Category: Security

This document is prepared and presented as a basic overview of contemporary best practices regarding written documentation — primarily security policy – needed within an effective security program. It is generic in that it is developed without a specific application or facility in mind. As such, all or parts of this information may not be appropriate for every building or facility. The intent is to provide fundamental information for non-technical and non-security readers.

Security documentation is the written material used to govern all aspects of a security program. Such documentation would include, at minimum, the following;

• Policies
  • Standards
  • Guidelines
  • Emergency Plans
  • Training Material
  • Informational Material

INTRODUCTION

It can be said that there are – in essence – only 3 reasons for performance failure in an organization’s security program;

(1) The is NO policy and procedure addressing the issue;
(2) There is a policy and procedure addressing the issue, but it was not followed;
(3) The policy and procedure addressing the issue was followed, but the contents were inadequate to properly address the circumstances of the particular situation.

In the triad of architectural, technological and operational security, the policies and procedures are the foundation of the later and are easily the most overlooked and most important aspect of a comprehensive and effective security program.

An organization’s policies and procedures are dynamic in that they must be continuously updated and constantly refined. Perhaps no other single aspect of an entity more clearly reflects its culture and philosophy than the body of written policies and procedures by which it governs.

STARTING AT THE TOP

Easily, the most common obstacle in any attempt to develop security policies and procedures is the failure to have the full support of top management. At the very least, the direct approval of the top position is necessary. Ideally, the policies and procedures should be reviewed and approved by the governing body – such as the Board of Directors – or a committee thereof. This support from the top of the organization must also be clearly reflected in the document itself.

Additionally, management must support the effort through “example”. This means that the policies and procedures must apply to everyone, regardless of their position within the organization. If exceptions are to be allowed, the exceptions should be stipulated in the policy and procedure document.

DISSEMINATION

If a “perfect” policy and procedure document could ever exist, even it would be of no value if the person’s subject to its contents and responsible for its implementation and enforcement are not aware of the details. Traditionally, binders of printed documents were reproduced and widely distributed so as to be accessible to the workforce. Today, fewer printed copies are prepared and there is a greater reliance on electronic media. A best practice is for the security department to have its own website on the organization’s intranet. Among the many benefits of this is the ability to make the security policies and procedures readily available for reviewing and downloading, ideally in the Adobe.PDF format.

The essential contents of the policies and procedures should also be presented during employee orientations and included in an employee handbook.

DESCRIPTIONS

Typical security documentation can be described as follows:

POLICY: The organizations stated security objectives and the requirements in general terms. Policy also establishes departmental responsibilities and cooperative interaction where issues may overlap. Most importantly, it conveys authority. Policies address specific issues, however, the statements are usually very broad and without detail.

STANDARDS: Standards establish minimum performance parameters. These are statements that are usually “actionable”, “measurable” and/or “observable”. Standards are more detailed that Policies, and can often be the same as or similar to technical specifications.

GUIDELINES: Policies and standards require writing in a very precise and special way that avoids misunderstanding. Because it is not a narrative style that most people are accustomed to reading, some helpful explanatory notes can aid in comprehension. Guidelines serve this purpose but are not “requirements” in themselves.

PROCEDURES: Procedures are directed at persons responsible for taking action under the various circumstances and conditions, or in response to certain events. These are very specific and step-by-step to the extent practical and reasonable. Where Policies and Standards may apply on an enterprise-wide basis, there will always be a large portion of the Procedures that must be specific to each individual location or facility.

EMERGENCY PLANS: Generally, a given facility will have need for several emergency plans, each addressing specific events. Emergency plans are constructed – in part – so that they may be referenced in real time during an event. The most common emergency plans are in response to such things as a fire or bomb threat. Additional plans may be needed for other events such as an attack or when the threat of attack is elevated. Procedures within Emergency Plans tell people “where” they will go and “what” they will do when the get there.

Check Out: Emergency Response Plan Basics

STRUCTURE

A key aspect to a good manual is that it is relatively easy for any user to find the information they are seeking. Because a policy and procedure document is continuously revised, a conventional, single document with sequential page numbering would be less than optimal. Additionally, it is desirable to numerate the contents other than through the employment of page numbers, since these tend to change during revision. It is also very desirable to facilitate later reference to individual “provisions” within the document, similar to the manner in which government laws are numerated. An example structure might be something similar to the following:

1 = Chapter
1.01 = Subchapter
1.01.01 = Section
1.01.01.01 = Subsection

It is advisable to create a standard format or template for the pages in order to facilitate the replacement of pages with revisions, and for readability. The template should incorporate a place for the title of the chapter and a place the date of the most recent revision. The document should contain a Table of Contents and a word index is a great enhancement.

Typically, an organization would have a general or master body of policies and procedures that are universally applicable across the entire global enterprise. Entities with multiple facilities will likely need to reserve certain subjects for further individualization for various locations such as different cities, states or countries in order to accommodate variations in applicable laws.

Additional policies and procedures will usually be needed based upon the specific nature of the organization, such as the business or industry in which it falls. Government regulatory compliance can be a major element of the document in some operations.

Where the policy manual is separate from the procedure manual – as is generally recommended – the relative procedures should reference the corresponding policy.

SCOPE

There are a myriad of subjects that might be addressed in a comprehensive set of security policies and procedures. Many of the common subjects will overlap with areas commonly addressed by the Human Resources department, and sometimes with other units as well. It is strongly recommended that legal counsel review and approve all policies prior to dissemination.

Typically, policy is written in a narrative and semi-general format and the only “rule” is that the message be clear and unambiguous. Each policy would generally state the organization’s position on the subject, and most importantly, it should delegate the necessary authority and responsibility for developing the corresponding procedures for execution and enforcement.

Procedures are typically written in a “step-by-step” format. As a guide, security procedures for security officers should be developed with a new guard on his or her first day on the job in mind.

ENFORCEMENT

If policies are important, than adherence to policy must be equally important. The policy MUST set forth appropriate consequences for violations of any policy, in the form of disciplinary action. Failure to consistently enforce policies might tend to negatively impact the legal enforceability of all policies. Where an organization lacks the collective will to act to enforce a policy, that policy should be changed or abolished. No policy should ever continue to exist for which enforcement action is not instituted consistently.

