Keeping Security in Shape

Terrorism vs Security = Offensive vs. Defense

I see the terrorism/global crime vs. protective authorities in terms of offense versus defense. Those on offense are the ones that are always "thinking outside the box" finding new ways to penetrate defenses and accomplish their mission. The US Homeland Security apparatus is not equipped to "think outside the box" and is stuck in static defensive mode. I have not encountered one single TSA agent that demonstrated initiative or creativity in executing his or her job. The activities and decision making processes of customs, border patrol, and many other protective service agents are bound by policies and procedures that were developed in response to past terrorist or criminal actions not in anticipation of how best a bad guy may accomplish his objective. What is kind of comical is that when there is "actionable intelligence" the DHS sends out press releases of their stepped up security practices - talk about tipping your hand.
When security/military forces are on offense -  disrupting and targeting criminal/terrorist organizations or cells, then you see the "thinking outside the box" phenomenon in play.

Special Event Security Planning

Planning security arrangements overseas or domestically for one time special events is no easy task. Though there are lots of tools in the tool box to plan for events, often the minor things are overlooked when it comes to security. Here are 5 areas which sometimes get lost in the sauce of security planning:

1. Accessibility - open to the public events are great, but a thorough registration process can not only help develop business intelligence but can also provide an obstacle for those with ulterior motives. Limiting entrances to your event will also help in reducing manpower costs provided there will be no additonal risks to anyone's safety or security.

2. Calendar Conflicts - Make sure that your event does not upset others due to a date's significance or timing. Planning a 3-day event in September is fine, but what if one of the dates is September 11th, do you think that attendees will be focused on the subject matter particular to your organization or discussing the fact that it has been 10 years since the attacks? Though you can't please everyone, be aware of major religious holidays for several faiths and look out for the possibility of any competition for parking or hotels if a major sporting or political event is occurring in town.

3. Proximity - Your organization or the venue may be innocuous but perhaps a facility across the street has an elevated threat profile. In many cases less than savory nightclubs are located near convention centers, alerting your attendees to avoid dark alleys or certain cross streets is a step in the right direction. If your venue is adjacent to property or offices belonging to controversial organizations, investigate if there are any planned demonstrations against such groups during the time frame of your event. Though demonstrations are sometimes initiated overnight versus a year plus of planning a special event, it is important to plan for such an contigency.

4. The Hotel Lobby and Activity Board- Lobbies are open 24/7 in most instances and are designed for people to feel welcome. If your event requires an elevated level of security, use an alternative name when registering the event with the hotel or banquet manager. The last thing you want as a security manager is for the name and nature of your event to be advertised in the hotel lobby if only a selected number of people are invited to attend. The invited attendees will know why they are there, no one else has to know.

 5. Low Level Contract Security - The security company (if not in -house) you hire for an event is a reflection of your organization. To satisfy insurance requirements of hotels or other venues, the hosting organization must be responsible for security. Just by having security officers standing outside in an access control capacity is not enough; how do the officers dress, communicate, do they look capable of handling crowd control duties? If celebrities or dignitaries are expected at your event; it will be quite embarassing if a security officer can't recognize a celebrity or know how to coordinate with the detail leaders of other security teams.

A Lot of Spooking Going Around

Espionage or rather those who partake in it do so for 4 major reasons:

1. Money (I would also include sex, drugs, or some mood alerting activity in this category)

2. Ideology

3. Coercion/Compromise

4. Ego

The recent Russian spies deported to Russia in a spy exchange appear to have committed espionage for love of Mother Russia - ideology.

It is too early to determine why the US Army Analyst, Bradley Manning, who is allegedly responsible for leaking 90,000 classified documents to Wikileaks.org, perpetrated such an act. Did he do so for the challenge of it (ego), did his allegiance to his country change (ideology) or was he pressured to collect and leak the documents (coercion/compromise). Only time will tell what investigators discover as to the origins of Manning's actions.

Wikileaks.org owner Julian Assange did not commit espionage in the classical sense he just disseminated the raw intelligence allegedly provided him by Manning. Assange's website's sole purpose is to be a destination for people to expose secrets. Assange's website can definitely be considered a tool to be used in a number of espionage operations such as propaganda and disinformation campaigns or to undermine the integrity of ongoing private or government initiatives.

The Essence of Security

The concept of security can best be described as a feeling one experiences when the opportunity of risk or danger is minimized or terminated. To achieve this feeling of being protected, countless methods and measures have been created in prevention or in response to perceived threats. Security methods and measures essentially manifest themselves in only three major applications:

1. People - trained security officers, law enforcement, military, and employees

2. Equipment - Gates, cameras, intercoms, and IT software and hardware systems to name a few of dozens.

3. Policies and Procedures - "What to do if..." "Shelter in place is to be activated when.." "HR must inform security prior to terminating employees" "All employees must wear company ID badges while on the property", etc.

From these three major applications we can extrapolate 5 security missions:

1. Deter - To psychologically influence a potential offender's actions to cause him, her, or them to abort the initial plan.

