Industry sign banking hawaii word secure
[Music] think take away civil engagement lives here hey Aloha and welcome to the think Tek Hawaii studios this is another episode of security matters Hawaii and we've got Matt Barnett here with us today the actually he's remote today but we've got him on the show he's the president of mercury security a access control system hardware manufacturer and we're going to talk kind of about the state of the industry Matt I really appreciate you joining us today I know you're a busy guy always on the road so we're we got you somewhere to sit for 30 minutes and talk with us well thank you for inviting me Andrew this is great no worries hey yeah I like to start off and just take the security folks that I get and kind of ask them you know from a security perspective what keeps you up at night lately and it's a fun question that it asked luckily I'm a heavy sleeper but and we will look at what's going on in the industry obviously the the word lately is all about cyber security and rightfully so so it's what long overdue and I know you've been you've been a proponent of this conversation for a long time as well as bill Bozeman at PSA and you know it certainly has been in the news least recently in this industry and in general so that you know I never want to be the name that's in the press when it comes to having an issue with cybersecurity so we're spending an inordinate amount of time and effort to make sure that our products and our customers that use our products are protected yeah now one that we're definitely gonna get into a little bit of SIA and OSTP and all the work you folks have done there I know yeah this week interesting that you know I have to know we had scheduled this we saw you know there's a lot of talk about that research that was done at Google which I think to some of us on the inside the industry was kind of old news but it sort of got rehire Johnson we've got around encryption is something that you know if you dig deep enough into into products you can find problems and I I know Mercury's done a whole lot to get us from sort of the legacy place that we were and to adopt these new the new OS DP standard I wanted to talk briefly and kind of start back with that legacy stuff so you could get a chance to give us your history you know I came from the days of all serial communications and I remember we had LAN tronics modules that got us onto the network and from there we kind of went berserk what what you know from your perspective on the history of the industry did it take too long kind of give us your you know where it went how it went along and you know what you experienced along the way yeah so I've got hard - hard to believe 27 years in in physical security electronic security starting on the integrator side of the business so understanding what you and the others in the industry and the integration side have to deal with and really for the last 18 19 years being on the manufacturer side of the business so it really got to see it from from both sides which i think is helpful in my position to understand you know what the what the channel to market has to deal with when they're you know installing and maintaining these products but certainly as you said going back to the old hardwired copper days and then modems and it's it's kind of crazy to think that in a lot of ways that's probably more secure than what a lot of systems have today being connected on an IP network mmm because point good point you know you know having having the dedicated copper connecting these points was a closed system loop and as the industry progressed in using the available backbone and most companies using their IP network it just made a lot of sense to tie these devices on to that network because it allows you so much more flexibility but it also now opens up a lot of you know potential doors to external threats and so I think we as an industry have been probably a little late to the market on how to not only provide products that are hardened against these potential threats but there's a lot of Education that has to go along with that as well to make sure that the products are being installed in the appropriate manner and I think there's still a ton of work that needs to go so manufacturers like Mercury and our parent company HID can have the most robust feature sets in the world when it comes to cyber security encryption OS DP and others but they a lot of times have to be configured and enabled in the field right and that's that is a potential missing link right now that that we really need to do a better job on yeah I gave talk last week with the Armed Forces communication electronics Association and I shall we share people processes and products as the the vulnerability I was talking about sort of our industry as a as a supply chain threat and it's interesting when I shared with them some is just just some just in maps or some devices and some taking a look at some of the certificates on the devices and point out some of the flaws it's a funny that these these guys are all kind of in charge of security networks senior networks military networks and they were surprised at the low level of a configuration that a lot of people in our industry do and that's you know that's a training thing as you pointed out it's it's funny I I don't talk to many integrators and you know we have a large body of them through PSA that are really proactive you know what's your what's your feeling about getting from sort of legacy into this modern idea of encrypting these networks and creeping these communications you know you travel quite a bit I'm what do you what are you seeing there's definitely momentum building in the marketplace I think as IT has gotten more involved in the security in different companies around the world certainly they're looking at the devices that are on their networks and and coming to the realization that they have problems that they're going to have to solve by upgrades and in a lot of cases you know it's really not an upgrade it's really a forklift replacement so you know it's happening but it's not happening at the speed you might you know you might think the reality is in our sector of the business and access control you know these products are installed and customers expect them to be installed for 10 15 20 years and without a lot of you know not a lot of fiddling around with them so to speak so you know there's a bit of a legacy mindset that you know these things don't have to be touched once they've been put you know in a building controlling the access or even video being installed you know even going back and doing firmware upgrades in a lot of cases just doesn't happen so there's there's a lot to be done there there is there is definitely some momentum and we're getting you know customers that are that are talking to us directly about what they should be doing going forward but it's you know budgets are what they are and this is sometimes a hard one to get