CONTENTS

No policy and procedure manual can be completely written in advance that will be applicable to any organization without customization and modification. The following is a list of basic subject areas – not in any specific order – that should be considered for inclusion in a security policy and procedure manual;

1.0 Statement from Executive Management
2.0 Security Department Mission, Purpose and Objectives
3.0 Security Department – General
3.1. Organizational Structure
3.2. Policy Enforcement
3.3. Investigations
3.4. Reporting
3.5. Background Investigations
3.6. Use of Force
3.7. VIPs
3.8. Communications
4.0 Security Department – Management
4.1. Authority
4.2. Qualifications
4.3. Liaison with Government Agencies
4.4. Periodic Departmental Reports
4.5. Security Awareness Training of Non-Security Personnel
4.6. Responsibilities
4.7. Staff Performance Appraisals
5.0 Security Department – Staffing
5.1. Qualifications
5.2. Uniforms
5.3. Equipment
5.4. Training
5.5. Post Orders
6.0 Security Department – Duties and Responsibilities
6.1. Policy Enforcement
6.2. Investigations
6.3. Response to Criminal Acts
6.4. Suspicious Persons
6.5. Emergency Conditions
7.0 Information Protection
7.1. Document Storage for Business Continuity
7.2. Document Destruction
7.3. “Clean Desk” Program
7.4. Trash Removal
8.0 Lost and Found
9.0 Courtesy Escorts
10.0 Cash Handling
11.0 Parking and Traffic Control
11.1. Vehicle Registration
11.2. Signage
11.3. Vehicle Removal
12.0 Security Responsibilities of All Employees
12.1. Reporting Incidents & Suspicious Situations
12.2. Cooperation in Investigations
12.3. Privacy and Consent to Search
12.4. Contacts by Governmental Agencies
12.5. Contacts by the Media
12.6. Cooperation during Emergencies
12.7. Protection of Assets
12.8. Prohibited Items
12.9. False Reporting Prohibited
12.10.Employee Conduct
13.0 Lock and Key Control
14.0 Material Passes
15.0 I.D. Credentials
15.1. Employees
15.2. Visitors
15.3. Vendors / Contractors
16.0 Workplace Violence
17.0 Ethics
18.0 Medical Emergencies
19.0 Fire and Life Safety
19.1. Systems Inspection & Testing
19.2. Unsafe Conditions
20.0 Audits of the Security Department
21.0 Access Control
22.0 CCTV
22.1. Overt Surveillance
22.2. Covert Surveillance
23.0 Security Screening
23.1. Pedestrians
23.2. Vehicles
23.3. Parcels and Packages
24.0 Emergency Conditions
24.1. Preparation of Emergency Plans
24.2. Incident Command
24.3. Drills and Exercises

Many people assume a security operations center only functions as an information crossroads during a crisis. A quality security operations center serves as a central hub for all safety and security operations. The operations center is the focal point for receiving, analyzing, disseminating and acting upon the information that flows through the center.

For participants to perform their tasks in a coordinated fashion, the design of the operations center must consider how work is performed, the number and types of staff in the room at the same time, the design and function of specialized furniture and the audiovisual systems type and placement.

In order to establish an adequately equipped and modern security operations center (SOC), managers have to include IT (plus audiovisual system subset) communications, space planning and furnishings. Everything mentioned must be in sync during normal operations, to ensure optimal operation during a crisis so that staff can collaborate and direct the activities both in the operations center and in the field.

 

Here are a few important elements of modern security operations centers:

• Facility design and layout: There are several ways to approach emergency operations center design and layout. The room layout could be a mix of different styles such as the traditional command center where rows of workstations are placed facing video screens, in an open layout style where workstations are placed around the room for open views, or the cluster style where workstations are placed together by function.
• Specialized furniture: The best furnishings for emergency operations centers are customized for each individual application and constructed of materials that will sustain 24/7 operations. This furniture should be ergonomic in design and flexible to meet the needs of the staff who will be working long periods of time under crisis conditions. For example, workstations with a monitor that can swivel, which allows the screen to be shared easily.
• Communications and dispatch consoles: These consoles are often in operation constantly throughout a crisis directing and coordinating activities in the field and keeping the operations staff informed of rapidly changing conditions. Because this equipment is important for proper management of an emergency, with operators spending long hours at the consoles, comfort and trusted functionality are paramount for effective performance.

As security operations centers design and functionality evolve, lessons will be learned and room layout, staffing and the tools they use will evolve with it.

With that in mind, you need to account for the steps to setting up the entire security operation center(SOC).

 

Check Out: What to Include in a COOP Plan

Steps to outfitting a new security operations center:

Formulate essential resources and assemble them: Members of the decision-making team may often be dispersed geographically and should be connected by:

• Large screen video walls
• Video conferencing capabilities
• Telephones, speaker phones or headsets.
• IT network with internet connectivity

Utilize emergency management planning and execution tools: Essential information systems should be shared by geographically separated operating locations. Software designed for SOC management should be in place and operations standardized.

Check Out: Strategies Behind Crisis Management

Establish separate conferencing and breakout areas: Agree upon the emergency operations center design and space allocation. Where possible, separate conferencing activities from the main operations center. Conferencing areas should have phone lines, internet connection, specialized furniture, whiteboards and integrated audiovisual systems.

Acquire large screen video wall: The latest video wall technology is essential as a primary tool for seeing and hearing what’s going on at affected areas. Utilize the latest security management software to gain the most from a video wall system. Modern video wall systems allow you to acquire multiple images, size and place them on the screens, and establish layouts with preassigned hot keys so that combinations of images can be displayed quickly. The video wall can be used for video conferencing, collaboration, directing operations, training and record keeping. Choose space-saving LCD video wall systems for relatively low purchase price, dependability and maintenance. Where appropriate, include integrated sound for low cost and ease of operation.

A security operations center that is not properly setup in design and equipment will not function properly.

When companies secure security guard services, they have a picture in mind of what their contract security force should look like, but too often what they end up with is not what they wanted. What is often the case is that while the security guard company may have the capability to meet the expectations, what they are often lacking is proper corporate security management. A site security manager provided by the contract security company, will be in charge of managing the security guards to the contract standards, but they are accountable to the contract security company at the end of the day. Employing a corporate security manager, there will be someone who is looking out for the company’s interests, and managing security through ongoing quality control reviews, as well as keeping the physical security procedures up to date.

Security guard companies are different from any other vendor that a company usually employs. If you hire a painter, you can see whether or not they are doing their jobs by looking at the walls. But when you hire a security guard company, how often can you see whether the guard company is doing their job which includes running background checks and drug screenings, providing good training for the guards, and effectively monitoring and supervising the guards. In most instances they probably are, but it is important to implement a system of verification and quality control of physical security management. A solid base for monitoring security guard services is a ensuring you have essential security policies in place. When you have that accomplished, you next need to follow the following 5 steps to improve your security guard services.