2. Detect - To get the earliest possible indication of a potential harmful activity

3. Deny/Delay - To successfully repel potential attacker(s) assault or to impede their progress toward their goal by physical or digital barriers.

4. Assess - To possess the command structure, technology, and communication channels to understand the scope of the perceived threat.

5. Respond - implement the needed measures to counter the threat, mitigate loss, and to initiate recovery.

Security solutions are generally applied when criminals exploit vulnerabilities in an organization's protective shield whether they be physical or digital. Security is not achieved if protective solutions only account for physical threats and not digital crimes. Conversely, an organization or business that is chiefly protected through any number of firewalls, virtual private networks, back up systems, high levels of encryption can not be considered secure if an intruder can simply walk through the unsecured back door of a facility propped open by cigarette smokers and in no time flat is in the server room.

The challenge of today's security director is to maintain a well balanced and finely tuned security machine that succeeds in blending the appropriate security applications to achieve the 5 security missions.

Intelligence Management

Understanding Intelligence Management

“ Jet Liner Goes Down”
“ Labor Strike in France”
“Underground Explosion in San Francisco”

These headlines are examples of what we read, watch, or hear through open media sources. For some
people and organizations, these incidents may directly impact their business process or livelihoods
requiring them to act (intelligence), and for others these headlines are considered simple news items.
A common problem facing many senior security managers is the feeling of being overwhelmed with
the constant influx of information via the Internet, broadcast media, the corporate intranet, and coworkers.

There is also the unspoken added pressure the chief security officer puts on him or herself to be the guy or gal who is expected to know everything that is happening anywhere in the world at any given
time. Unfortunately, some managers, fall into a trap of subscribing to every conceivable security oriented e-mail list possible, with the hope of finding something “actionable”. Casting a wide net in the hope of catching a single nugget of actionable intelligence will tax corporate or organizational
resources, demand many hours of analysis, and clog up the security department’s communication
infrastructure.

How does one actually assess what it is
considered intelligence and what is non-essential
news to that organization’s business continuity or
security? How does one navigate through a
plethora of information sources? The answers to
these questions and other’s can be found by
understanding how to manage the intelligence
process. Valuable time, money and even
reputations can be saved by knowing what the
intelligence needs of an organization are first and
then designing a plan to capture the intelligence.

For the rest of the article click on: http://www.sfasis.org/PDF/Newsletter/nl-q2-2009.pdf

What's your status?

I don't remember the sociologist, it may have been Emile Durkheim who promoted the master status theory. This theory contended that in any given social setting an individual possesses a superior status that may identify him from others within the same environment. Let's say we take 10 real estate salesmen and put them in a room, it is now unremarkable that they are real estate salesman, but if one of them was formerly a fighter pilot, this fact changes his status in the group and chiefly identifies him from the others. If we put 10 fighter pilots in the room, but one of them sold real estate on the side, his real estate job would be his master status amongst his fighter pilot friends. 

Our parents always told us we were special, but they said this out of unconditional love. It is the company that you keep who determines how special you are. I may have a diverse professional background, a deep and solid education, but the fact that I served in the Israeli army generally dominates all other traits about me in the US. In Israel, the fact that I served is unremarkable, what identifies me in Israel is that I came from the US to serve in the IDF not my service. 

Don't think of how you identify yourself think of how others identify you.

Economic Downturn - What it Means for the Security Industry

The financial crisis in the US is the leading topic of discussion in America more so than the upcoming election for US Preseident.

The security industry, like any business sector, will suffer in some segments, but not in all. Due to some severe budgeting in the months to come, many corporate security departments will see the axe fall on many security programs and or jobs.

I predict the casualties for corporate security to include:

1) Any upgrades to current physical security equipment - the $70,000 new video surveillance or access control system will get left off the budget.

2) Reduction in managerial manpower -as is the trend, many corporate security managers may have their jobs rolled into Environmental Health & Safety or a department such as  Real Estate & Transportation.

3) Positions for perimeter security officers may be reduced. Fewer security officers will have more responsibilities at facilties.

4) Executive Protection programs will defintely suffer not just for budgeting reasons but for the reason that this expense is often categorized under Executive Compensation, and with impending oversight from the federal government, corporations may view this function as a perk and not a necessity.

5) High end or elite contract security firms will suffer due to the reasons mentioned above. In wanting to do more with less budget, risk managers and CFOs will seek the lowest bidder and not the best service for future security contracts.

The likely winners within the security industry during this economic downturn will include:

Alarm companies, fence and gate companies, small sized physical security integrators, and low end security service firms.

The reason for a positive outlook for such companies is due largely in part to what happens during an economic downturn: people steal.  For example: A warehouse, with no previous history of being burglarized, is robbed of some goods and has the copper fittings of a heating system stolen.  The warehouse in wanting to prevent further burglaries contacts a local alarm company or security integrator and spends money on new security equipment (not top of the line) and also decides to install fencing.  If the general economy was more robust, perhaps this warehouse may not have been robbed if due to the greater liklihood of the thieves having other means avaliable to earn a living. So the winner in this instance is the small sized security company making profits in a downward economy.

