Security Systems - Cloud or no Cloud?

It's hard to believe that just a few short years ago, cloud technology was something of a novelty. These days, it's becoming increasingly normal for security systems to make use of cloud-based technologies. There are a number of reasons for this. First, cloud-based systems are more scalable and flexible than traditional security systems. This means that they can be easily adapted to the changing needs of businesses. Second, cloud-based systems are often more cost-effective than their traditional counterparts. This is because they make use of shared resources and don't require businesses to invest in their own infrastructure. Finally, cloud-based security systems are often more innovative than their traditional counterparts. This is because they offer businesses the opportunity to take advantage of the latest developments in artificial intelligence and machine learning. As a result, it's no surprise that cloud-based security systems are becoming increasingly popular among businesses of all sizes.

In this 4 part post we'll be looking at:

1. What is cloud-based security and how does it compare to traditional security systems?
2. Pros and cons of using a cloud-based security system?
3. How secure are cloud-based security systems, and are they safe from cyber-attacks?
4. Which type of security system is best for your application - cloud or no cloud?

1. What is cloud-based security and how does it compare to traditional security systems

In a world where more and more businesses are moving their operations online, the question of security is becoming increasingly important. While selection of the best system for your specific requirements is a key consideration, many businesses are now looking for systems that offer both security and accessibility. So how do cloud based systems differ from traditional "hardware based" systems. Put simply, a traditional system is installed onsite at a fixed up-front cost. A cloud system comprises of site “devices” connected to a web based network and is “rented” for a monthly/yearly cost.

The difference between cloud based systems and hardware based systems comes down to the way they are accessed and setup.

Traditional "Hardware based" systems

A traditional system is comprised of a set of core hardware products that work together to make up a system. For example a CCTV system typically consists of CCTV cameras, a recording device (either an appliance or a dedicated Server Computer) and some form of network to set it up on. Many traditional systems can be connected to the internet via configurations on the recording device and the network, or a newer technology called "P2P" which essentially sets up the internet connection for you. Traditional alarm, intercom and access systems are often a mix of non-connected devices that are physically wired to a "controller". This controller sometimes acts as a gateway to the internet, allowing access via remote devices and computers - in a sense, adding a connected controller to a traditional system makes it the lowest level of cloud system.

"Cloud based" systems

Cloud based systems offer many (if not more) of the features that traditional systems offer, with a different architecture. These range from traditional systems with an internet connected controller right through to fully connected IP systems that connect directly to the internet. Referring to a security system as a cloud based system means that not only is it accessible via the internet, but that some, many or all of the features offered by the system are delivered via the internet. For example, a traditional CCTV system might allow access to recorded footage via a mobile phone app. The app connects to your recording device and retrieves footage stored on hard drives physically installed in the traditional recording device. A fully cloud connected system may not require an app allowing you to simply logon to a website to view cameras and footage.
Some cloud based systems work 100% on the cloud, meaning that all features and functions are available only via an internet connection (more detail in the pros and cons section).

So with the basic differences between the technologies understood, let's look at the advantages and disadvantages of the cloud based system.

2. Pros and cons of using a cloud-based security system

Flexibility

One of the biggest advantages of cloud-based security is its flexibility. CCTV, alarms, intercoms, and access control systems can often all be easily integrated into a single system, allowing you to tailor your security setup to your specific needs. For example, many cloud based CCTV systems can talk to Access Control allowing cameras to be refocussed on a particular door every time a person of interest uses their access card there. We can also use cameras to detect number plates and open boom gates in parking scenarios, allowing for automated billing and access based on registered cars. Features and functions can be added and removed as needed, often allowing for significant advantages when deploying systems over time. Often, cloud based systems provide for trial periods to test out basic functionality, and allow addition of extra features - many times at just the click of a button.
Because cloud systems often have no "controller", there is no system bottleneck. This means that a cloud based system can be much larger than a traditional system, and can be spread over multiple remote sites with relative ease.

So the disadvantages - there really is no disadvantage to any of the above when it comes to flexibility. The cloud system delivers significant flexibility over and above that of a traditional system

Accessibility

One of the greatest challenges facing security management today is the balance between security and accessibility. Generally, these two aspects of the system have been polar opposites of a sliding scale, more secure means less accessible and vice versa. Today's systems have made great strides in this area; but there is still a compromise when it comes to cloud availability.