through yeah I I tend to talk about I still believe that ninety percent maybe more of the of the access control systems that are out there are still running you know wagon they're using legacy hardware that cannot support the newer protocol so it's got to be forklift it I think I think the 125k procs car may still be ninety percent in use out there does that do you think in North America that's a reasonable statement absolutely I think what I would say currently that maybe one to two percent of the card readers installed in North America are OS DP Wow it's you know gaining momentum but you know that spec was released ten years ago now so it's not new we've mercury has had OS DP on the panel for ten years but you know it's really been in the last couple of years now that we start to see a momentum building people saying we only want to go now OS DP so you know we'll be testing the waters we released a panel recently that doesn't have Wiegand it only has OS DP reader connections on it and we'll see if the market is really going to be accepting of that because if that product doesn't sell well then we'll know how serious is the market about having secure protocol down to the reader level mm-hmm does it do you feel it he says customers are coming to direct do you feel it's its enterprise are they no DoD's concerned obviously right so I'm getting or getting questions out of those guys and they have our taxpayer dollars so it's not like a bottomless pit but you know they they tend to move in these directions they have more regulatory guidance but I'm getting questions in health care I'm getting questions from my financial sector and in critical infrastructure but are you seeing commercial enterprise so they can sir nor they how many guys are they looking for solutions the vertical as you mentioned are really the ones that are kind of the bullseye here that are that are progressive about this certainly some of the you know fortune 100 you know they're they're also the ones that are going to kind of push this along and if they see the vulnerability and they know base to some of the other news stories that have been out there they don't want to be the ones that that have a problem because they had systems on their network that weren't that weren't encrypted so they tend to be the ones out in the forefront we're you know you know I don't think we're gonna see you know 80% of the market is 16 card readers or less those are not going to be the companies that are going to be looking for perhaps the most cyber secure systems available they just want to have something if anything installed but the the enterprise accounts are the ones that are going to push this as well as the critical infrastructure and government as you said yeah I have I talk a lot about the the supply chains out here obviously in the DoD's kind of I think at the forefront of asking for more robust protection from its supply chain not only for the data that maybe government data they're handling but that extends to the physical perimeter of those facilities you know as we need cyber security we need physical security kind of combined do you think it's going to take that or do you think I mean do you think the industry will heal itself even for those small guys or do you think it's going to take sort of a more of a regulatory push to get this commercial sector or active in upgrading or replacing these of these products well again I think some of the bigger commercial sector is going to move but you know we end up building products for those companies and then it you know the feature sets go downstream from there and so it's not like we're gonna have one product for the low end of the market that doesn't have those I would say if you're releasing a product today that's not cyber secure then you may not be in business and so for five years go back to the drawing going aware yeah so you know we're building it into the product and if it's used in an enterprise or if it's used in a small office with two card readers they have the feature sets on board to make it work now whether again they're turned on or not is it'd be you know based on the end user and the integrator installing it yeah so I know there's a big that we have a specifier show coming over a clone show pretty soon do you think we need to or do you think manufacturers will push some of this education out I mean I remember talking with axis how they they've had 802 1 X embedded in the product forever and they said no one uses it so I'm kind of wondering if you know if you're providing it and the integrator community's not configuring it because the customer doesn't know how to ask for it how much of an issue do you think that is I mean you know it's it's problematic to my to my way of thinking is a big issue and we had a roundtable at our last consultant event and it was only supposed to be 30 minutes and we went well over an hour just talking about this one topic it we never got off this question the you know can we build these features in and I think consultants have done a good job but there's more work to be done and making sure that any system that's going to be bid on a project that they're writing a spec for needs to have these features in them or they shouldn't be allowed to be a participate and that's the only way to get really the the manufacturers to make sure that they're building products with these protocols and these encryption technologies built-in and then again the consultant and the end-users are going to have to hold the integrators responsible to make sure that they're being enabled and turned on so you know it's been an issue that we found we had encryption between panel and panel and it was an option you had to turn it on in the in the feature set and we found that doing some survey work of end users that nine times out of ten it wasn't enabled so our latest generation we just turned it on by default and if for some reason they want to turn it off they have to go in and manually do it so again I think it manufacturers we need to build products that are you know maybe easier to configure and install and turn these things on and you really have to go out of your way to turn them off so almost you know making it harder to defeat if you will yeah secure by default I love it I think I think in a lot of cases we need that sort of help tell you what we got to take up we have to pay some bills so we'll take about a woman a break for commercial time and then we'll be right back with Matt Barnett from mercury security Aloha my name is Marx klav I am the host of think Tech Hawaii's law across the sea La Crosse the sea is on think tech Hawaii every other Monday at 11 a.m. please join me where my guests talk about law topics and ideas and music and Hawaiiana all across the sea from Hawaii and back again Aloha Aloha I'm Wendy Lowe and I'm coming to you every other Tuesday at 2 o'clock live from think tech Hawaii and on our show we talk about taking your health back and what does that mean