIR booth, I met with Fredrik Wallberg, director of marketing – Security & ITS, and Haley Coveny, public relations coordinator, who explained that the company is looking to be more of a “solution provider” rather than just a provider of products. In addition to its wide range of thermal camera solution, FLIR highlighted its new solutions for Smart Cities and perimeter protection applications. The company’s new TruWITNESS wearable sensor platform is designed to expand true, real-time situational awareness for public safety operations. Combining video, audio, location data and IoT capabilities, TruWITNESS enables sensors to send alerts and stream data back to a central command center running FLIR United VMS for improved incident analysis and intervention.

Moving to the G4S/AMAG Technology booth, I spoke John Kenning, regional CEO for G4S Americas, who spoke about the company’s continued commitment to using technology to help security professionals be more efficient and accurate, whether they are out in the field or back in the command center. The company is also taking a more “risk-based” approach as a “trusted advisor” who is there to evaluate and consult based on operational and compliance needs. “We are a top 5 integration business and a top 3 man-guarding business, which is a great combo.”

Next, I visited with Benjamin Bryant, global public relations consultant for IDIS, which celebrated five years at ISC West with a comprehensive showcase of the South Korean manufacturer's IDIS Total Surveillance Solution. Highlights of the company's fifth anniversary with ISC West included areas of special emphasis on cybersecurity, deep learning analytics and facial recognition, and solutions for the retail and banking sectors. On the product side, the company released its new Compact IR Fisheye, featuring its dual-side dewarping in a smaller, more versatile approach. The company also unveiled its new 12MP Panamorph Fisheye and the full IDIS Compact Solution.

At the Allegion press event, Robert Lydic, Allegion’s VP of PACS OEM Business, discussed how Allegion brings strength to the security industry with a legacy of knowledge and quality behind them and how that strength will be leveraged into forward-thinking solutions with the right balance of security, convenience and efficiency. Allegion is “a five year old company with brands that have been around for 100 years,” he said, noting that these are brands that people trust, such as Von Duprin, the producer of the first "panic bar" style door mechanism, and Schlage, one of the oldest and “most tested and trusted” lock manufacturers. Lydic also noted that Allegion’s mobile ecosystem is founded on the belief that providing physical access control should have an open, secured architecture offering customer-centered solutions.

Day Three: Thursday, April 11

Started the day bright and early at 5:30 a.m. volunteering with Mission 500, which hosted its 10th annual Security 5k/2k, bringing the entire industry together for a great cause. As Mission 500 Founder George Fletcher and Board Chairman Tim Purpura pointed out at the award ceremony on Thursday, this year’s race was a huge success with more than $145,000 raised to help Mission 500 children and families in need. It felt good to get out there with SSN Regional Sales Manager Brad Durost, and walk — yes walk, sorry! —along with others to help this amazing organization.

Started the morning with Alarm.com, with Matthew Zartman, director of communications, who gave me a tour of the latest and greatest on both the residential and commercial side of the business, where the company has been growing its presence, especially in the SMB space, Zartman noted. For example, Alarm.com is making it possible to manage access control and video across multiple business locations. Just as Alarm.com informs the homeowner using data in Insights Engine, it can use data on the business side to provide business intelligence on top of access control and video surveillance management.

I next visited with Robin Regina Baker, CTO, SilverShield, which was showcasing its cloud-based safety and information system at ISC West, demonstrating the capabilities of their visitor management and communication software. Originally developed for school campus applications, the software incorporates a fully integrated suite of modules including visitor management, lockdown initiation and more. Designed to expedite emergency security procedures, the SilverShield Visitor Management System enables manned or unmanned visitor screening at all types of facilities. In addition to offering an incident and event management system, the company’s in-app SilverShield HR & Safety Resource Center connects schools and businesses with local, highly trained security professionals to develop a security assessment, plan and documentation.

