We’re Tracking the Future of Security

Author: Osiris

  • Video Analytics Performance Drift: Baselines, Detection and Retesting

    Video Analytics Performance Drift: Baselines, Detection and Retesting

    Video analytics can pass commissioning and still become less reliable months later. The scene changes, vegetation grows, lighting is replaced, camera aim shifts, software is updated or the mix of people and vehicles changes. Performance drift is the gap between the accepted baseline and current operational behavior, and it must be measured rather than inferred from isolated complaints.

    Create a baseline that can be repeated

    Commissioning should preserve representative test clips, target routes, environmental notes, configuration values and expected results. Record both detections and nuisance events. A baseline that says only that the analytics passed provides no reference for later diagnosis.

    Use scenarios tied to the operational requirement: line crossing, intrusion into a zone, stopped vehicles or another defined event. Include target size, speed, direction, occlusion and time of day. Where privacy rules limit stored imagery, retain controlled test material and numerical outcomes with appropriate governance.

    Monitor indicators of drift

    Useful indicators include detection rate during scheduled tests, nuisance alarms by cause, operator rejection rates, processing latency and periods when analytics are unavailable. A falling alarm count is not automatically an improvement; it may mean targets are being missed. Conversely, a rising count may reflect real activity rather than a model problem.

    Compare trends by camera and scenario. Site-wide averages can hide one failing view. Maintenance records should be aligned with performance changes so analysts can identify whether drift followed a lens cleaning, camera replacement, firmware upgrade, construction activity or seasonal transition.

    Separate scene, configuration and model causes

    Begin with the observable path: image quality, focus, field of view, occlusion, time synchronization and network delivery. Then compare zones, thresholds and schedules with the accepted configuration. Only after those checks should the team attribute a change to the analytic model itself.

    Version control is important because model and firmware updates can change behavior without obvious interface differences. Record the deployed version and test it against the same baseline clips or field scenarios. If rollback is possible, define who can authorize it and how evidence will be preserved.

    Retest changes before closing the issue

    Corrective action should be followed by controlled retesting, not just a quiet period with fewer alarms. Verify the original failure scenario and check that the change did not create blind areas or suppress legitimate events elsewhere. Operators should understand any new limitations and escalation rules.

    Analytics assurance is part of ongoing Video Surveillance & Imaging governance. Repeatable baselines, version records and operational feedback allow teams to distinguish real performance drift from anecdotal dissatisfaction and to respond before confidence in the system collapses.

    Assign ownership for reviewing the indicators and define a threshold that triggers investigation. Without a named review cycle, dashboards can collect performance data without anyone deciding when a change is operationally significant.

    Reference sources

  • Fire Alarm Loop Fault Isolation and Network Survivability

    Fire Alarm Loop Fault Isolation and Network Survivability

    A fire alarm system may appear normal at the control unit while a single cable fault threatens a large part of the detection or notification path. Loop isolators, redundant communications and supervised circuits are intended to limit that impact, but their value depends on design, placement and testing. Acceptance should prove what remains operational after realistic faults.

    Map the intended fault boundaries

    Start with drawings that show signaling-line circuits, notification circuits, isolators, network nodes, power supplies and interfaces. Identify which devices are expected to remain available after an open circuit, short circuit or node loss. The drawing should match the installed field route, not only the tender design.

    Fault isolation is affected by physical topology. Devices on both sides of an isolator may not fail in the way an operator expects if the cable route, address sequence or return path changed during construction. Record fire compartments, risers and critical functions so the test can assess consequence as well as device count.

    Test faults under controlled conditions

    Introduce approved test faults one at a time using a documented method that protects people and equipment. Confirm the control unit identifies the correct circuit or segment, annunciators receive the condition and unaffected devices continue to operate. Measure how long isolation and restoration take and whether repeated faults produce additional loss.

    An open circuit, short circuit and network communication failure can have different effects. Test representative locations, including boundaries near isolators and remote power supplies. Where a fault could disable a safety function, coordinate compensating measures and restore the system immediately after the evidence is collected.