it means my body and soul anything you can do that makes your body healthier and happier is what we're going to be talking about whether it's spiritual health mental health fasciae health beautiful smile health whatever it means let's take healthy back Aloha hey welcome back to security matters I'm Andrew the security guy we're here with Matt Barnett from mercury security products today and I were kind of taking a drive through the industry so we talked about some of the legacy problems that we have we talked about some of the adoption issues that we're seeing out there and you know we know how to do it right widespread it's not happening sometimes it's budget considerations sometimes it's lack of knowledge I love them Matt your your idea of secure by default I talked to some folks about some camera folks about the last thing the camera ought to do is give me video I should have to secure it I can't get video out of it until it has a checkbox for all those security settings it you know people will turn plug it in they get video and they walk away right that's a problem I think so good good on mercury for doing that you mercury supplies hardware for a lot of different software providers right so we've got so you're a big guy the big legacy gas United Technologies down so we've got a lot of new in the market they are doing cloud how how's the you know to never ask me the old phone phone line days we talked about earlier but what do you think about the cloud adoption with the access control III think it's a natural progression in this industry I made a comment at a event last year that you know five years from now we'll look back and say you know why do we do it any different than having these systems all cloud-based it just makes it makes too much sense from a service supportability aspect you know one of the biggest obstacles that most large end users have is the upgrade process for their system is massive and you have to typically have the entire system upgraded worldwide all at one time because the systems can't have you know disparate versions running so you know for an enterprise customer with locations around the world at running software that's a big expense and it's a it's a logistical nightmare so you know having a cloud-based solution for access control video I think it's a natural pro
ression it'll take a while again these systems take a long time to migrate but luckily on the mercury side you know our system doesn't care you plug it into a network and it'll it'll talk to a local server it will talk to a server in the cloud it you know it can be configured either way we've put the technologies in to allow for that TLS level encryption 1.2 TLS version so it's a it's as secure more secure than doing a credit card transaction on the Internet but there's a you know there's a ways to go so the obstacles that we keep hearing about and the user base tends to be a little skeptical especially in the security end-users when I t's involved mm-hmm usually less skeptical and more more accepting of moving directly to the cloud so that a lot of manufacturers are in the traditional sense are trying to catch up with cloud enabled software there are new entrants into the market that are just cloud by default and I think they're having success in that area where really nobody else is filling the void today yeah we we've had great success with some of those providers and I for me it's I think it's important that you know especially you know from your perspective that mercury can fill all of those niches right so you've got the you got the big guys you want to you know the server huggers they're always want to own their things but the cloud gives us a lot of agility with with product upgrades and things that you mentioned that we we just haven't had in the past I think that's gonna lower cost substantially I wanted to I wanted to I don't know how much we can sort of talk about this but you know you've got a competitors out there who make their own product and as you know it's kind of a silo right they make their their hardware and their software and some of which have also I think have a bit of a controller but they're starting to use your hardware as well or they can use their hardware or your hardware do you get a sense of how those guys think they're gonna compete I mean to me Mercury's kind of really expanded into a lot of different software manufacturers are using mercury so I don't know how if I'm making my own hardware against a mercury based hardware you know offering I don't understand how it can be competitive long term I agree I think the market is shifting and you know the end users have become much more educated you know the Internet has allowed them to do research and now they're asking a lot more and more in-depth questions of what systems they're going to use going forward yeah so those proprietary manufacturers I don't think they're going to go away anytime soon but it's getting harder and harder you know the investment they have to make to keep these technologies up-to-date it's only going to accelerate with the cybersecurity aspects and other things so as new standards are being released by the governments around the world not just the US government but you know other governments around the world are coming on board with higher assurance identification they want to make sure that the systems aren't hackable from the car to the reader the reader to the panel and then on to the network or to the cloud that's going to require a lot of investment or they're just not going to play in those in those areas and so I think it gets very expensive and may be the investment that we're doing here at Mercury and hid it I think it becomes very difficult for smaller players in this market to compete if they're trying to build everything from scratch when they can you know certainly use a product like mercury or like the HID vertex products and you know they've got really great technology right out of the box and the secret sauce is really in their user interface whether they want to be a on premise solution or they want to be a cloud solution you know the feature sets what the end users you know that's what they see and that's what they use and I think that's really where the focus should should be when it comes to you know those manufacturers yeah well we talked about other other manufacturers integration access control platforms tend to really be the basis of many of the you know that the video gets integrated the audio gets integrated the intrusion gets integrated and the operate sort of from the access control platform as the the monitoring tool and the integration platform do are you folks asked to do that from your from a hardware perspective or do you tend to leave that to the other software manufacturer dual play there I think especially as we get into cloud you could become you know some of each I don't that's kind of one of the status of that yeah so it's the valid question our panels have moved now to