The role of the systems integrator is again being reinvented and now includes cyber defense as an essential service. Cameras, access control and the internet of things (IoT) are all connected, with new devices readily added to the network. Users are scaling artificial intelligence (A.I.) and analytics company-wide in an effort to make proactive security and safety decisions while gathering data for business operations. This open environment, however, requires systems integrators to apply strategic hardening for effective, secure deployment. 

A.I. is a double-edged sword. While it assists in identifying risks and actors with ill intent, it also broadens the attack surface. It is increasingly embedded in operational technologies and industrial applications, and it can be used to gain access to devices on the network, including surveillance cameras, control panels, sensors, detectors and more. 

Experts agree that keeping solutions current with the latest software and firmware is a primary strategy in securing systems. Cybercriminals exploit known security flaws in outdated software, according to the National Cybersecurity Alliance, which recommends enabling automatic updates whenever possible to ensure operating systems, applications, plugins and drivers are always up to date. 

Hardening for system integrity

Automating system updates is central to reducing risk, especially in large-scale facilities. All installed equipment needs to be documented in an asset inventory compilation with clear hardening guidelines. Vetting vendors requires due diligence, as many manufacturers claim the highest cybersecurity postures, making assessments more complex when apples-to-apples comparisons don’t exist. Systems integrators are required to be trusted cybersecurity advisers, responsible for training and educating clients on best practices, providing documentation and certifications on equipment, and offering recurring maintenance plans that include security assessments and managed patching services.

For organizations with connected cameras, access control systems, servers and cloud services, weak or poorly governed credentials can expose sensitive operations and create new pathways into organizations, according to Mathieu Chevalier, principal security architect and manager for Genetec Inc., Montreal. 

“This includes the passwords used to connect directly to devices themselves, which are often overlooked but provide a direct entry point if not properly managed. In this environment, periodic password changes or basic cyber hygiene is no longer sufficient,” he said.

Chevalier advised organizations to manage the physical security infrastructure with the same rigor as mission-critical systems. That means regular access reviews, controlled updates and partnerships with trusted technology partners who support long-term security, transparency and operational resilience. 

Patching takes precedence

Patching and updating systems is the No. 1 defense, Chevalier said. “A customer with thousands of connections requires an automated, risk-based patching strategy. The cloud is one of the strongest ways to harden systems and improve the security posture across multiple systems.” 

Service-level objectives (SLOs) that define patching timelines based on risk, ease of exploitation and consequences can help prioritize updates. 

“Ideally, before you deploy the system, you have an automated patching strategy in place based on SLO,” Chevalier said. “When a critical vulnerability is identified, for example, you set an SLO to fix it within 30 days and the patch needs to be completed in that time frame. Something with a low vulnerability might have six months to address, because the impact or the potential ease of exploitation is reduced.” 

Systems integrators must verify the cyber controls designed into the systems they purchase, requiring vendors to provide penetration tests and proof of accreditations such as SOC 2 Type 2, (a detailed audit report, not just a certificate) and adherence to ISO/IEC 27001 standard for information security management systems.

Chevalier said every connected device in a loT “chain” must be considered when applying patches, something that’s often overlooked. 

“Think about access control. You have your cloud server talking to something on-­premises, and then usually you have a controller and a door reader,” he said. “All those things have firmware, which might contain vulnerabilities. You need to think about the whole chain, not just one component.” 

For older systems, patching may not be possible, he said, adding that, “In those scenarios, you try to isolate those components. For example, cameras that aren’t within budget currently to be upgraded but need to be restricted on what they can do and what devices can talk to them.”

Optimizing security solutions means applying proper controls to harden systems from potential takeover, attack or compromised use. These strategies translate into new service areas, including cybersecurity patching, maintenance/updates and ongoing execution. Integrators turn into cyber defenders in a connected world. 

stock.adobe.com/putilov_denis