    Verify interfaces and degraded operation

    Fire alarm systems often control doors, smoke control, elevators, suppression interfaces and monitoring connections. A field loop may retain detectors while losing an interface module that supports another life-safety action. The acceptance matrix should therefore verify required cause-and-effect behavior in the degraded state.

    Confirm that off-site monitoring receives fault and restoration events with correct timestamps. Networked panels should maintain required indications when a peer node or communications link is unavailable. Cybersecurity controls must not block supervised traffic, while maintenance access should remain authenticated and logged.

    Preserve evidence for maintenance

    Close the test with updated drawings, device lists, software versions, fault results and unresolved limitations. Operators need plain-language information about which area is affected by a reported fault and what temporary action is required. A generic trouble message without location or consequence is difficult to manage safely.

    Repeat selected tests after rewiring, expansion, firmware changes or unexplained communication faults. Fire network survivability supports the wider Fire & Safety program by making single-fault behavior visible before an emergency exposes it.

    Coordinate testing with the authority having jurisdiction and the site’s impairment procedure where required. Notify affected occupants and monitoring parties before the exercise, then confirm that normal supervision has been fully restored.

    Reference sources

  • Access Credential Revocation and Offboarding for Physical Security Systems

    Access Credential Revocation and Offboarding for Physical Security Systems

    Offboarding is complete only when a departing person’s physical and digital access paths have been identified, revoked and verified. A returned badge does not prove that mobile credentials, biometric enrollments, vehicle permissions, visitor-system accounts or remote administration rights have been removed. The process must follow the identity across every connected security system.

    Build an authoritative trigger

    Revocation should begin from a trusted personnel or contract event with an effective time and accountable owner. Human resources, procurement, facilities and security may hold different parts of the record, so the workflow needs one authoritative trigger and a method for urgent terminations. Role changes and extended leave also require review even when the person remains employed.

    The request should identify the person, organization, sponsor, credential types, sites and systems in scope. Avoid using names alone; duplicate names and formatting differences can lead to missed records. Preserve identifiers that allow operators to find the same identity in the access-control system, visitor platform and mobile-credential service.

    Revoke the credential and the entitlement

    Disable active badges and mobile credentials, but also remove the access levels, groups and schedules that granted permission. Otherwise a replacement credential may inherit rights that should have ended. Biometric templates and identity documents should be handled according to retention and legal requirements rather than left indefinitely in an active population.

    Collect physical badges where practical and record those that were not returned. Vehicle tags, keys, tokens and temporary passes need their own disposition. Contractors may have access through a shared employer relationship, so terminating one assignment should not accidentally remove or preserve access for unrelated personnel.

    Verify across integrations and offline devices

    Integrated systems may not update simultaneously. Confirm that revocation reached downstream controllers, wireless locks, elevators, parking systems and third-party services. Offline locks and cached mobile credentials deserve particular attention because a central status change may not take effect until synchronization.

    Test high-risk cases by reviewing the credential status and recent transactions. Do not create a real unauthorized entry attempt unless the procedure is controlled. The verification record should show who performed each action, when it completed and which exceptions remain open.

    Measure timeliness and completeness

    Track the interval from the effective termination time to confirmed revocation. Separate routine delays from urgent failures, and investigate credentials that remain active beyond policy. Periodic reconciliation between personnel records and active access identities can identify orphaned accounts, expired contractors and duplicated credentials.

    Access offboarding is a lifecycle control within Access Control & Identity, not a one-time badge task. Clear ownership, complete inventories and evidence-based closure reduce the window in which former access can be misused.

    Include service identities and scheduled accounts assigned to the departing person. Shared administrative credentials should be rotated through a controlled process when exposure cannot be ruled out, while audit evidence is preserved.

    Reference sources

  • Thermal Camera Acceptance Testing: Baselines, Calibration and Environmental Checks

    Thermal Camera Acceptance Testing: Baselines, Calibration and Environmental Checks

    Thermal cameras can reveal people, vehicles and heat patterns when visible-light imagery is limited, but acceptance cannot be based on a daytime image alone. Performance changes with distance, weather, background temperature, mounting stability and the analytics configured around the sensor. A useful acceptance test establishes a repeatable baseline for the actual scene and mission.