 

 

 

How to Improve Your Security Guard Services in 5 steps

1) Screen Your Guards Qualifications

In many states, security guards are mandated to have a specified amount of training before they can begin working as security guards. If your state is one of these states, ensure that your security guard company is compliant, do not just accept their word, ask for copies of the certificates.

If you are in a state where there are no state requirements for guard certification, then investigate the type of training that is being provided by your security company and ask yourself does it seem adequate. Doing this step during the contract negotiation means, if you find the security guard training inadequate, you can ask for more training or find a company that provides the level of security you are seeking.

Additionally, is your security guard company performing background and drug screenings on all your guards BEFORE they send them to your property? If they are, they should be providing you with verification. If not, why?

2) Assess Guard Training

Although most security guard companies have a very thorough orientation that introduces each guard to their company, in many cases the guard’s orientation to his assigned property is not as complete. We call the orientation for the assigned property “Site Specific Training”. Find out what your site specific training looks like:

• Does it occur at your property?
  • Who does the training?
  • How long is each new officer trained?
  • How long does the security company double bank? (Double banking is the process of having a veteran guard working at the same time as the new guard.)
  • How thoroughly are your post orders explained?

Corporate security management would be the ideal position to conduct this “Site Specific Training”, as they know the physical security procedures of the site, as well as the security policy.

Unsure of how to assess your guard training? Check out this post on Security Company Resource Center to help you better understand it.

3) Review Your Guard’s Supervision

Guard supervision is one of the more important factors of good security guard service. When security companies provide poor supervision, there is not enough emphasis placed on preventing mistakes, problems, and complaints. Lack of supervision also removes the opportunity for the guard to learn and better understand their duties. If the guards are not being supervised, they begin to feel that their work is not important and they begin to see themselves as less of a part of the security team. When guards do not feel like part of your team it typically leads to unacceptable practices such as unprofessional behavior, tardiness, and even theft.

Depending on the structure of your contract, on-site supervisors may not be included. If your contract does not require on-site supervision, how does your security guard company remotely supervise its guards? Outside of the normal security company field supervisor spot checks, the two methods of remote supervision that prove most successful are:

1. Officer Tour Tracking Systems
2. Officer Check-Ins

If your guards are required to make rounds of your property, then a system for tracking them while on duty is essential. This can be accomplished with a physical security checklist, whether on paper or done electronically.

4) Inspect Your Guards

After hours inspections of your guards are always great ways of finding out exactly what is happening with your security while you are not there. During these inspections, make sure to ask your security guards questions about their duties and responsibilities to ensure that they understand their jobs. In fact, we suggest having your security guards audited regularly, formally (i.e. post inspection) and informally (i.e. secret shopped) by a licensed security consultant as part of your ongoing security program.

5) Meet with your Security Guard Company Regularly

The fifth and easiest step is to regularly meet with your security company. Without providing regular feedback to your security guard company, property managers are missing out on opportunities to achieve incremental increases in efficiency. Topics such as tenant feedback, guard attrition, feedback from any remote supervisory systems, and any security audits should be discussed during these meetings.

Make sure your security policies are set up correctly.

For a professional corporate security manager, these 5 tips should seem commonplace, but many companies overlook them, and just keep switching contract security companies, hoping the next company, will provide solid security management.

Employing the services of an independent security consultant possesses several advantages: an unbiased point of view; a fresh viewpoint on old issues; as well as innovative views and solutions produced from an extensive record of experiences.

 

However, just like any significant security and safety decision, its best to conduct extensive research as well as to make inquiries beforehand. At first glance, using the services of a security and safety consultant for institutions and businesses to develop your current security plans and methods while reducing your security threats and vulnerabilities may look like a somewhat simple decision process for a business. However basic this project may look like, consideration needs to be shown when selecting a security and safety consultant.

 

These questions are important to ask, once you have decided to hire a security consultant. Check out this post to decide if you need the services of an independent security consultant.

 

Check out the Guidelines for hiring a security consultant

Listed below are some fundamental questions that we recommend for you to ask about your business and regarding the security consultant you plan to seek the services of:

1. Is my organization really willing to make changes?
   Your security consultant may ultimately recommend some significant changes in equipment, personnel, or procedures. Do you have commitment from your executive and/or lay leadership to spend the time and money needed to make changes? Will they back you up long term, especially when difficulties arise, such as employee resistance to change or challenges from shareholders? Will they follow-through?
2. Does this consultant know my industry and particularly the needs of my community?
   Analyzing threats for your particular organization or institution may be very different from evaluating dangers at other facilities and organizations. For example, violent, often deadly attacks are being perpetuated against the Jewish community, including children. The dangers posed to synagogues and other Jewish institutions are a matter of record. Therefore, while there may be some common issues with many religious institutions, there are enough significant differences that specialized experience and knowledge are crucial, particularly knowledge of anti-terrorism vs. crime prevention as well as an understanding of the special concerns of the Jewish community.
3. Are there competing or conflicting interests at work?
   Some consultants are truly independent, representing neither a particular company nor a particular technology solution. Others, however, may be using their consulting services as a door opener to sell particular products and services you may or may not need but for which a consultant may collect commissions or other fees.
4. Will you be independent or dependent when the project ends, meaning with the assessment process include justification and rationale for the recommended security changes?
   The ideal consultant will not only help you solve the current problem but also equip you with skills and knowledge to begin to tackle the next one. You may not be able to solve all future problems on your own, but you should know enough to begin preparing ideas.
5. Will the consultant’s services include training seminars, materials, or other extras to use with the staff?
   No doubt you’ll need to educate others within your organization about your new security procedures and changes. The consultant should have the skills and abilities to conduct implementation and follow-on training as required.
6. How comprehensive is the consultant’s knowledge and approach?
   In some cases, you’re hiring a consultant to solve a specific problem. Using a consultant that has a broader perspective, however, means possibly identifying and solving problems you may not have considered before.
7. Who’s on the case?
   You might have a highly experienced, senior consultant make the pitch to get your business. But will you ever see that expert again after you’ve signed on the dotted line or will your job be relegated to junior staff? Make sure you get the experience you pay for.
8. What are the steps in the evaluation, planning, and implementation process the consultant will use?
   Is it a cookie-cutter approach or are the consultant’s methodologies customized to your organization? For example, some security consultants use a cookbook checklist originally designed for another application, which is now relegated to being a catchall assessment used for every facility.
9. How does the security consultant meet reporting requirements?
   Make sure that you discuss exactly what it is you require from the consultant as a reporting deliverable (or series of deliverables) for your security assessment. For example, do you want the consultant to deliver the final report in a written form that may be discoverable through the Freedom of Information Act? Or would your requirements be better served by having the consultant give you an oral presentation of your vulnerabilities? Make sure these requirements are settled at the start of the project.
10. Can the security consultant offer advice on implementation and training?
    To ensure consistency in the transition from mediation recommendations to security systems implementation, it is best to ensure that your security consultant will be able to provide technical training for new security policies, procedures, and systems implemented as a result of your facility risk and vulnerability assessment. After you’ve gone through this “deceptively simple, yet endlessly complicated” process – from hiring a competent security contractor to implementing the contractor’s recommendations – the most important question remaining is, when do I start this process all over again? As your security consultant can tell you, the answer to that question is right away.

