PCC Research preview

This page is a working demonstration for NPA and Council leadership. Enter the preview phrase to continue.

That is not the phrase. Try again.
A publication of the National Parking Association -- Parking Consultants Council
NPA's 75th Year · 1951–2026  ·  How this connects to WeAreParking.org →
Parkonomics PCC Research
PCC Research / The PCC Book of Parking / Part VII · Keeping It Alive / Module 63
PART VII · KEEPING IT ALIVE · MODULE 8 OF 8 MEMBER EDITION · PREVIEW

Cybersecurity for Parking Operations

By Andrew Sachs, Don Monahan, and Jerry Marcus · Edited for the Book of Parking by Andrew Sachs, PTMP
Reviewed August 2026 · v0.1 draft · in Council author review · revision record begins at publication

The parking operation digitized while nobody was calling it a technology business: PARCS, payment processing, cameras, SaaS office tools, email, banking, customer apps and reservation sites. Every one of those systems is now operationally load-bearing, and the manuscript's new-for-this-edition chapter states the consequence plainly: an unexpected outage (glitch or attack) can simultaneously hit revenue collection, security surveillance, and day-to-day communication. Cyber protection is not an IT department's hobby; it is continuity of the operation itself.

The seven-category map. Cybersecurity decomposes into network security (keeping intruders off the wire), application security (finding and fixing software vulnerabilities), information security (data integrity and privacy, in storage and transit), operational security (the processes and decisions around data handling), disaster recovery and business continuity (restoring and maintaining operations through the incident), end-user education (the users being the perennial weakest link), and cloud security (the SaaS layer the industry now runs on).

Network and application discipline. The network stack for a parking operation: firewalls filtering traffic against rules; anti-virus and anti-malware; an intrusion detection and prevention system scanning for attack signatures and blocking automatically; VPNs for private transit of sensitive data (card information above all); segmentation into subnetworks so a breach of one zone does not open the sensitive ones; and scheduled audits and updates. The manuscript adds the operational resilience layer that reads like operator experience: redundancy through dual providers (separate ISPs for payment processing and office communications, so one outage does not stop both) and cellular backup on payment processing that activates automatically when the primary line fails: the revenue keeps flowing through the incident. Application security runs the software lifecycle: security designed in from the SDLC's start, threat modeling at design and on a refresh cadence, code review with automated scanning, manual review, and penetration testing, established frameworks over homegrown code, patch management across the application and its third-party dependencies, strict access control, hardened (non-default) configuration, encryption at rest and in transit, an incident response plan, and security training for everyone touching the development process, with the standing frame: not a one-time task but an organizational habit.

the attack surface, segmented:payment + PCI zonecard data: theregulated islandPARCS + gatesthe machines thatopen thingscameras + intercomseyes and ears,on the networkbusiness systemsemail, monthly billing,the officethe dashed walls are the security program: segmentation, so the phished office laptop cannot open the gates or reach the cardsthen the basics, relentlessly: default credentials changed, vendor remote access inventoried, patches on a schedule, backups tested
Figure 1.The garage is four networks pretending to be one: cards, gates, cameras, and the office. Cybersecurity here is mostly walls between them, plus the unglamorous basics done every time.Source: operational cybersecurity per Ch 18, as carried in this module.

Information, PCI, and the people. Information security organizes around the classic triad: confidentiality (sensitive data disclosed to no one unauthorized), integrity (data accurate and unmodified), availability (data usable when authorized users need it), implemented through encryption, access controls, audits and risk assessments, and continuity planning, across customer data, employee data, financial records, and business strategy alike. PCI DSS compliance gets its own standing in an industry that has gone nearly universal on card payment and increasingly cashless: the standard's requirements (secure networks, cardholder data protection, vulnerability management, access control, monitoring and testing, and a security policy) are the non-negotiable floor for anyone touching card data. And the human layer runs throughout: end-user education against phishing and password failure, because the best-engineered stack still falls to one credential surrendered willingly.

The action plan. The manuscript's organizational guidance splits by scale: larger operators should resource a dedicated digital security officer (plan ownership, audits, training, incident command); smaller operations can outsource to a managed security service provider for network management, vulnerability scanning, incident response, and compliance help, buying expertise without the headcount. Either way, the seven-step plan is the template: risk assessment (external and internal threats, disgruntled insiders included); security measures across network, systems (PARCS updates named explicitly), and access control; data protection with encryption and PCI compliance; employee training; an incident response plan with a named team, isolation procedures, investigation, remediation, and notification; disaster recovery with tested backups and continuity provisions; and regular audits with vulnerability scanning and penetration testing. The closing frame is the discipline itself: ongoing maintenance and review, because the threat landscape does not hold still for the plan.

VERDICT

treat every digital system as operationally load-bearing and protect it accordingly: segment the network, dual-path the connectivity, put cellular backup under the payment line, run the application lifecycle with security designed in, hold the PCI floor absolutely, and train the humans who are the actual attack surface. Assign the program an owner (officer or MSSP by scale), run the seven-step plan on a cycle, and test the recovery before the incident does, because in a digitized operation the cyber plan is the business continuity plan.

Sources: PCC cybersecurity practice per the source chapter; PCI DSS per the PCI Security Standards Council as cited. Threat landscape and tooling evolve continuously; program specifics per current standards at implementation.

From the shelf

Source crosswalk -- where each section came from in the manuscript
Module section Source: Chapter 26, "Crime Prevention & Cyber Security"
Stakes "Cyber Security" (introduction); "Network Security" (outage consequences)
Seven categories "Cyber Security" (category list)
Network and application "Network Security" (stack, redundancy, cellular backup); "Application Security" (SDLC list)
Information and PCI "Information Security" (CIA triad); "PCI Compliance"
Action plan "Cyber Security Action Plan" (officer vs. MSSP, seven steps); "End-User Education"; "Disaster Recovery and Business Continuity Planning"
Not carried forward Physical security (in #61); electrical security detail (summarized; see note)