IEN: What are the major security concerns facing industry? How can they be addressed?

Thompson: There seems to be no upper limit on what could be spent on security, so one major concern facing our industry is determining a practical, defendable, and cost-effective approach for each unique facility and situation.

Fortunately there is an answer to this problem -- and it doesn't come from a "my product will solve your security problem" approach. Instead, a rigorous threat/vulnerability/risk assessment needs to be performed in advance of prescribing any specific products or technologies. By quantifying the threats and risks to the business, a measured security plan can be put in place that provides appropriate protection to the most vulnerable aspects of business continuity by conserving financial resources where there is less risk. The result is a spending plan that is defendable to financial stakeholders while demonstrating due diligence to employees, customers, and the community.

IEN: Where are strides being made: In risk management? Integrated systems design? Emergency response? Hazard controls? Computer security? Elsewhere?

Thompson: Risk management: For many companies, risk management used to be about insurance coverage. More recently, there has been a trend to a more comprehensive view of risk management -- inclusive of a wide range of potential threats to a facility or business. Security systems are designed from rigorous threat/vulnerability/risk assessments. Fire alarm systems look beyond minimum code compliance. And the time/cost for recovery from a range of incidents is increasingly incorporated into an overall risk management plan.

Integrated system design: Driven by requirements for ease-of-use and efficient operations, integrated security design has become common at three levels.

1. A systems-centric rather than a product-centric approach forces an up-front design of all major security products, services, and procedures working in concert.


2. A single-seat user interface allows an operator to monitor and command security features from a variety of systems in a multi-vendor environment.


3. Inter-process communication allows for coordinated security applications across a broad range of disparate systems, from access control to video management and fire alarm.

Emergency response: Emergency response has graduated from "building evacuation plans" to a set of "best practices" training and drills for a wide set of emergencies ranging from natural disasters to workplace violence. The Incident Command Structure (ICS) is becoming a widely adopted method to organize responsibilities with a standardized approach so that building occupants, company management, and first responders can effectively coordinate under the pressures of an emergency situation. Increasingly, these emergency plans and training modules are migrating from three-ring binders to interactive websites with audited training schedules. And, in many cases, command and control is being centralized with offsite backup -- requiring safety and security systems to be flexible enough to work in concert at one or more Emergency Operations Centers (EOC).

Hazard controls: The U.S. Congress and Department of Homeland Security have been active in debating the need for updated and tighter regulations controlling the security of facilities containing hazardous materials. However, more progress has actually come from industry initiatives and voluntary compliance to draft regulations. This has driven the market for new security technologies and new uses for older technologies. There has been a focus on tracking of hazardous materials, auditable restricted access, and improved ways to communicate emergency information to the right people quickly.

IEN: What innovations are in store for users in security equipment and systems, software, training, and other areas?

Thompson: Rapid innovations in security technologies have, in some cases, added new complexity for users. As a result, much of the development moving forward is targeted at simplification, ease of use, and user productivity. Some of these improvements will be visible enhancements to the user interface, while many others will be "under the hood" -- improving the way disparate systems interact and coordinate common applications.

IEN: Where are other R & D hot spots?

Thompson: Three areas of basic and developmental research have heated up in recent years:

• The first is the movement from analog to digital video technology. Improving compression algorithms, transmission methods, and video analysis applications are changing both the cost structures and functionality of traditional surveillance.


• A second hotbed relates to remote tracking and identification. RFID and other newer technologies are beginning to improve and find expanded applications.


• And the third major area of R & D spending is driven, for the most part, by federal government requirements to find an effective method to identify and mitigate against chemical, biological, and radiological threats.

IEN: Is the web a significant factor? Why or why not?

Thompson: Much of security is about getting the right information to the right people at the right time. The World Wide Web has driven expectations regarding the nature and availability of security data to authorized users wherever they happen to be physically located. Furthermore, advances in personal electronics and wireless technologies are "untethering" security professionals from their traditional security consoles.

IEN: Will wireless technology play an increasing role in security? If so, how?

Thompson: Wireless technology affects security in three principal ways:

• First, an enhanced wireless infrastructure provides for improved access and reliability -- including the use of emergency radios when other systems may have been compromised.


• Second, wireless security devices allow for installation in areas that may have been impractical or cost-prohibited using the traditional hard-wired approach.


• And finally, wireless technologies serve to "untether" security professionals from 24x7 monitoring of security command stations.

IEN: How can companies integrate security technologies within the industrial enterprise?

Thompson: Special needs of the industrial enterprise demand special security applications. There is a heightened need to provide auditable records of access control, events and alarms, asset tracking, visitor management, and specialized logic rules for authorized access to hazardous areas. Not only does a security system need to protect people and property in an industrial enterprise, it needs to show auditable evidence that it is doing so. And while these records can be maintained manually for each independent security-related system, the labor costs of doing so can be prohibitive. Integration technology, coupled with the latest advances in digital signatures and protected records retention, can lower the cost of compliance through automation.