 

 

When a business hasn’t experienced a significant security incident for a while, C-suite executives typically become complacent and begin to question if all of the security procedures, systems and jobs currently set up are needed. However, complacency isn’t the right reason to reduce the security budget, particularly in a recession when crime usually increases. It is the responsibility of a security manager to make sure the organization always remembers the importance of physical security programs.

To avoid an upswing in security incidents, security management should conduct a physical security audit of their facilities. Evaluating current physical security procedures will reveal areas where security might need to be increased to protect the company’s assets, including facilities and employees.

To design a cost-effective security program, you need to carefully consider developing a well-balanced program. While designing a well-balanced security program, you will need to take note of the 3 fundamental components of physical security strategy.

Types of Physical Security

• Organizational (security staff and procedures as well as organizational security): Covering the involvement in the security programs by management, security staff, tenants and employees.
• Mechanical (electronic systems): Covering the use of security hardware including access control, Closed Circuit Television (CCTV), door locks, monitoring systems, emergency call boxes and intrusion alarms.
• Natural (architectural elements): Covering basic security philosophies involving property definition, natural surveillance and access control. Also known as Crime Prevention Through Environmental Design (CPTED), you are utilizing psychological techniques to reduce risk.

Unfortunately, countless security professionals concentrate too closely on just one of the three security concepts. A number of facilities depend too much on security guards who will be able to only protect a entrances or handle a limited number of people entering the building. Utilizing a massive security team is a sizable, long-term cost. Many other facilities concentrate on mechanical security, leaving their security team and tenants untrained and uninvolved in the security process. While other facilities go without the utilization of mechanical and organizational security, dependent upon the goodwill of others or simply the psychological effect of signage.

Establishing a security program that utilizes a balance of all the above physical security strategies, will keep the program flexible and ready to handle potential risks that may develop.

A physical security audit is the first step to proper design of a comprehensive physical security program. The following steps will walk you through the initial steps of conducting a physical security audit:

Check Out: Risk Assessment Guidelines

Examine Your Risks

Before you develop your security program, you must first determine the level of risk to your facility. The higher the risk, the greater need for physical security and planning. There are three forms of risk:

• Terrorism (International and Domestic)
• Criminal (Crimes against people and property)
• Environmental (Risk from nature or manmade incidents)

First, ask yourself these questions:

• Do you have neighbors who might attract unsafe individuals to your neighborhood for either terrorist or criminal activity?
• Does your facility contain individuals or activity that might bring risk to your doorstep?
• How well known is your facility on a local, national or international basis?
• Is your facility near railroad tracks, major freeways or a toxic manufacturing/storage facility?
• Are you near a university or college?
• Is your facility near a public park or government facility?
• Do any of the tenants in your building have negative media or internet exposure?
• Are there certain organizations that are not thrilled with the existence of one of the tenants in your building?
• What is the crime rate in your neighborhood?

The responses to these particular questions are going to determine the measure of risk for your facility. That is, an office building full of proctologists almost certainly carries a lower chance of terrorist attack compared to an office building containing a Federal Government Agency. A property positioned adjacent to an abortion clinic almost certainly carries a greater risk of becoming affected by safeguards or various other harmful events. A lot more Us office buildings have been evacuated as a result of toxic fumes from derailed trains and overturned trucks as compared to terrorist activities.

Check Out: Physical Security Risk Assessment: 9 tips to secure your workplace

Creating a Balanced Physical Security Program

Utilizing the aspects of organizational, natural and mechanical security you can develop layers of physical security around your facility.

Organizational Security

To begin with, who may be allowed in the building? The following recommendations come under the organizational method of physical security. In the event that your company is the solitary tenant of the building, what sort of background checks do you happen to be performing on new staff members or contractors? Are you able to know if the new personnel coming through the door is a legal resident of the United States of America? Does this new staff member have a record of violence, drug use or theft? In the event that they are handling cash, have you performed a credit check? Are you permitting undocumented associates of the cleaning staff to enjoy open access to every office in the facility at night? The expense of a background investigation for every new employee are dwarfed beside the losses you could possibly experience should you allow a violent person into your work site. In the event of contract companies providing staff to the facility, does the contract require the companies to perform background investigations of their staff, and can you at any time audit this process?
Do your tenants and staff members obtain some type of security and safety orientation? Will they be familiar with who to contact in an emergency? Do they understand who needs to have access to their work space? Do they know the emergency evacuation routes, and do they understand exactly where they need to meet once they evacuate the building so a headcount may be conducted? Is the lone emergency meeting location you have chosen in close proximity to any kind of potential neighborhood problems like a railroad track?

Do you have contact with community law enforcement representatives to know what is happening in your neighborhood? Do you have meetings with your neighboring businesses to discuss the issues they are facing? Could your company be impacted by a strike next door? Is one of your neighbors being threatened? Have any of your neighbors experienced an upswing in criminal activity? Do you have a clear communication method to pass this information to your tenants, employees, or neighbors?

More robust physical security controls, for instance physical security training as well as more effective background investigations, may have averted many of these attacks. Physical security controls consist of taking preventive measures to stop unauthorized physical access to restricted areas in addition to preventing physical theft. Insider threats to physical security may come from current or perhaps previous staff, contractors, or even respected business associates, which includes custodial personnel or security guards. Employees granted open access must be comprehensively vetted. As an example, custodial employees as well as security guards must submit to the exact same background investigation just like all the other insiders. Staff with this kind of access should likewise undergo regular security awareness training due to the fact their jobs cause them to become popular prey for social engineering attacks.

 

Natural Security

Now consider your facility perimeter utilizing natural security aspects. Look at your facility as a stranger might from the outside. Are your property boundaries clearly defined? Would a stranger know if he or she were walking or driving from public to private property? Is this clearly defined by signage or architectural design? Does the signage define the rules of your property? Are the rules enforced? Is your property given the appearance of being well maintained? Is graffiti quickly removed or covered? Are bushes trimmed low so they cannot be used for hiding? Is the lawn maintained? If you answered no to one or more of these questions, you will give the unsafe stranger the impression that you don’t care about your facility’s appearance and probably also do not care about security.

