Securing Remote Sites. September 23, 2015

Transcription

1 Securing Remote Sites September 23, 2015

2 Special Guests Bob Force Vice chair, AFPM Security Council Director, Corporate Security, Tesoro Bill Gillespie Security Manager PACS Program, Shell Oil Company John Romanowich CEO, Sightlogix Adam Shane Senior Systems Design Architect, AMAG Technology

3 Challenges Access Control Offsite/Remote Secure Areas Remote Pipeline Assets Contingency Response Events Live Feed vs Docking Surveillance Remote Areas Without Power Lack of Network Availability

4 PHYSICAL ACCESS CONTROL SYSTEMS An Enterprise wide approach towards integration of security applications Security Industry Association (SIA) webinar 23 September 2015 William Gillespie Program Security Manager - PACS Program Copyright of Shell Oil Company

5 WHAT IS THE PACS UPGRADE PROGRAMME? The Physical Access Control System (PACS) Upgrade Programme is a global initiative made up of five main elements: STANDARDISED ACCESS CONTROL SYSTEM CARD READERS CARD PROCESS ID CARDS IDENTITIES Copyright of Shell Oil Company 5

6 BUSINESS VALUE SUMMARY The benefits of a global integrated approach to Physical Access Control is based on the strategic aspiration of having a consistent application for improved security, improved overall control, and doing so in a cost conscious manner with a reduced total cost of ownership. SECURITY CONTROL TOTAL COST OF OWNERSHIP Copyright of Shell Oil Company 6

7 DEPLOYMENT STRATEGY The deployment is targeted to cover 80% of the people who use cards for accessing locations. To achieve this, the approach will be to deploy in the following manner: Site prioritized baseline, set by: 1. Threat Materiality at each site; 2. Security Risk Assessments; 3. Technology upgrade. New and refurbished office locations Further fine tuning of the deployment list is expected to be continuous with current emphasis to also address Main Hub Locations Real Estate managed sites Site requests for global solution Copyright of Shell Oil Company 7

8 BENEFITS DETAILS (1 OF 4) - IMPROVED SECURITY Secure the entire path from Card to Server: Skimming and cloning of cards is prevented through use of proven new encryption technology (EV-1) that controls secure communication between card and reader; ensuring card reader only works when card is held small distance away. From the reader to the panel housed in a secure area. Communications across the network between the server and the panel is encrypted. With Global Policy & Procedures for Provisioning Access Cards, it is possible to account for each and every Access Card issued in the new Physical Access Control System. For particularly sensitive areas, two factor authentication mechanisms (PIN or biometric) can be used. A PIN reader solution is already available from the vendor. Copyright of Shell Oil Company 8

9 BENEFITS DETAILS (2 OF 4) - INCREASED CONTROL Improved Control from a single Global Solution that is easier to manage: Single system with global control of access/revocation Standard high-quality approach and installation of a standardized ACS and associated infrastructure All sites will be on the same version of software and upgrades and enhancements can be deployed in a consistent controlled manner One location for the business to make requests and find information about the ACS (Access Control System) Build and support a single interface with other security systems, such as video surveillance systems, intrusion detection systems and panic alarms. Strategic supplier partner Standardised card ordering and provisioning process Copyright of Shell Oil Company 9

10 BENEFITS DETAILS (3 OF 4) - INCREASED CONTROL Improved Control through compliancy to Security Policy: Reducing the possibility of fines for non-compliance. Possibility to tailor to meet specific company requirements in different lines of business and locations for greater efficiencies. The understanding of these requirements will enable us to allow step outs to procedures when required by business needs or emergencies. Support the Transportation Worker Identity Credential (TWIC) mandated by the Transportation Security Administration for US Sites. Improved Control through Reporting & Analysis: A single access control system will streamline the reporting and analysis of security related alarms and events, facility space utilisation and attendance, and the ability to interface with the various time & attendance, facility management and building automation applications. Ability to build specialised reports. Make monitoring easier for sites by centralized or regional monitoring implementations. Copyright of Shell Oil Company 10

11 BENEFITS DETAILS (3 OF 4) COST CONSIOUS For the Company, there is advantage of anticipated reductions in Total Cost of Ownership (TCO): Hardware & Software Standardizing the access control system and negotiating an enterprise license has provided software discounts and hardware discounts. Cards Changing the card technology will provide a savings per card. Provisioning - Improving control and centralized purchasing of card, is expected to reduce the waste of costs from reissuing cards. Support Standardization of the software and hardware, along with a global support contract will provides yearly decrease in both overall cost and annual maintenance costs. Transparency Increased overview of spend which allows reduced cost and improved prioritisation of spend to areas of most risk or highest return. Copyright of Shell Oil Company 11

12 Smart Video Security for Remote Sites September 23, 2015

13 Surveillance or Security? Video Surveillance Guards watching monitors while the system records Video Security Automatically detecting intruders in real-time

14 Reducing Infrastructure Costs New solutions cover 4 times the area

15 Detect and Assess Intrusions

16 Solar Powered Remote Outdoor Burglar Alarm

17 Video-Verified Alarms Instant Situational Awareness

18 Who Uses These Solutions Today Bridges Data Centers DoD/Gov t Facilities Memorials Rail Airports Chemical Utilities Refineries Ports Corrections Nuclear

19 Making Outdoor Video Smarter Thank You John Romanowich President & CEO, SightLogix

20 Physical Security For Remote Sites Adam Shane Sr. Systems Design Architect AMAG Technology September 23, 2015

21 Remote Site Challenges Atypical Environment Risks Traditional Requirements Limited Connectivity Theft Physical Security Protection Large Perimeter Vandalism Authorized Access Valuable Assets Terrorism Alarm Monitoring Critical Infrastructure Accident Forensic Video Review

22 Communications Cellular or Dial-up coverage may not exist Sat coverage may be low bandwidth, high latency

23 Operational Issues Centralized access control needs to update remote controller Configuration Card access (add, modify, delete) Stand alone access control system Fixed population Remote controller needs to communicate alarms Video requires too much bandwidth Significant operational costs

24 Solutions Intelligent controllers All decision making at the node Automation based on local alarm sensors, time, etc. Low bandwidth utilization Card updates Configuration Local NVR Store high resolution, high frame rate video locally Dynamic Resolution Scaling Dynamic Video Decoding Dynamic Frame Throttling

25 NERC CIP, CFATS, and HSPD-12 Cybersecurity protections specified in NERC CIP through V5 are basic HSPD-12 and Federal Government FIPS 201 require high levels of identity assurance for logical and physical access Federated Identity Services and PKI-based authentication require network access, smart cards more expenditure and infrastructure

26 Questions?

27 Presenter Contact Information: Jake Parker Director of Government Relations, Security Industry Association Bob Force Director, Corporate Security, Tesoro Bill Gillespie Security Manager-PACS Program, Shell Oil Company John Romanowich President &CEO, SightLogix Adam Shane Sr. Systems Design Architect, AMAG Technology