Learning paths

Choose a reading path for your current task. Each path links the background, protocols and practical checks you need to work through it.

Sources and scopeSource record 25 August 2026

Technical source record: 25 August 2026. Check the linked documentation for current product requirements.

Suggested sequencing, not a competency or certification framework.

Verification and testing

Pick a practical route#

New to physical security · Video · Access control · Event pipelines · Troubleshooting · Security review

Each route gives you a question to work through, a short reading order and a limit to keep in mind. The broader domain routes below go deeper into alarm monitoring, building systems and related topics.

Overview#

Don't try to memorise the protocol catalogue. Learn the shared models first, then one end to end workflow at a time.

Getting started with physical security#

1. Architecture and layering
2. Physical security system architecture
3. Networking fundamentals
4. Events, state, commands, and time
5. Identity, authentication, and authorisation
6. Protocol landscape

Outcome: explain a flow from field device to client, name every layer, and distinguish observation from command.

Video and VMS integration#

Start with media fundamentals, multicast and discovery, and time synchronisation. Then study ONVIF, RTSP/RTP/RTCP/SDP, WebRTC, HTTP, and the relevant vendor API. Add GB/T 28181 for applicable Chinese deployments and SRT/RIST only for contribution network requirements. Finish with event normalisation, reconnect, bounded buffering, certificate validation, and evidence integrity.

Outcome: trace control, media, metadata, events, and authentication as separate but correlated flows.

Access control integration#

Read credentials and identity media, serial and field interfaces, dry contacts and supervised circuits, and failure semantics. Then study OSDP, legacy reader interfaces, contactless/smart card standards, mobile credentials, pedestrian portals, and PACS APIs. Use federation, SCIM, and WebAuthn/FIDO where enterprise identity crosses into PACS administration.

Outcome: distinguish credential identifier, authentication factor, access decision, door state, and audit event, and identify which component is authoritative for each.

Alarm and monitoring integration#

Read events, state, commands, and time, data modelling, and reliability and failure semantics. Then use the alarm protocol index for the SIA families and IEC 60839 alarm transmission, followed by intrusion monitoring systems for receivers, verification, and redundant path supervision. Use CAP and EDXL for public warning message exchange, not as a panel to receiver substitute.

Outcome: model alarm, restore, cancel, test, communication fault, and acknowledgement without assuming ordered or exactly once delivery.

Building and OT convergence#

Read trust boundaries and segmentation, serial and field interfaces, TLS and PKI, and secure integration lifecycle. Then use the building and industrial index for Modbus, BACnet/BACnet/SC, KNX Secure, OPC UA, IEC 60870-5, IEC 61850, Matter, and only the protocols actually present at the site.

Outcome: broker the minimum required information across zones without turning an analytics or enterprise integration into an uncontrolled actuation path.

Defensive reviewer#

Follow verification and safety, trust boundaries, identity and authorisation, TLS and PKI, reliability, and observability and evidence. Apply security and assurance and only the defensive lab class authorised for the environment.

Outcome: produce a finding that states evidence, affected version/path, preconditions, physical consequence, uncertainty, and a proportionate mitigation.

Suggested depth#

Use three passes:

• Map: actors, layers, data/control paths, lifecycle, and trust boundaries.
• Mechanics: framing, state, timing, errors, identity, and secure modes.
• Assurance: negative cases, degradation, recovery, logging, version drift, and source verification.