Due to the fully connected nature of cloud based systems there is an inherent ability to access your system at any time and from anywhere in the world. This makes it easy to keep an eye on your business even when you're away.
For example, today's CCTV systems allow a user to access video footage instantly from anywhere you have an internet connection. Combined with a feature called the "smart search" this can greatly speed up the process of finding footage of an incident and making an informed decision on how to respond. New users can often be added remotely, giving a system admin the ability to work remotely as required whilst minimising the interruption to their workflow.
Many higher-end integrators will also offer “law enforcement access”, which means remote access can be granted to law enforcement temporarily to allow them to review and save footage. Again minimising the work required for footage review.

Another advantage of this extended accessibility is the ability to share data across multiple sites and/or stakeholders. For instance, businesses with multiple sites to protect no longer need to install separate systems when their security is cloud connected. They can simply connect all devices to the internet and then manage them centrally via a web portal, allowing access to building areas (doors, lifts, boom gates etc) as needed across all sites.

Accessibility can also have advantages when it comes to decisions on alarm responses. For instance, with traditional systems an alarm signal being sent to a control room was somewhat of a gamble. Was there a real intruder onsite, did a bird fly into the warehouse, was there a warm breeze or a reflection from the sun setting of movement detectors? Do you attend site yourself and risk a physical confrontation?, or do you despatch a security patrol? - incurring large costs every time this happens. Now we can perform "video verification", which means we can pull up video of the premises to visually confirm the alarm. This can save thousands of dollars a year in costs and, more importantly, help to keep people safe by giving a more accurate assessment of the risk level onsite.

Along with accessibility though comes a level of risk. The internet is not a private space, it is a public space and therefore carries a lot of the risks associated with putting sensitive data on a public network. Connected systems can be vulnerable to attack from hackers, disgruntled ex-employees, 3rd party attackers and many more. Does this mean that cloud systems should be avoided? Not at all........as with all risks, we weigh up the advantages against the risks and make a decision from there.
A good integrator will always have the skills to secure your network to minimise the ability for a 3rd party to gain unauthorised access. In particular, many devices when connected to the internet use a protocol called "P2P". This essentially involves the device calling a server on the internet, reporting it's details in and then establishing a secured (encrypted) connection. The device will then refuse to talk to any other devices that care not similarly registered with the same service, allowing for internet connectivity; but with a private connection. Many of these cloud services use military grade encryption which makes it very difficult to gain access.

An often overlooked disadvantage to some cloud services is the need for an internet connection. Many cloud based systems will use a hybrid combination of cloud based functionality and local functions. This means that some tasks happen on the internet, and some happen on the device. Typically, critical functions are best performed locally. For example, a fire/evacuation system that relied on the internet to open door or turn on sprinkler systems would not be a very safe product. Similarly, a CCTV system that relied on the internet to store footage could represent a major security risk in that if the internet was lost, there would be no footage in the event of a break-in or other incident.

Cost Effectiveness

Cloud-based security systems can be significantly more cost effective than their traditional counterparts. This is because of a few reasons:

They often require less hardware – Cloud systems typically require less physical hardware in the background as they are able to offer features and services via the internet. A good example is storage. Traditional CCTV uses either a small recorder onsite (NVR) or a PC with multiple hard drives attached. This means expensive, bulky, power hungry hardware that must be paid for in advance and can break down (introducing extra cost) at times. Many cloud based systems record footage to the cloud or to an SD card on the camera, therefore reducing the need for hardware to manage the process.
Cloud systems often require significantly less install and configuration, hence they can reduce initial outlay even when paying upfront.

Features can be added and removed as desired – One of the most significant advantages of cloud based systems is the ability to add and remove from the system without any physical changes. Many cloud based systems allow the user to choose from a suite of “features” that can be added to the system as needed. This gives the freedom to decide if a feature is worth paying for or not. This also means that new features or functions can be added as they are introduced to the product. Allowing the user to upgrade their system to allow more features without physical changes in many cases. Often, cloud based systems can incorporate retail analytics, information systems and other useful services that allow a return on the system itself. Drastically increasing the cost effectiveness and even providing return on investment

Services can be customised to your business – Most higher-end installers are able to overlay valuable and useful services that can be delivered remotely with cloud based systems. Maintenance agreements can be inclusive of monitoring, maintenance, footage retrieval, analytics such as face recognition, number plate recognition, smart clothing based searches etc for a much smaller monthly fee, saving thousands of dollars in upfront costs. Many of these services are bespoke functions that can be deployed after deep collaboration between the installer and the business owner/user.