At night, is the area around your property dark and foreboding or well illuminated? Do your employees or tenants feel apprehension when they walk from your building to the parking lot or parking deck at night? Could they see danger at a distance or are there shadowy hiding areas where unsafe individuals could be lurking?

If you have a large parking lot or a parking deck, do you provide your employees, visitors or tenants emergency call boxes? Such call stations reduce the fear of isolation and distance. Are these boxes well illuminated and marked? Are they easily seen from all areas of the parking facility? Are the call boxes regularly checked to make sure they are working? Is there someone always ready to answer an emergency call from the call box? If the call comes in, will the person answering know where the call is coming from if the person making the call cannot speak?

 

Mechanical Security

The use of security hardware can greatly enhance your security program if there is a high risk to your property. How many entrances are there to your building? Are these entrances monitored? When we say monitored we could mean a lobby receptionist, a CCTV camera or an employee that can observe the entrance from his or her desk. Could an office creeper or stalker enter your facility without ever being seen or recorded by anyone or any system? Don’t forget about the back doors and the loading dock. These back doors can be a problem when they are left propped open by smokers. Limit the number of access points to your building and use some form of natural or mechanical surveillance so that those approaching and entering the facility have the feeling they are being monitored. You want to make the unsafe individual feel uncomfortable.

When using mechanical security systems, such as CCTV, look for systems that will give you the best bang for your buck. Which would be more helpful, a CCTV system that records individuals walking down a hallway at three in the morning or a system that records and alerts your monitoring station that someone is walking down that hallway and advising them what action may need to be taken? Make sure you are using all the features available in your security systems or that you purchase a system that meets your needs.

Access control systems provide a positive confirmation that the persons entering your facility or a particular strategic area are authorized. In very high-risk buildings or areas, the use access cards, combined with Personal Identification Numbers (PIN) key pad or a biometric reader will confirm a stolen access card is not being used to gain access.

Depending on the level of risk at your facility, you may want to introduce an inspection layer in your lobby. You may want to install signage that indicates you plan to randomly inspect packages carried in by visitors. You may have visitors walk through a magnetometer. Again, this will be defined by the potential threats to your facility.

One other access point is your air intake vents. This is not about a disgruntled ex-employee entering the facility through the vent, but instead introducing some toxic substances to your building to disrupt your operations. Are your air vents on the roof or at ground level? Many of these vents are in buildings built in the 1960’s, in the loading dock area where a badly positioned vehicle could introduce exhaust into the HVAC system. Are your ground-level air intakes monitored?

How quickly can you turn off your HVAC system in the event a foreign substance might be introduced to your system? Remember that question asked earlier about being near a railroad track, freeway or toxic manufacturing plant? If a toxic cloud were floating in the immediate area of your facility, how quickly could you turn off your HVAC system so the cloud is not sucked into the building? Before you say your HVAC system is automatically turned off when you sound the fire alarm, remember that audible fire alarm is also telling your employees and tenants to head outside into the toxic cloud when it might be safer to keep them inside your airtight building until the cloud disperses.

 

Levels of Response

Now that you created a balanced security program for your facility you have one additional concern. What will your security levels of response be? What we have described so far are the layers of security planned for your building on the average workday. What if your facility comes under some form of alert? The alert may come from some form of specific or general threat directed towards your building, company, tenant, area, city or country.

You need to develop a plan for additional layers of security in the event of such threats. It is important to pre-plan this higher level of security and have your staff pre-trained on the increased response. Don’t try to handle it on the fly. Will you add security staff? Will you shut down some access points? Will you increase access control? Will you start or increase package inspections? By having an increased security plan already in place with your staff trained in their new duties, when a threat comes around, you are ready.

 

As you can see, planning the security of your facility comes from using layers of organizational, mechanical and natural security. By using all these aspects of physical security, you can develop a physical security program that is both effective and COST effective.

As a physical security professional, you must know how what it takes to secure your workplace, for the safety of your coworkers, as well as for the security of the facility, this is accomplished with a proper physical security risk assessment. These days, companies need to address and prepare for security threats which are more substantial and diverse than any other time. With every technological advancement that enables innovative, effective business strategies, brings a security risk which is just as innovative and equally effective.
Every physical security risk assessment of a company security system must start with the specific security requirements along with the effects they are going to have on your business overall. You may want a facility secure enough for UL 2050 certification or perhaps you will simply have to ensure the staff safety before and after business working hours.

 

9 Tips for a Proper Physical Security Risk Assessment

.Effective Communication: Above all is communicating information to and between employees. A lot of companies utilize e-mail alerts to notify staff concerning would-be hackers. Likewise, make sure that staff remain informed on procedures and prospective site visitors. By letting staff understand what and who to be expecting, they will be better prepared to identify suspicious activities or people. So that you can prevent complacency, make sure to utilize a single way to obtain information that becomes a part of an employee’s habit. This can be a daily server broadcast or informational email. No matter what the source, it needs to be short, practical, and incorporate positive news along with precautionary information.

Key Control: Designate the commitment of locking or unlocking the workplace to as few people as is possible. Eliminating the “first in, last out” approach helps to ensure that all access points are properly secured on a regular basis. Develop a procedure for all those in charge of opening or closing your office which includes taking a look at washrooms, closets, and wherever an individual could possibly hide. Hard keys need to be numbered as well as assigned to specific people. staff assigned keys will need to be regularly be requested to produce their keys to validate against a master registry.

Site-Wide Policies: Something as fundamental as a “clean-desk” policy, training all employees to clear and secure their office desks of valuable equipment or information before departing for the day, significantly decreases potential theft. Mandating staff to possess and display ID badges or access cards all the time enhances the awareness of any unauthorized individuals. Don’t include things like job titles on any directory available to the public as a lot of criminals tend to use a name and title to validate their presence in restricted locations. Finally, be sure to maintain a “chain of possession.” All deliveries need to be given to a person rather then placed in a hallway or even on an unattended desk.

Check out this post on Risk Assessment Guidelines to better understand the process, if you need to.

Small Investments: All computers, laptops in particular, need to be properly secured with cable or plate locks to prevent “walk-off.” Docking stations are rather inexpensive ways to protect electronic devices while not being used. Take into consideration high risk targets such as state-of-the-art equipment, postage meters, check writers, and business checkbooks. Strengthen entry doors by installing peepholes as well as keypads. Implement 2 secured entry doors surrounding a small lobby or foyer. This sort of “airlock” method minimizes piggybacking; a technique intruders utilize to obtain entry by catching a locked door when an employee leaves.