Deterrence vs. Response Vol 1.

Constructing a physical security infrastructure has to 1) be compatible with the nature of the protected business and or facilty, (no frisking at day care centers) 2) be sustainable economically and operationally, and 3) deter or counter threats and vulnerabilities in the most efficient manner.

Deterrence is a psychological phenomenon. A perpetrator will assess his or her chances for success prior to any crime; and if fearing an unsuccessful outcome, will abandon the action.  The purpose of erecting security measures is to prevent crime and thus alter a potential offender's thought process by introducing severe doubt of success.

Some facilities, events, and organizations put a lot of money and resources into crime prevention with out first understanding what "success" means in the mind of the perpetrator.

A bank robber who sees SWAT teams deployed outside a bank, as in the case of lower Manhattan Post-9/11 will be deterred from achieving his goal because he knows that there will be an immediate and quick repsonse and he will lose in a hostage situation. This is a case of the response having a deterring effect on the motivation of the perpetrator.

Conversely, a suicide bomber will not be deterred by a SWAT team because to him, they are just more victims. In the case of the suicide bomber, deterrence is achieved by having such preventive security measures in place that the bomber will realize he will not succeed in killing as many people as he would like to and will try another day thereby exposing themselves for potential capture. Suicide bombing prevention is more of a question of having measures in place that can identify suspicious behaviors of the bomber, deny the bomber the ability to arrive to his destination, or deny the bomber(s) the access to the necessary materials. Rarely will suicide bombers be psychologically deterred except if their actions will not result in the success of killing scores of people.

Unfortunately, in the private sector at least, some organizations/facilities/events put all of their efforts on prevention of a particular incident, crime or crimes that when an unwanted event does occur, "active shooter" for example,  no adequate means of response exist and in the end the crime has a deeper impact. More to follow...

Security and the Environment

A recent article in the latest Security Management magazine brought attention to the "Going Green" phenomenon and the challenges to security. 

http://www.securitymanagement.com/

Depending on which state a facility is located, tax breaks can be given to businesses that employ "Green" technology or adhere to energy saving practices. The article points out several obvious conflicts that will arise between protection of assets versus protection of the of the environment. (No sooner did I think of writing on this topic; then an article gets published, a day late and a dollar short). 

Some issues that can be obstacles between the security and the green camps are trees and lighting. Trees sometimes obscure the field of view of CCTV cameras, removing the trees may be a solution but a building may forfeit a tax break by such an action. Lighting is a key tool in mitigating instances of premise liability as well as for identification but there is a cost in running lights overnight as well as an carbon foot prints. 

The article talked about new lighting fixtures that will use less power as well as be more directed to a particular area, eliminating the need for blasting too much light.

Corporate and municipal risk managers will no doubt conduct cost benefit studies on energy/environment protection strategies versus security strategies.

  

US Infrastructure Security - Geography

There are several types of industrial infrastructures in the US that as citizens, we depend on daily to live. Such infrastructures are Agricultural, Telecommunication, Transportation, Energy, Financial, Political, & Defense. Shall any one of these infrastructures be damaged or severely threatened, Americans will find themselves thrown into a frontier like mode of survival.

Some of our national infrastructures are centralized geographically in certain regions. 

Agriculture: beef, wheats & grains - Midwest, vegetables & greens, Monterey County, CA, fruits - California, Florida. Dairy products are generally produced in close proximity to where they will be delivered. 

Financial: NYC, The San Francisco/Bay Area is number two based on the fact that the headquarters of several financial firms are located in SF and that many Fortune 500 companies are situated nearby in Silicon Valley.

Energy: Louisiana,Mississippi Delta, Texas, New Jersey, Northern California. Though much of America's energy infrastructure is based on the delivery of foreign oil, many oil refineries required to make gasoline are located in the US.

Currently we are witnessing some our infrastructures under threat by natural made disasters or harsh weather systems. The flooding in the Midwest is damaging crops, undermining the local housing infrastructure, and effecting the transportation of goods sent from local farms and distributers to national markets via shipping on the Mississippi River.

Wild fires or brush fires through out California are threatening much of the produce crops that supply much of the country. In this age of "global warming" awareness we can't spare to lose any more trees - not that I am a "tree hugger" or anything.

Let's look at a scorecard of recent man made and natural disasters that have impacted key infrastructures in the US:

Financial/Political: Terrorist attack 9/11 - NYC/Washington D.C  

Energy: Hurricane Katrina - States bordering the Gulf of Mexico

Biggest Threat to key US infrastructures yet to happen is an Earthquake in Northern California which will cause severe flooding in the Delta region located on the Northeast SF Bay Area threatening Chevron and Valero refineries: National Impact: Energy

Structural damage to Fortune 500 headquarter buildings; National Impact: Financial, Telecommunication

Loss of livestock and produce emanating from fires, floods, and landslides: National Impact: Agricultural 

Now I am not a doomsday guru but my two cents says it is quite important to follow the US Boy Scout mantra and, "ALWAYS BE PREPARED."