The Convergence of Physical & Cyber Security: Why Your IT & Security Teams Must Work Together

In most Bangladesh enterprises, physical security and cybersecurity are managed by entirely separate teams that rarely communicate. The IT department manages the network, servers, and digital systems. The Security department manages guards, cameras, and access control. Each team has its own budget, its own reporting line, and its own understanding of what constitutes a security risk.

This division made sense when physical security meant locks, guards, and analog cameras with no connection to any network. It no longer makes sense in 2026, when a typical Bangladesh enterprise has dozens of IP cameras streaming video across its corporate network, access control panels connected to servers storing employee biometric data, and building management systems controlling HVAC and electrical systems via IP. Every one of these systems is a networked computer. Every networked computer is a potential target for cyberattack. And every cyberattack on a physical security system has physical consequences.

This article explains why physical and cyber security must converge — what the risks are, what international standards say, and what Bangladesh enterprises should do to close the gap between their two security worlds.

Why Convergence Is Needed: IP Systems Change Everything

The transition from analog to IP-based security technology has created a fundamental shift in the risk landscape. The change is not just technical — it is structural.

Analog CCTV operated on coaxial cables directly connected to DVR recorders. The only way to access the footage was physically at the DVR. The only way to disable the cameras was to physically cut the cables or damage the cameras. The attack surface was entirely physical.

IP CCTV operates on network cables or wireless connections, using the same TCP/IP protocols as the internet. Cameras have IP addresses. They run web servers accessible via browser. They have firmware — embedded software that can contain vulnerabilities. They can be accessed remotely by anyone who knows their address and credentials. The attack surface is now both physical and digital.

The same transformation applies to access control (from standalone panels to server-based systems with databases accessible via network), building management systems (from relay-based control to IP-based HVAC and electrical management), and public address systems (from analog distribution to IP audio). Bangladesh enterprises that have invested in modern IP-based security and automation infrastructure have, by definition, also expanded their cybersecurity attack surface — whether they acknowledge it or not.

CCTV Cyber Vulnerabilities: What Attackers Exploit

Default Credentials

The simplest and most common vulnerability in IP camera systems is the use of default factory credentials — the username and password set by the manufacturer and printed in the manual. Hikvision cameras historically shipped with admin/12345. Dahua cameras with admin/admin. An attacker who knows the manufacturer (visible from the camera's ONVIF broadcast or HTTP headers) can look up the default credentials and access any camera that has not had its defaults changed.

Globally, botnets have compromised millions of IP cameras with default credentials to conduct distributed denial-of-service attacks. In Bangladesh, IP cameras connected to internet-facing networks with default passwords are vulnerable to the same attacks. The Shodan search engine — a publicly available tool that scans for network-connected devices — can be used to find IP cameras in Bangladesh with default credentials from anywhere in the world.

Unpatched Firmware

Camera firmware — the software running on the camera's embedded processor — contains code that can have security vulnerabilities. Manufacturers release firmware updates that patch these vulnerabilities. Cameras that are never updated accumulate known vulnerabilities that attackers can exploit using publicly available tools.

Several high-profile Hikvision vulnerabilities in recent years (including unauthenticated remote code execution vulnerabilities in 2021) were fully patchable — but only by organisations that applied the firmware update. Cameras not updated remained exploitable for years after the patch was released.

Bangladesh security installations rarely include firmware update as part of commissioning or maintenance. The result is large populations of cameras running outdated firmware with known critical vulnerabilities.

Unencrypted Video Streams

Many IP cameras transmit their video streams unencrypted using the RTSP (Real Time Streaming Protocol). On a properly segmented internal network, this may be acceptable. But on networks where cameras share segments with other systems, or where remote viewing is enabled across the internet, unencrypted streams can be intercepted by anyone on the network path. An attacker who intercepts the video stream from a bank's CCTV cameras has a real-time view of security operations — enabling them to time physical attacks to exploit gaps in coverage or guard rotation.

Access Control Cyber Vulnerabilities

Database Security

Access control systems store sensitive data — employee names, biometric templates, access histories, and door schedules. This data resides on a server or embedded in a standalone controller. Server-based access control platforms from manufacturers like Honeywell, Gallagher, and Genetec run on Windows servers and database systems. If the server is not properly hardened — regular patching, strong authentication, network segmentation — it is vulnerable to the same cyberattacks as any other Windows server.

An attacker who gains access to the access control database can:

• Read all employee biometric templates (sensitive personal data under PDPO 2025)
• Modify access permissions, granting themselves access to any door
• Delete access logs, eliminating forensic evidence
• Create new credential records for non-existent employees (ghost cards)

API Security

Modern integrated access control platforms expose APIs (Application Programming Interfaces) that allow integration with HR systems, visitor management, and other platforms. If these APIs are not secured with strong authentication and encrypted communications, they can be exploited to manipulate the access control system programmatically without physical access to the server or the management workstation.