Lights, Camera, Layout: Take note of “dark spots” either inside or outside the office. Put up ample lighting in parking lots and outdoor break areas for staff safety, prevent blind spots in stairwells, and organize hallways and offices to eliminate all areas in which an individual may conceal himself or stolen items. Lacking CCTV, highlighted below, it may be worthwhile to install recording security cameras at key areas like loading bays and access points like after-hours entrances.

Reception: Among the most complete solutions is to utilize one or more full-time receptionists. From a security process perspective, this person enables close examination of credentials and id and funnels security information by means of a single point. When it is impractical to have every site visitor greeted and checked-in by someone, look at a dedicated phone line in the lobby or at the front door that goes directly to a designated person. This process, along with a sign-in station, often is an economical strategy for a lot of offices.

Access Control System: Certainly one of the issues with hard keys is reacting whenever one is lost or stolen. With an access control system, businesses can easily issue access cards to staff while maintaining complete control over what each individual card can open. Additionally, access control systems reduce risk by permitting just enough access to accomplish a job. As a result, employees, contractors, or visitors will be restricted by area or time of day. A couple of things are important with access control systems. First, enable “total access” to as few people as is possible. This will directly clarify who is approved to be where and thereby enable staff to identify and report infractions. Second, maintain a record of the usage of every card. By reviewing card activity, it is possible to ascertain who requires having access to where and at which times, streamlining routines and defining access.

Closed Circuit Television (CCTV): For more advanced security system needs, CCTV is among the most effective method of protection. Using restricted broadcast, every camera is able to be monitored by means of a single user interface. Subject to the specifics of the system, footage may be monitored by a staff member or digitally recorded. Position cameras strategically to achieve the maximum coverage for a single unit. Additionally, cameras or corresponding signs which are visible to visitors and staff will be effective deterrents and create a secure environment. It is essential to keep in mind, however, that as effective as CCTV is, it must be utilized efficiently as well as in tandem with other preventive measures. As an example, installing a unit in an entry with an “airlock” door system enables extended recording of a person (s) entering or exiting the property.

Proper Training: Most of all, make sure that every one of your staff members is properly trained to utilize security equipment and follow procedures. Investment and planning in the ideal security system is going to have minimal effect if people are unclear on preventative measure and intervention. This can be as fundamental as ensuring staff keep doorways and windows secure or safeguard their personal belongings, but usually involves specific training on identifying and responding to suspicious items, persons, or events.

 

Hopefully you found these tips beneficial in conducting a physical security risk assessment of your facility and understanding the physical security needs of your location. Being able to clearly understand these tips and explain them to others for training or securing CAP-ex, is what will make you a successful physical security professional.

I am often asked, “Why should my company hire you as an independent security consultant?” The most significant reason is if you know little to nothing about security, then you need to hire an experienced professional security consultant that has the experience and subject matter expertise required for the tasks at hand. Security consciousness is a necessity for modern business managers. With this in mind, the selection of the security consultant(s) should also take into account their knowledge of the issues and conditions that are particularly relevant to the security threats that may affect your organization. A solid track record proving knowledge in these areas of specialized interest provides a benchmark that can be helpful when evaluating the subject matter experience of the prospective consultant(s).

 WHY HIRE AN INDEPENDENT SECURITY CONSULTANT

The first thing we need to do is define security.

Webster’s dictionary defines security as:

• the state of being protected or safe from harm
• things done to make people or places safe

 

Concerning security as a profession there is not truly a “universally accepted definition.”

Security is a hybrid profession blending various skills, backgrounds, and preparation. Security professionals have varying perspectives, often because of the unique degree of specialization required in their current assignment. Security provides those methods, either active or passive, which serve to protect and preserve an environment that allows for the conduct of activities within a business or society without disruption. There is a lot more than just looking at your doors, windows and locks or alarm systems to figuring out what security measures are needed to protect your synagogue, school, institution, or agency.

The primary goal of an independent security consultant is to prevent loss of life by reviewing your liabilities on security issues and reducing or eliminating them. Planning is required since it is an approach that recommends identifying and stopping a problem before it occurs, reducing hazards in given situations, and of forecasting rather than reacting to circumstances.

Competent security consultants know what to look for when identifying security issues and know how to properly mitigate the conditions through cost effective reductions/eliminations. After careful evaluation, it may make sense to use a security consultant to get the best security/cost value proposition you can; think of the expense as an investment for the future.

Before you hire a security consultant, make sure you know how to vet them, tips here.

An Independent Security Consultant can help you with the following issues:

• Negligent Hiring/Retention
• Premises Liability
• Negligent Security
• Hiring Contract Security Services
• Physical Site Security Surveys
• Anti-Terrorism
• Fraud and Internal Thefts
• Disaster recovery
• Risk Analysis
• Crime Prevention

Along with so much more.

 

Written security policies are essential to a secure organization. Everyone in a company needs to understand the importance of the role they play in maintaining security. One way to accomplish this – to create a “security culture” – is to publish reasonable security policies. These security policies are documents that everyone in the organization should read and sign when they come on board. In the case of existing employees, the policies should be distributed, explained and – after adequate time for questions and discussions – signed.

This article will introduce you to seven security policies that every organization should consider adopting. The specific policies that you implement, as well as the amount of detail they contain, will change as a company grows. Certainly, an organization with two employees has different security concerns than an organization of thousands. This list addresses both physical and information security issues, and is meant to provide a starting point for assessing your particular security needs, when establishing your security policy.

7 Security Polices Every Company Needs

Internet Usage

Below are some guidelines that a business should be thinking of using when they are looking to set up any kinds of policies in relation to the use of the internet during business hours.

General Internet  Usage:

• Internet usage is intended for job-related activities. Occasional brief personal use is allowed within reasonable limits
• The Company reserves the right to monitor internet traffic and retrieve any data that is composed, transmitted, or received and, as such, is subject to disclosure to law enforcement or other third parties
• Team members cannot pirate software, or download/copy software without authorization
• Team members should always ensure that the business information contained in internet email messages and transmissions is accurate, appropriate, ethical, and lawful

However if you are a company that is allowing all their employees to have access to the internet then rules and regulations must be in place that will restrict the amount of time that they use it for their own personal use. So therefore when writing up any kind of company internet usage policy document it should clearly shown within it when employees are entitled to use the internet for personal searches and when for company work. To ensure that your employees are sticking to the guidelines provided then a good quality tracking software program should be installed. This will then help you to track when and what your employees are using the internet for. However again employees must be made aware that their use of the internet is being tracked.

