Cybersecurity and Information Security for Physical Security Systems
This domain tests the PACS as a networked OT and IoT system. Expect questions on default credentials, network segmentation, encryption, patching, remote access, logging, supply-chain risk, and the physical security of controllers and servers.
Core controls
- Inventory every PACS device, firmware version, and owner.
- Change default passwords and use unique accounts with least privilege and multifactor authentication for administrators.
- Segment cameras, readers, controllers, and servers on dedicated VLANs with firewall rules limiting traffic.
- Encrypt management traffic with TLS and use OSDP Secure Channel where supported; do not treat Wiegand as secure.
- Patch firmware and software on a risk-based schedule, testing before deployment.
- Restrict and log vendor remote access; disable it when not in use.
- Back up configurations and databases, protect backups, and test restoration.
- Monitor logs for failed logins, configuration changes, door forced events, and unusual badge activity.
Worked example
A vendor requests permanent remote access to a PACS server. The security team instead requires a support account with multifactor authentication, a time-limited session, an approved change ticket, and logging to the SIEM. The vendor connects through a jump host; firewall rules allow only the management protocol. After the session, access is disabled and the log is reviewed. The reasoning is least privilege and accountability, not trust in the vendor relationship.
Traps
Do not assume an 'air-gapped' system is secure. Do not leave default passwords or shared administrator accounts. Do not expose PACS web interfaces directly to the internet. Do not forget physical tampering, USB ports, and unpatched legacy operating systems.