    Start with the required detection task

    Define whether the camera must support detection, recognition of a target class, alarm verification or temperature-related observation. These are different tasks and require different test evidence. Record the target size, route, speed and parts of the scene where an alarm is required. Avoid translating a general product range into a site guarantee without field validation.

    Confirm mounting height, angle, horizon, focus, field of view and obstructions. Check that the intended target occupies enough pixels across the relevant path and that the image remains usable at the edges. Vegetation, fencing, reflective surfaces and warm machinery can create scene-specific limitations.

    Capture environmental baselines

    Thermal contrast can decline when a target and background approach the same apparent temperature. Test at more than one time of day where practical, especially near sunrise or sunset and during expected seasonal conditions. Record air temperature, precipitation, wind, surface conditions and any active heaters or exhausts.

    A baseline should include representative images and alarm results, not just configuration screenshots. If the camera supports automatic gain or scene-based processing, record the settings and observe how rapid scene changes affect the image. The purpose is to create a reference that maintenance teams can compare with later performance.

    Validate analytics and handoff behavior

    Walk or drive controlled targets through required zones, boundaries and approach angles. Include expected speeds and partial occlusion. Measure whether alarms occur in the intended location, whether the event is delivered to the video platform and whether operators receive useful pre-event and post-event footage.

    False-alarm testing should use realistic non-target activity such as moving vegetation, animals, hot equipment, reflections and weather. A short quiet test is not enough for scenes that vary across a day. Record nuisance events by cause so thresholds can be adjusted without hiding genuine targets.

    Close acceptance with maintainable evidence

    Document firmware, time synchronization, network settings, analytics versions, zone coordinates and user permissions. Verify recording, export and event timestamps across the complete path. If another camera is cued for visual confirmation, test the handoff under the same scenarios.

    Define triggers for retesting: camera movement, vegetation growth, construction, firmware changes or repeated nuisance alarms. Thermal acceptance is part of ongoing Video Surveillance & Imaging assurance. A signed baseline makes performance drift visible and prevents later troubleshooting from relying on memory.

    Assign a responsible owner for the baseline and store it with approved drawings and maintenance records. Operators should know how to report suspected coverage loss and which evidence must be captured before settings are changed.

    Reference sources

  • Security Alarm Escalation Matrices: Priorities, Contacts and Timeouts

    Security Alarm Escalation Matrices: Priorities, Contacts and Timeouts

    An alarm escalation matrix converts a technical event into an agreed sequence of operational decisions. It identifies which alarms require immediate action, who must be contacted, how long each person or team has to respond and what happens when the first path fails. Without that structure, operators improvise under pressure and similar incidents receive inconsistent treatment.

    Define priorities from consequence and urgency

    Priority should reflect the consequence of delay, not simply the device type. A door-held alarm at a low-risk store room may be routine, while the same signal at a pharmaceutical cage or data-hall entrance may require immediate dispatch. Build priorities from location, asset, operating mode, corroborating signals and the response that is realistically available.

    Keep the number of priority levels manageable. Each level needs a plain-language definition and an expected action. If two levels produce the same operator response, the distinction may not provide operational value. Document exceptions such as maintenance windows, known construction activity and temporary risk controls.

    Map contacts, ownership and timeouts

    For every priority, list the primary contact, alternate contact and final authority. Include communication methods, hours of coverage and the information the operator must provide. A named individual alone is fragile; use roles or duty functions where possible and maintain a controlled roster behind the matrix.

    Timeouts should be measurable. Define when the clock starts, what counts as acknowledgement and when the next step activates. An unanswered telephone call is different from an acknowledged incident with no follow-up. The matrix should state whether escalation transfers ownership or merely adds another participant.

    Connect verification to escalation

    Alarm verification can change the required path. Video, audio, access events and adjacent sensors may raise or lower confidence, but verification should not create an indefinite pause. Set a maximum verification interval and specify conditions that permit immediate escalation, such as a duress signal or multiple independent detections.