 Check Out: Physical Security Program – know the process

Email

What kind of subjects should you cover in the email section of your security policies? Here is a list of ten points to include:

• Email risks: The policy should list email risks to make users aware of the potential harmful effects of their actions. Advise users that sending an email is like sending a postcard: if you don’t want it posted on a bulletin board, then don’t send it.
• Best practices: This should include email etiquette and writing rules in order to uphold the good reputation of the company and to deliver quality customer service. For instance, include 6 etiquette rules:
  • Do not write emails in capitals,
  • Enable spell checking,
  • Read the email before you send it,
  • Include a signature that conforms to company format,
  • Use proper grammar and punctuation,
  • Include instructions on compressing attachments to save bandwidth.
• Personal usage: The policy should state whether personal emails are accepted and if so, to what extent. You can for instance set limits on the times of day that personal emails can be sent (only during breaks), or you could require personal emails to be saved in a separate folder. In addition, state that employees are prohibited from sending or receiving certain email attachments, such as exe, mp3 or vbs files. You could also include a maximum file size for attachments sent via email.
• Wastage of resources: Warn users that they are making use of the company’s email system and that they should not engage in non-business activities that unnecessarily tie up network traffic. The policy must also cover the use of newsletters & newsgroups. For instance you can state that employees may only subscribe to a newsletter or newsgroup if this directly relates to their job.
• Prohibited content: The policy should expressly state that the email system is not to be used for the creation or distribution of any offensive, or disruptive messages, including messages containing offensive comments about race, gender, age, sexual orientation, pornography, religious or political beliefs, national origin or disability. State that employees who receive any emails with this content should report the matter to their supervisor immediately. Moreover, employees should not use email to discuss competitors, potential acquisitions or mergers or to give their opinion about another firm. Unlawful messages, such as copyright infringing emails should also be prohibited.
• Document retention policy: Include information on whether or not email will be archived and for how long. If your organization is required to archive email messages, state that all emails will be archived and include the number of years that the records will be kept. If you are not required to archive your emails, notify your users about whether they can or should delete emails after a number of months or years.
• Treatment of confidential data: Include rules and guidelines on how employees should deal with your company’s confidential information and trade secrets. They should also be aware that they should not forward any confidential messages or attachments from other companies without permission. Make employees encrypt any confidential information that is sent via email and change passwords regularly.
• Email disclaimer: If you are adding a disclaimer to employees’ emails, you should inform them of this and state the disclaimer text that is added.
• Email monitoring: If you are going to monitor your employees’ emails, you must state this in your email policy. Warn that employees should have no expectation of privacy in anything they create, store, send or receive on the company’s computer system and that the company may, but is not obliged to monitor messages without prior notice. If you do not mention that the company is not obliged to monitor messages, an employee could potentially sue the company for failing to block a particular message.
• Measures & violation reporting: Warn that if an employee is found to be in breach of the email policy rules, this could result in disciplinary action, up to and including termination. If an employee witnesses email policy abuse they are required to report the incident immediately. Include contact details of who to contact if a violation of the policy rules is detected. This could be a supervisor but it might also be a good idea to appoint a specific contact person to report email policy breaches to.

 

Social Networking

While you might not have a large staff now, it is a good idea to put an online networking policy into your security policies as soon as possible. Make sure that everyone is aware of the social networking policy when they are first hired. Here are some things to consider when you are coming up with the social media policy for your company.

Social Media Presence:

• Remember to act respectfully at all times when interacting on social media platforms
• Confidential company information should be kept off social media
• Team members should follow company guidelines for how to talk about products (or services) to keep with brand image
• Should team members see negative content regarding the company on social media, they are to follow the set engagement procedures in order to react properly
• Be sure to create a secure password and avoid default privacy and security settings for personal social media pages

• What your employees are allowed to say about the company.
  • I am not suggesting that you totally censor your employees. However, you do have a certain public image to uphold. You have to decide early on what you are going to allow your employees to say about the company on social networking sites. This is definitely something that needs to be outlined in the handbook you create about your company’s social media policy.
• Is there a particular point person to send media requests to?
  • Your employees may run into members of the media while they are networking. The journalist may want to ask them some questions about your company. You have to decide if you want your employees to be able to answer those types of questions themselves or if you want one employee to be the designated spokesperson for the company. Whatever you decide, make sure to communicate this to all staff so there is no confusion.
• What employees are allowed to post on online networking sites.
  • Once again this is a matter of protecting your company image. Your employees are a representative of you. You need to figure out what kind of information you want your employees to post on social media. Are they allowed to reveal your company name on their personal profiles? Can they post pictures of themselves at work? Is it okay for them to post pictures of themselves drinking alcohol? These might seem trivial, but it is important to let your employees know beforehand what they can post rather than trying to discipline them when they cause bad publicity for the company.

Having a social media policy is important for you and your employees. It helps your employees to know exactly what they can and can’t do with their social media profiles. It could also protect you from future lawsuits since the policy will be spelled out in black and white. Now stop reading this article and create a social media policy for your company.

 Check Out: Layered Security

Access Control

You need to have an access control procedure, not just for visitors, venders, and guests, but also for employees, as not every employee needs access to every area. Ask these questions when developing an access control procedure for your security policies:

• Do they have a need to be there? If an employee’s job does not require them to be in an area, clearly state that area is off limits, or set a physical control like key or electronic access to ensure it is enforced.
• Will they need to be there escorted? A good rule of thumb is to clearly state areas like an HR office are restricted access, and only select personnel are authorized access unless escorted by select personnel, other offices and areas may need the same type of policy.

Check Out: How Do Your Alarms Communicate

Mobile Device Security

When you issue company business mobiles you are faced with many pros and cons, one of which is convenience and productivity while the other drawback is how to restrain mobile phone use as you keep your company liabilities at a minimum.

Here are some ways you can create security policies with respect to the use of company issued handsets:

Dispel privacy breach concerns with your company issued mobile phones. Make it a point to inform your employees that they do not have to fear their privacy being breached with the issuance of company mobiles. By doing this, you eliminate the probability of other problems or lawsuits from arising in the workplace.

Be sure that you own the phone numbers issued. It is very vital that you keep ownership of the phone numbers. You have to be clear with this in your policy. It is because you want to limit the likelihood of a leaving employee from further soliciting or doing business with your customers once they are gone.

Check monthly charges from time to time. The moment your employees know that their bills are being checked on a regular basis, they are less likely to incur unexplained surcharges or other unnecessary charges like for instance the purchase of unauthorized 3rd party content such as apps, ring tones, or even mobile games.

Report lost or damaged devices as soon as possible. The instant a company mobile device has been lost, damaged, or stolen, tell employees to report them immediately so all related services will be turned off the soonest time possible. There are some mobile apps that enable users to remotely track a mobile phone’s SIM card and delete all private data once lost or stolen. Expressly indicate who will shoulder the costs in case of loss or damaged business mobile phones. If it’s the employee who will have to bear the financial burden, then by all means let them know and have them sign up an acknowledgement agreement to that effect.

