Physical Security
Physical and cyber security: why they belong in one security plan
Cameras, door controllers and alarm panels often share the network with your PCs. This article shows where the gaps between trades lie and how a joint security plan closes them.
Q-entra editorial teamPublished on 6 min read
Contents
- Why physical security is now part of IT
- Which devices count as networked security technology
- Where the gaps between trades arise
- Typical attack paths in practice
- A joint security plan in five building blocks
- Checklist: do physical security and IT work together in your company?
- Conclusion: one plan, clear responsibilities
Key takeaways
- Physical and cyber security belong in one plan because cameras, access control, alarm systems and building automation are networked computers that need the same care as any other IT device.
- Many gaps arise between trades: often nobody is clearly responsible for firmware, network ports, passwords or remote maintenance.
- Attacks can go in both directions: through security devices into the IT network, and through the IT network to doors, cameras and recordings.
- A joint plan rests on five building blocks: inventory, segmentation, clear responsibilities, documentation and monitoring.
- Plan both sides together from the start of a project; fixing things later usually takes more effort and tends to leave more gaps.
Why physical security is now part of IT
Physical security and cyber security belong in one plan because both now run on the same technology. A modern camera, door controller or alarm panel is no longer a closed system with its own wiring, but a device with an IP address, a web interface, an operating system and often an app or cloud connection. Building automation for heating, ventilation, lighting and blinds increasingly runs over the same network as office IT as well.
This means physical security and cyber security can no longer be planned separately. If a camera is poorly secured, it puts the office network at risk. If the IT network is attacked, doors, recordings and alarm messages may be affected too. Protecting only one side leaves the other side open.
Which devices count as networked security technology
- Video surveillance: IP cameras, recorders (NVRs), video management servers and viewing apps.
- Access control: card readers, door controllers, management software, intercoms and barrier controls.
- Alarm systems: control panels with IP or mobile network modules, user apps and the connection to an alarm receiving centre.
- Building automation: controls for heating, ventilation, lighting, blinds and lifts, for example via KNX IP or BACnet/IP.
- Infrastructure: PoE switches, Wi-Fi access points, routers and the cabling that connects everything.
Where the gaps between trades arise
Several companies usually work on one building: the electrician lays the cables, the security installer mounts cameras and readers, an IT provider looks after the network, and the building automation comes from yet another firm. Each of them does their part carefully. The gaps lie in between, in tasks that nobody has explicitly taken on.
| Topic | Typical gap | Clear rule |
|---|---|---|
| Firmware | Installer considers the job done at handover | Named owner, update schedule, end-of-support plan |
| Passwords | Default or shared logins, noted on paper | Personal accounts, password manager, handover record |
| Network | Devices sit in the office network | Own segment with defined firewall rules |
| Remote maintenance | Permanent port forwarding or a separate mobile router | Controlled VPN access, enabled only when needed |
| Documentation | Spread across several firms or missing | One shared device list and network plan |
Typical attack paths in practice
The following scenarios are deliberately simple, because many incidents start in an equally unremarkable way. None of them needs sophisticated tools, only a gap that nobody has noticed.
From the camera into the office network
A camera with a default password can be reached from the internet via port forwarding. Automated scanners find it, and because it sits in the same network as PCs and servers, it becomes the starting point for further attacks. As early as 2016, the Mirai botnet showed how many cameras and recorders can be taken over with nothing more than default passwords.
Through remote access for installers and contractors
For maintenance, the installer of the alarm system or building automation often has permanent access into the building, sometimes through a separate mobile router that bypasses the company firewall. If their login details are stolen, attackers are inside. A widely cited example is an attack on a US retail chain in 2013: according to media reports, the attackers gained their first access using stolen login details of a refrigeration and air-conditioning contractor. That access was not used for remote maintenance but for billing and project management. Any external access is therefore only as secure as the contractor's handling of its login details.
Physical access to the network
An unused but live network socket in the meeting room, an unlocked rack or an outdoor camera with an accessible cable: anyone who plugs in a laptop there may land directly in the internal network. Card readers can be a weak point too. Older 125 kHz proximity cards are easy to copy, and the classic Wiegand connection between reader and controller is unencrypted. Current encrypted card technology and a protected reader connection, for example OSDP with Secure Channel, reduce this risk.
From the IT network to doors and recordings
The opposite direction also happens. If ransomware encrypts the server that runs the video management or access control software, recordings can be lost and permissions can no longer be changed, for example to block a lost card. Security technology is only as available as the IT it runs on.
A joint security plan in five building blocks
A joint plan does not have to be a thick document. What matters is that physical and IT security are considered together and that every task has a named owner.
- Inventory: Record every networked device with location, model, firmware version, IP address, owner and support period. Without this list, nothing else works.
- Segmentation: Separate cameras, access control, alarm and building automation from office IT and from each other. Each system gets its own network segment, and connections between them run only through firewall rules. Our article on VLANs and network segmentation explains how.
- Responsibilities: Define in writing who is responsible for firmware, passwords, network configuration and remote access for each system, including external companies.
- Documentation: Keep network plans, device lists, accounts and firewall rules in one place and update them after every change.
- Monitoring: Watch device availability, tamper alarms, failed logins and unusual connections, for example a camera that suddenly starts contacting the internet.
For the cameras themselves, our guide to securing IP cameras lists ten concrete measures. NIS2 also links the two worlds: the directive requires risk management measures based on an all-hazards approach that explicitly protects the physical environment of IT systems as well. In Austria, it has been transposed by the NISG 2026. Whether your company is covered is explained in our article on NIS2 for SMEs; for your specific situation, legal advice is recommended.
Checklist: do physical security and IT work together in your company?
These questions quickly show where action is needed in your company:
- Is there a complete list of all networked security and building technology devices?
- Are cameras, access control and building automation separated from office IT?
- Is it clear for every system who installs firmware updates and changes passwords?
- How do external companies access the systems remotely, and is this access logged?
- Are unused network sockets disabled, and are racks and recorders locked?
- Would you notice if a camera went offline or contacted an unknown address?
- Do the IT provider and the security installer know each other and coordinate changes?
Conclusion: one plan, clear responsibilities
Physical security and cyber security protect the same company, the same data and often the same network. Planning them together closes the gaps between trades and makes responsibilities visible. Ideally, this starts at the planning stage of a building or system. Q-entra combines video surveillance and other security technology with cyber security, so both sides can be designed and implemented as a single plan.