    The workflow should preserve the original event, verification evidence, operator decisions, notifications and acknowledgement times. Those records support investigation and reveal whether delays came from technology, unclear procedures or unavailable responders.

    Test the matrix as an operational system

    Tabletop exercises can reveal missing numbers and unclear authority, but live tests are needed to measure actual notification and acknowledgement behavior. Use representative scenarios across normal hours, nights and holidays. Confirm that the monitoring platform displays the same priority labels and instructions used in the approved document.

    Review the matrix after organizational changes, incidents and major system modifications. Track overdue acknowledgements, repeated contact failures and unnecessary escalations. The goal is not to eliminate judgment; it is to give operators a reliable baseline for using judgment consistently.

    Escalation design belongs with broader Command & Control governance. A concise, tested matrix can reduce hesitation while ensuring that serious alarms reach people who have both the authority and information to act.

    Reference sources

  • Corp MDM Android Spyware Targets Logistics Firms With SMS Theft and Call Forwarding

    Corp MDM Android Spyware Targets Logistics Firms With SMS Theft and Call Forwarding

    Logistics organizations are being targeted with an Android spyware application called Corp MDM that is distributed through fake Google Play pages and disguised as a corporate system service. Research from Have I Been Squatted shows the implant can exfiltrate newly received SMS messages, activate call forwarding and maintain background communications with attacker infrastructure.

    Fake enterprise branding supports installation

    The malicious application is delivered from pages that imitate logistics brands rather than the official Play Store. After sideloading, it requests permissions for SMS, telephone and notifications, removes its launcher icon and registers the device with a command-and-control service. The observed implant collects new incoming messages rather than a full historical inbox, but that can still expose one-time passcodes, recovery messages and dispatch information.

    The associated control panel includes commands for enabling or disabling unconditional call forwarding. Researchers also found options that were displayed in the panel but not fully implemented by the malware, a distinction that matters when assessing actual capability.

    Mobile controls should include distribution provenance

    Enterprises should restrict sideloading, verify package origin, monitor device-administration permissions and investigate branded download pages outside approved stores. Mobile-device management is useful only when enrollment is genuine; attackers deliberately borrow enterprise-management language to make intrusive permissions appear routine.

    The campaign intersects with Cyber-Physical Security because mobile credentials can expose operational accounts and shipment data. Response teams should review affected telephone settings, revoke exposed sessions and examine related Windows or phishing activity rather than treating the Android implant as an isolated event.

    Sources

  • Ukrainian Websites Serve Fake Cloudflare Checks That Deliver Psychedelic Stealer

    Ukrainian Websites Serve Fake Cloudflare Checks That Deliver Psychedelic Stealer

    Compromised Ukrainian websites are being used to present fake Cloudflare verification pages that direct visitors through a ClickFix sequence and ultimately install an information-stealing program called Psychedelic Stealer, according to Arctic Wolf research. The campaign combines a trusted visual pattern with instructions that cause the victim to execute the attack.

    Fake verification leads to command execution

    A visitor to an affected site is shown a verification prompt designed to resemble a legitimate anti-bot check. Instead of completing a normal browser challenge, the user is instructed to open a system dialog, paste clipboard content and run it. That action starts a staged delivery chain outside the browser’s ordinary security boundary.

    The reported stealer targets information that can support follow-on compromise, including credentials and browser data. The use of legitimate but compromised websites complicates simple reputation filtering because the initial domain may previously have been trusted.

    Defenses must address the instruction pattern

    Web administrators should investigate unexpected script changes, third-party injection and new redirects. Endpoint teams can monitor unusual command interpreters launched immediately after browser activity, while user guidance should make clear that a genuine web verification process does not require pasting commands into an operating-system tool.

    Organizations can connect these controls with SectechMedia’s Cyber-Physical Security coverage. Detection should preserve the originating URL, browser process, clipboard-driven command and subsequent network activity so responders can identify both the compromised site and any affected endpoint.

    Sources

  • Placeholder Domain in 1,700 Repositories Starts Serving ClickFix Malware

    Placeholder Domain in 1,700 Repositories Starts Serving ClickFix Malware

    A placeholder internet domain referenced in more than 1,700 public software repositories began serving malicious ClickFix content after it was registered by an external party, according to research from Manifold Security. The incident demonstrates how example values can become a supply-chain exposure when copied into code, documentation and generated applications.