Visited next with Alcatraz AI, winners of the Judges’ Choice Award in the SIA New Product showcase. I spoke with CEO and Founder Vince Gaydarzhiev about the company, which specializes in secure facial authentication for physical access control, replacing badging in the workplace with AI-based enrollment and anti-tailgating alerts. The three-year-old startup, which was founded by a team coming from Apple, NVIDIA and Lily Robotics — with venture-backing from JCI Ventures — is currently doing pilots with mid-size and large corporations in Silicon Valley. The company is using AI and machine learning, he pointed out, to simplify the enrollment process and make it as seamless and painless as possible.

I next met with UmboCV, which was featuring its new product, AiCamera, one of the first cameras in the industry with “AI processing on the edge,” said CEO and Co-Founder Shawn Guan, who explained that the company always believed that the best video security experience comes from a perfectly integrated solution of intelligent Internet devices and the cloud, powered by machine learning. He showed me how the company’s new AiBullet camera increases event detection distance while reducing baseline bandwidth usage to a fraction of a typical Internet camera. Guan also showed me how the camera provides 150 feet of daytime and nighttime event detection.

At the ISS booth, Shawn Mather, director of sales, gave me a tour of the booth, demonstrating why the company is one of the leaders in the VMS business, demonstrating how the company’s native, or in-house, analytics help differentiate the company from other VMS providers. On the product side, the company recently introduced its SecurOS v.10 VMS featuring an updated, highly-intuitive GUI designed to accommodate multiple clients and the ability to easily manage large systems with infinite scalability. And while the company creates its own analytics in-house, he pointed out that it also fully integrates with top companies in the industry today, such as Axis, Hanwha, and Bosch.

I next spoke with Tracie Thomas, vice president of marketing for Boon Edam, which demonstrated its integrated entry solutions that mitigate tailgating at ISC West 2019. Integrated with access control and biometric technologies, the company’s security entrances demonstrate “real world” capability to “stop piggybacking and tailgating,” she explained. The company also continues to show how it integrates with other companies to provide a comprehensive solution and experience from the perimeter all the way into the building and key areas within the facility. The company’s focus this year at ISC is to “show end users what the total experience is when you have key partners,” said Thomas. She pointed to key integrations with Stonelock, IrisID and HID Global, as examples of Boon succeeding by partnering.

At the Sielox booth, I met with Karen Evan, president and CEO, who was excited to be celebrating the company’s 40th year and a newly designed website. The Sielox portfolio of layered security systems address the complexity of providing the right combination of features and configurations to best accommodate specific applications and needs. Featured solutions include: the new release of Pinnacle v.10.4 Access Control Solution; Sielox CLASS Crisis Lockdown Alert Status System; AnyWare Browser-Based Access Control Platform; and the company’s highly-touted 1700 Intelligent Controllers.

Off the show floor, I met with Stehapnie Mayes, VP, business development and Greg Alcorn, divisional director – transport and infrastructure, for Synectics, a global leader in the design, integration, control and management of advanced surveillance technology and networked security systems, for environments where security is operationally critical. With over 30 years’ experience, Mayes pointed out that the company has gained an intimate understanding protecting critical infrastructure and assets, including oil and gas, gaming, transport and infrastructure, and high security in public spaces. By integrating systems and bringing relevant data into one platform, or “one pane of glass” as Mayes noted, the company’s technology allows operators to be more efficient and accurate, preventing incidents, as opposed to reacting to them.

Day Four, Friday, April 12

Started the final day with a keynote from Juliette Kayyem, a national leader in America’s homeland security efforts, as part of the SIA Women in Security Forum breakfast event highlighting the group’s efforts since forming last year. SIA’s Women in Security Forum is a group for both women and men that offers programs, professional development opportunities and networking events with the goal of supporting the involvement of women in the security industry.

Kayyem, who is the faculty director of the Homeland Security Project, Harvard's Kennedy School of Government, gave a truly inspiring talk on the major events that have shaped her life and career, including raising a family while trying to create a Homeland Defense program after 9/11. 