the Linux operating system and we'd introduce our first panel with Linux about five years ago and we had so much success with that that we decided to update the entire intelligent controller line and they all run Linux now so those were all released back in July and when you're running on that type of an operating system it allows for a lot more third-party development capability and so we've embedded you know we call them drivers but they're basically apps that run on the panel that we talked to you know asset ABLOY Wireless locks and Allegiant Wireless locks and and others in that category we have integrations to elevator destination dispatch that are being deployed and most you know multi tenant high-rise facilities around the world and so those are basically apps but similar to what you would run on your iPhone or your Google device your your handsets so they having these different apps and so what else can we tie in we've tied in life safety power and their intelligent power supply we're working with all Tronics so that we're providing the data so maybe mercury is directly in that you know in that market segment per se but we are a conduit and it becomes really an appliance on the network what else do you want to do with it from a from a security standpoint and quite frankly in the future it may be other systems in the building IOT other building control systems so we have the ability to tie in to those and will continue to work with manufacturers that specialize in that sides of the sides of the market so so once you've got that built in and you can perform the integration it's really just a matter of them being able to display that in their software or in their UI in the way that the customer needs to consume it yeah so work you know with a collection point of data and we can send we can store the data locally or we can send it to a you know a database in the cloud or on an on-premise server and you know then it can be displayed in a dashboard or you can do business analytics on it so a lot of the work that hid and I know some of our other partners are doing is collecting that data and then be able to you know action off that data so if this facility for instance is typically has a hundred people on a Monday morning you know that show up between 7:00 and 8:00 and for some reason there's you know only 10 people show up somebody might want to know about that and so having the collection of that data and then being able to action on that I think is is certainly very valuable so we're we're going to see more you know they call it AI now but it's basic business intelligence going to be run against the data and having that data in the cloud it just allows you to do you know much more with it a lot easier to work with quite frankly than having disparate databases of information around ground and network now you know we had ondrea's from our cue Lisa Andres Peterson recently and you know their take on secure yachts they have a video product but everything they're doing is based on Google you know machine learning and and and business intelligence business analytics it sounds like you guys are tapping right into that as well and but your idea is going to be to offer the capability and then the it'll be on the software manufacturer I guess to mine that out is it a service that you provide to them you think or how do you think it'll be consumed by the the software providers that are using your hardware I don't think that'll be something that mercury directly is involved in but and certainly HID is working on that so our parent company is okay is providing those as cloud services so companies that can subscribe to that data that's being collected and so it's part of a you know a future connected architecture scenario some of the larger players you know they'll build that capability themselves or they could also partner with HID and subscribe to that type of data but we just want to be the conduit to you know collect that data locally since we you know almost always going to be on on-premise mmm-hmm we're a collection point for not only access control the alarm and other data again tying and other devices so you know the ability to not only monitor but also from a serviceability standpoint you know what version is this panel running what version is the card reader running and you update the firmware in the reader remotely from the cloud and so from an enterprise perspective you know being able to manage your your entire portfolio from a from a dashboard I think as a missing link today and certainly we're enabling that type of functionality with our parent company HID as well as some of the others you mentioned our key leads it's something that that they're certainly very interested in doing as well yeah and I know we we did and see you guys have been really helpful with see a developing OSTP node along the way and an interrupt this year actually pushed information out to a card reader so that you know that bi-directional capability of OSTP is amazing we didn't get to talk about that too much today but how's that partnership with CR they fun to work with over there so seems like a great group you guys have gotten a lot done yeah I think they're they're focused on the manufacturer side has certainly been great for companies like Mercury and others so this was I think their first and it may be still there they're only spec that's been written in mercury and hid at the time were instrumental in getting the OS DP spec written and it's a continuous effort right so you know the new version is out that adds some additions what they call secure channel encryption so again you mentioned bi-directional but you know that that is important the the other technology that as you said we didn't talk about you know I'm being able to upgrade the reader firmware via the mercury panel that may be connected to a cloud service and maybe an on-premise server but having the ability to manage the readers you may in a transition going from you know procs to smart card you know you might want to turn off procs at some point if you're moving to mobile credentials you might want to turn off functionality in the reader today that's more of a manual process with most systems but in the future that really should all be a checkbox in a cloud portal right so we're enabling that using the OS DP standard but there are some other really cool things they're working with manufacturers HID and others to enable through the you know edge devices whether it's a biometric reader you know facial recognition iris scan and we're tied in to all of those and we're trying to really bring you know new technologies to market that make end-users lives easier amazing stuff Mercury's really taken the lead in the access control industry out there Matt I really appreciate your time today we've run out of time I'll have to get you back in here in six months and see where we're at with the industry really appreciate it Aloha but to come out and visit thank you [Music]