    Copied examples created a durable dependency

    The domain appeared in repositories, code samples and configuration material as though it were a harmless stand-in. Once it was controlled by another party, visitors could be shown a fake verification workflow that instructed them to run commands on their own computers. ClickFix attacks rely on social engineering rather than a conventional browser exploit: the victim is persuaded to copy and execute a command that installs malware.

    Not every repository reference meant that a production application automatically contacted the domain. Risk depends on how the value was used, whether a link was exposed to users and whether build or runtime processes resolved it. The large number of references nevertheless widened the potential audience.

    Placeholder values need lifecycle controls

    Development teams should use domains reserved for documentation, maintain dependency inventories and scan source code for external references. Reviews should distinguish between package dependencies, browser links, API endpoints and examples because each creates a different path to execution.

    The event belongs in a broader Cyber-Physical Security program. Security teams should monitor ownership changes for externally referenced domains, remove obsolete examples and treat copy-and-paste command prompts as a user-protection problem as well as a malware-detection problem.

    Sources

  • YouTube Extends Likeness Detection to Voice-Based AI Impersonation

    YouTube Extends Likeness Detection to Voice-Based AI Impersonation

    YouTube is expanding its likeness-detection program to include voice-based impersonation, adding another signal for identifying synthetic content that appears to imitate eligible creators. The platform previously introduced tools centered on visual likeness and is now extending the program as generated audio becomes easier to produce and distribute.

    Voice becomes part of the review workflow

    The system is intended to surface videos that may contain an AI-generated version of a creator’s voice. Detection is not the same as an automatic removal decision. A flagged result still needs review because parody, commentary, licensed use and coincidental similarity can affect the appropriate response.

    YouTube’s existing privacy complaint process considers whether content is altered or synthetic, whether it is realistic and whether the person can be uniquely identified. Adding voice broadens the evidence available to creators, but the platform still needs enrollment controls, secure reference data and an appeals path to reduce false claims.

    Detection requires governance as well as matching

    Voice-likeness systems operate in difficult conditions: compression, background music, short clips, accents and intentional transformation can change performance. Attackers can also combine genuine and generated segments. Effective operation therefore requires confidence thresholds, human review and records showing why a decision was made.

    The development connects identity protection with Cyber-Physical Security governance. Organizations using similar tools should define who can enroll a reference voice, how consent is verified, how long biometric-derived templates are retained and how disputed matches are investigated.

    Sources

  • Ofcom Investigates Pornhub Device-Level Age Checks Under UK Online Safety Rules

    Ofcom Investigates Pornhub Device-Level Age Checks Under UK Online Safety Rules

    UK communications regulator Ofcom has opened a formal investigation into whether the age-assurance process used by Pornhub operator Aylo satisfies duties under the Online Safety Act. The inquiry focuses on a device-level approach that uses operating-system age signals rather than requiring a fresh identity or age check inside the service.

    Investigation focuses on effectiveness and due diligence

    Ofcom said it will examine whether the service uses highly effective age assurance and whether Aylo completed an adequate children’s access assessment. The regulator also raised the question of whether sufficient due diligence and testing took place before the process was introduced. Opening an investigation is not a finding of non-compliance, and Ofcom said it is not making a determination about Apple’s age-verification system itself.

    The technical distinction matters because a device-level signal may describe an account holder without proving who is using the device at a particular moment. Shared devices, known passcodes and household account practices can therefore affect the assurance provided by the overall workflow.

    Age assurance is a system-level control

    Organizations assessing age controls should document the signal source, binding between the signal and the current user, fallback methods, privacy boundaries and testing evidence. They should also record how exceptions and account recovery are handled, because those paths can weaken an otherwise strong primary check.

    The case is relevant to broader Access Control & Identity design: assurance depends on the full chain between enrollment, device, account and transaction. A vendor feature alone does not establish that the deployed service meets a regulatory or operational threshold.

    Sources