Wireless Access Vulnerabilities

Many access control deployments in Bangladesh use wireless (Wi-Fi or Bluetooth) connections between components — particularly for door controllers in locations where cable routing is difficult. Wireless communications that are not properly encrypted can be intercepted or spoofed. Some legacy access control cards (particularly Mifare Classic RFID cards) use encryption algorithms that have been publicly broken — an attacker with a portable card reader can clone these cards in seconds without the cardholder knowing.

The Consequences: What Physical-Cyber Attacks Look Like

Physical-cyber attacks are not theoretical. They have occurred and will continue to occur as more physical security infrastructure becomes networked. Consider these scenarios relevant to Bangladesh enterprises:

Scenario 1 — An attacker gains access to a bank's IP camera management system via unpatched firmware vulnerability. They observe camera feeds in real time, mapping guard patrol patterns and blind spots. They use this intelligence to time a physical attack on a cash vault during the window when no guard passes the vault corridor. The CCTV system that should have been the bank's evidence tool becomes the attacker's reconnaissance system.

Scenario 2 — A disgruntled former employee retains a copy of the access control server credentials (obtained while employed). After leaving, they access the server remotely, reset their own credential as active, and enter the building after hours. Since their access log shows a valid credential event, initial investigation treats the entry as legitimate until deeper analysis reveals the credential should have been disabled at termination.

Scenario 3 — A factory's building management system (BMS) is compromised through an insufficiently secured IoT network connection. The attacker manipulates HVAC controls, raising temperature in the server room above operating limits and causing a graceful shutdown of IT systems — effectively a denial-of-service attack via physical infrastructure.

A Joint Threat Assessment Process

The starting point for physical-cyber convergence is a joint threat assessment involving both the IT security team and the physical security team. This assessment should:

1. Inventory all IP-connected physical security devices — every camera, every access control panel, every NVR/VMS server, every BMS controller, every IP PA system
2. Map network connections — document which network segments each device is on, what other systems share those segments, and where internet or external access is possible
3. Assess credential hygiene — identify any devices still using default credentials; audit all admin accounts for shared passwords
4. Review firmware/software patch status — compare installed firmware versions against current manufacturer releases; identify devices with known critical vulnerabilities
5. Evaluate network segmentation — determine whether physical security devices are on properly isolated VLANs (Virtual Local Area Networks) or sharing network segments with corporate systems
6. Review remote access security — assess how remote access to security systems (for monitoring, administration, or AMC providers) is secured

The output of this assessment is a joint risk register with findings prioritised by severity and remediation assigned to the appropriate team (IT for network and server issues, physical security for device and credential issues).

ISO 27001 Physical Security Controls: Annex A.11

ISO 27001 — the international standard for information security management systems — recognises the inseparability of physical and cyber security. Annex A.11 of ISO 27001:2022 ("Physical Controls") includes controls that are traditionally considered "physical security" but are explicitly part of an information security management framework:

• A.11.1: Secure areas — physical security perimeters, entry controls for secure areas
• A.11.2: Equipment — protection of equipment from physical threats, power supply protection, secure disposal of equipment containing data

Organisations that have achieved ISO 27001 certification have demonstrated that their physical security controls meet the standard. Organisations pursuing certification must address physical access controls, CCTV, and environmental monitoring as part of their information security programme — reinforcing the point that physical and cyber security are one integrated discipline.

Bangladesh Corporate Security Governance Recommendations

Based on the physical-cyber risk landscape and the Bangladesh regulatory environment (Bangladesh Bank ICT Guideline v4.0, PDPO 2025), we recommend the following governance measures for Bangladesh enterprises:

Establish a joint security committee — Create a forum where IT security, physical security, and facilities management meet quarterly to review joint risks, share threat intelligence, and coordinate investments. In organisations large enough to have a CISO (Chief Information Security Officer), physical security should report to or co-ordinate with the CISO.

Include physical security systems in IT asset management — Every IP camera, every access control server, every NVR should have an IT asset record with firmware version, network location, and assigned maintenance responsibility. Physical security systems that are invisible to IT asset management will not be patched, will not be audited, and will become vulnerabilities.

Separate network segments — All physical security systems (cameras, access control, BMS) should be on VLANs isolated from corporate IT systems. Remote access to these VLANs should be through VPN with multi-factor authentication.

Change all default credentials — This is non-negotiable. Every IP camera, NVR, and access control server must have its default credentials changed before commissioning. Passwords must be documented in a secure password manager accessible only to authorised personnel.

Schedule firmware updates — Include firmware review and update as a quarterly AMC task. Most manufacturers release firmware updates on a regular cycle. Staying within one major revision of current firmware is a reasonable target.

Audit access to security systems — Review who has administrative access to CCTV and access control systems quarterly. Remove access for departed staff immediately upon termination.

Talk to Our Expert

Physical-cyber security convergence is an area where specialist expertise makes a significant difference. We work with Bangladesh enterprises to assess the cyber posture of their physical security infrastructure and implement the technical controls — network segmentation, credential management, firmware update programmes — that close the gaps.

Talk to Our Expert — contact us to arrange a physical security cyber assessment for your organisation.