In addition to booth visits and covering events, I was able to do many video interviews on all three days of the trade show on the SSN Media Stage on the trade show, which can be found at www.securitysystemsnews.com/videos in the weeks following the show. The following is the list of video interviews I conducted at ISC West:

•    ACRE: Joe Grillo, CEO
•    Arcules: Andreas Pettersson, CEO
•    AvantGuard: Justin Bailey, President
•    Briefcam: Stephanie Weagle, Chief Marketing Officer
•    DICE Corp.: Cliff Dice, CEO and President
•    Dynamark: Hank Groff, Senior VP, Sales and Business Development
•    ESIConvergent: Pierre Bourgeix, President
•    IDIS: Keith Drummond, Senior Director of Sales and Marketing
•    JCI: Eli Gorovici, General Manager, Tyco Access Control and Video Solutions
•    Milestone: Tim Palmquist, VP Americas
•    Mission 500: George Fletcher, founder, and Tom Nolan, director, strategic partnerships
•    Morse Watchmans: Tim Purpura, International Sales Manager, George Lawson, Account Executive
•    National Monitoring Center (NMC): Woodie Andrawos, President
•    OnCam: Scott Brothers, Chief Operating Officer
•    ONVIF: Per Bjorkdahl, Steering Committee chairman and Stuart Rawling, Steering Committee member
•    Pivot3: Brandon Reich, Vice President, Security and IoT
•    Qognify: Marc Whalen, Vice President of Sales
•    Rasilient Systems, Sean Chang, Co-founder, CEO and President
•    SAST: Nikolas Mangold-Takao, VP Product Management
•    USI Insurance Services: Robert Tockarshewsky, Vice President, Property & Casualty
 

Confession: When I was a kid, I ate way too many cheeseburger Happy Meals and played countless hours with Ronald McDonald, that purple lad, Grimace, and the mysterious masked Hamburglar on the old-school playground of yesteryear at McDonalds. 

This trip down memory lane leads me to what “Mickey D’s,” as I affectionally call the fast-food restaurant, is super-sizing on today — machine learning via the acquisition of Dynamic Yield, a Tel Aviv startup that provides algorithmically driven “decision logic” technology. The burger joint will be using this technology to meet and exceed the customer experience with innovation. Here’s how:

We all know the saying “time is money” in this swiftly paced world we live in, so the first deployment of the technology will be in McDonald’s drive thru to speed things up and increase sales. If the drive thru is moving slowly, a digital display could highlight simpler-to-prepare items to speed things up or likewise, when it’s slow highlight more complex-to-prepare, higher-priced food items. While customers grab a French fry out of the bag as they drive off and more fill the drive thru line, algorithms will be noshing on data — weather, time of day, local traffic, nearby events, historical sales data and data from other stores, for example — and then show customers on the display other popular items to prompt potential upsells as they place their order to a voice inside of a box. 

That seems a bit “big brother” in my opinion. I know when I get “hangree,” I’ll order whatever I want, no matter what a digital screen tells me and no matter how long it takes to prepare. But, I digress. 

Beyond the drive-thru, McDonald’s is currently using geofencing around its stores to know when a mobile app customer is approaching and how to prepare their order accordingly. 

The company is toying with the idea of adding the personal touch, turning their mass collection of data into usable information. Think in-store kiosks, mobile order and pay, customers identifying themselves to the store to personalize their hamburger experience, license plate recognition (LPR) that allows the system to identify a specific customer as they approach and adjust the menu based on their specific purchase history, and more. 

Of course, with what sounds like the most glamorous fast-food dining experience ever, I see two major types of risk involved: 

Privacy: The possibility of sensitive data being compromised, like credit card numbers, names, email addresses, phone numbers and real-time location identification is not only real but happens daily, threatening physical and financial safety and security.

Ethical issues: There’s a fine line between personalization and suggestive selling/influencing someone to buy something. While McDonald’s could personalize the experience and perhaps quicken the ordering process by displaying previously ordered items in the form of touchscreen ordering, they could also display only the most expensive items previously bought in an effort to increase sales without the customer being the wiser. 

Digital Yield will remain independently operated, even after the McDonald’s acquisition, and according to Wired, the offer was over $300 million, which makes it the restaurant’s largest purchase since its acquisition of Boston Market in 1999. 

I did the math based on the price of a single Big Mac in the Dallas, Texas area being $3.99. Adding this technology will cost McDonald's approximately 75,187,969 in Big Macs.

What other security risks can you think of related to this technology?