The difference in system ownership is the main consideration here as cloud systems are often subscription based. This means the system is effectively being rented over a period of time. Although not strictly a “con”, it is important to understand this difference and the way it affects overall cost.

3. How secure are cloud-based security systems, and are they safe from cyber attacks

This is somewhat of a “how long is a piece of string” type of question. The short answer is that cloud based systems are as secure as the network environment they are on. It is important to remember that most traditional systems have some form of internet connection today, so the risk profile difference between the systems is not as large as you may initially think.

Most of the same considerations exist surrounding security of Data, management of access, retention practices, and legal compliance among many others. The main contributor towards the security of a cloud based service is a secure connection. As mentioned above, a well secured system will involve a dedicated connection between the device onsite and a secure server. This connection or (pipe) will act like a barrier; both concealing and protecting visibility of data you send across the internet. This is done by a process known as encryption.

Although many cloud security manufacturers will build strong cyber-security features into their products, many rely on integrators, IT departments and end users to secure the network themselves. For this reason it is important that your installer is well versed in securing networks from 3^rd party attackers. Quality integrators should now have specialist IT security professionals as part of their offering. They should be capable of applying cyber-security best practice principles when deploying your system. For this reason it is imperative that an installer be able to explain clearly how they will secure your system.

4. Which type of security system is best for your application - cloud or no cloud

The answer to this question depends on what you want out of your system vs how you want to manage the costs.

As previously mentioned, a cloud based system offers unique features that are often interchangeable and customisable. For example if you are trying to identify specific persons of interest and want a warning when they are on-site you have 2 options. Either pay upfront for a camera that is capable of performing facial recognition internally with the required hardware, or add the functionality to your cloud service as part of your subscription. Often cloud based services can add functionality to existing cameras, eliminating the need for an expensive new camera. Perhaps you are looking for license plate recognition for a parking/boom gate application. Local “LPR” cameras can be purchased for this application, which are usually significantly more expensive than standard cameras. Alternately, some cloud offerings can use existing cameras (dependent on the camera specifications). The license image is sent to a cloud server and processed online, with the results sent back to the software for viewing, or to grant access to a boom gate/door etc onsite. Looking at it from this perspective, the choice comes down to whether you see your system as an investment to be owned or a business tool to simply have access to as needed.

One new development in the area of cloud security is the emerging analytics “Appstore”. Increasingly the various features, functions such as analytics (movement detection, face recognition, retail heat mapping etc) are moving towards an “app ecosystem” approach. This means that analytics can be purchased off the shelf and applied to existing compatible cameras. This app approach allows for outright purchase of analytics or subscription access, depending on how you like to approach the investment of a new security system.

Finally, a feature that is almost specifically unique to cloud based services is the ability for many of these products to be deployed on an existing network in a “demo capacity”. Allowing you to try the system before making a decision to ensure the best fit for your business. Traditional systems typically make this service a lot harder for both integrator and customer due to the significant time and labour investment incurred by the integrator to set the system up. Most integrators will want a fee for the demo and/or a significant purchase commitment for a demo. Traditionally this has made this service something that has been available only to large enterprise customers that have the funds for testing and development built in to procurement. Now even smaller customers have the option to engage with their supplier to arrange demo periods with far less risk to the integrator. 1 – 2 points of protection can now be added to a site to test functionality, features, useability and security on the network – this is a significant advantage to cloud based systems, and one that should be very high on your list of selection criterion for your new system and security provider.

Finally, one last point to note is the intrusiveness of install. Traditional systems require teams of installers onsite to physically install devices, networking, computers, servers, storage and a host of other components. Typically cloud systems require much less “time on site” with a lot of configuration possible remotely due to a lot of the backend systems being owned and managed by a third party. This can lead to a shorter and less intrusive install period.

Wrapping it all up

So as you can see from the above, cloud based systems offer a significant amount of flexibility, access and functionality. They offer flexible payment, scalability and opportunities to try before you buy in many cases. Traditional systems provide a more secure environment out of the box; but much of this is mitigated as soon as you connect them to the internet. Traditional systems offer local operation that generally does not need internet to function, while cloud systems offer a range of internet reliant features combined with local functions.

Hopefully this has given you some checkpoints to mark off next time you are considering the question of Cloud vs Traditional security systems on your site.

All the best!!

Kind Regards,

Adam Walsh
General Manager

Brave Security
9 Hall Street, Port Melbourne VIC 3207
13.000.THEFT (1300-084-338)
0423 456 472
www.bravesecurity.com.au