Inform them about GPS tracking. There are several mobile phones out there that come with software that does not only allow GPS navigation but also tracks the bearer. You have to expressly let them know that their business mobiles will come with a GPS tracking feature. Businesses in the field of logistics highly benefit from this practice.

 

Visitor Management and Safety

An unauthorized or unescorted visitor can be a physical threat and can also steal sensitive information. If possible, steer all visitors into a controlled entry point, be it a gate or receptionist’s desk. When writing your policy, decide whether visitors should be escorted at all times, or only in certain areas. Requiring visitors to wear a badge and sign in and out should also be considered. If your visitor management policy is communicated clearly, employees can more easily serve as your eyes and ears as they will feel more comfortable approaching or reporting a suspicious individual.

It would be wise then to craft a safety policy for visitors along the same lines as employers do for workplaces.

1 – Visitors must be notified of any hazards they might encounter.
2 – They must be made aware of all protocols and procedures in the event of an emergency.
3 – All visitors must sign-in and sign-out of your facility.
4 – Similar to all workplaces, must be provided with the appropriate personal protective equipment (PPE) and on its use and reason for it.
5 – Care must be taken to ensure proper fit and use of the PPE.
6 – Visitors must be oriented properly and advised on the basics of behavior during the visit.

Non-Disclosure Agreement

What is a Nondisclosure Agreement?

Fortunately, the United States legal system has several safeguards to protect intellectual property rights. One of these is the nondisclosure agreement (NDA), also known as a “confidentiality agreement.” This is a signed agreement between two or more parties which states they will keep confidential specific information shared during their business relationship, or in the course of a transaction. In the business world, an idea, formula, or process can be a company’s most important asset. The NDA ensures that a company or individual retains exclusive rights to their intellectual property. When you hire a company to manufacture your plush toy, an NDA gives you the assurance that your ideas (and profits) remain yours and legal recourse if it does not.

Types of NDA

There are two kinds of NDA. With a one-way NDA, only one of the parties is disclosing information. If you are hiring a company to produce your plush toy, but that company will not be sharing proprietary information (such as a secret method of stitching) with you, you may only need a one-way NDA. A mutual NDA is necessary when everyone involved in the process is sharing private information. If you sell a new manufacturing process to a soft drink company which shares a secret formula with you, you’ll both want a mutual nondisclosure agreement.

Contents of an NDA

A good NDA contains:

o Definitions of the shared information. For example, yours might include “the design for Skippy the Cat,” without describing the confidential information itself.

o Exclusions. Not all information needs to be confidential. This protects the recipient, in the event that it possesses or discovers information independently of its relationship with you.

o Recipient’s Responsibilities. Shared secret information must remain secret. Neither party can share it or use devious ways to steal it.

o Time Limit. Although you might want your idea to remain secret forever, this is not always going to be the case.

o Miscellaneous Clauses. These are various legal details, such as how a breach will be handled, who will pay attorney fees in the event of a lawsuit, etc.

BONUS: Workstation Security

Physical:

• Ensure monitors are positioned away from public view
• Use screen privacy filters for added security (especially in open floorplan offices)
• Always lock computer (and protect with a password) when stepping away from your desk
• Log off workstation at the end of each business day
• Keep food and drink away from your workstation at all times
• When taking your laptop or other company owned devices out of the office, be sure to keep them in your trunk
  and out of plain sight

Operational:

• Only approved personnel may install software on workstations
• All sensitive information must be stored on network servers and not the workstation itself
• Follow all authentication and password management requirements

 

Conclusion

One key to creating effective policies is to make sure that they are clear, and as easy to comply with as possible. Policies that are overly complicated only encourage people to bypass the system. Don’t make employees feel like inmates. Communicate the need, and you can create a culture of security.

There is always a trade-off between security and convenience. You would like to board a plane without going through the TSA checkpoint, right? But how comfortable would you be knowing that no one else on the plane had gone through security either? The policies described in this article will help to ensure that you and your employees are protected.

For help in developing security policies to protect your organization and its employees, Contact me, I am available for assist you in your security policy development, or any other security needs you may have..

You’ve got a few security guards and your CCTV system is up to snuff. You’ve got your building security covered, right? Think again. While many organizations are taking the steps to ensure their building is secure, many are ignoring basic pieces of the puzzle that is physical security in and around a facility.

Here’s a rundown of some common missteps organizations make when devising a building security plan.

 

7 Sins of Physical Security

1.) Creating post orders without advanced analysis

Most companies don’t have an inside person with facilities security expertise.  Often the facilities
manager will put together a guard services contract and contract services with a company and they really have very limited ideas about how to manage it.

The problem is that an outside contract company will often come into the assignment with their own post orders and place security personnel without first conducting a real analysis of the security needs of the
building. And because there isn’t an experienced person within the company that understands security, there is no system of checks to ensure the contract security personnel are doing what they should be doing. (Read a first-hand account of how easy it is for criminals to get in the door of a secure building
in Anatomy of a Hack) Before any contract security services firm creates post orders for a building, they should first conduct a thorough assessment of the unique needs for security in the facility.

Buildings differ primarily because of who the tenants are. Security needs to evaluate who is in there and what kind of risks they bring with them. Some have a high-traffic volume of visitors. They could be controversial; some might face the possibility of problems with former or disgruntled employees.
All of those things dictate what security should be doing at their posts.

2) Placing aesthetics over security

This mistake can be made as early as when the building is designed by an architect. While ground-level lighting and hidden cameras may be more pleasing to the eye, neither are good for security. We’ve even worked in a building where the architect had designed all the cameras to be out of sight.

But someone seeing the camera is 50 percent of the value because it’s a deterrent. When people know they are on camera, they are much less likely to do something wrong.

Another common design we see that makes us cringe is shrubbery that runs along walkways and sidewalks.  Suddenly someone who wants to rob someone has a nice hiding place.

Check Out: Common Security Vulnerabilities

3) Neglecting to properly secure certain entrances

We believe in the rule that the fewer entrances into a building, the better.  Every door is
another opportunity for someone to get in. While it is important to have several doors for emergency
exits, they all too often get neglected. We suggest alarms at all doors that have been designated as emergency. Employees should also be asked to demand ID or badges from individuals entering a secure building, and noted the best defense against intruders is a good security awareness program among workers that gets them to notice what is going on around them.

4) Allowing management to ignore security rules

Sure, a good awareness program might ask employees to “check” on one another to ensure they are wearing badges or ID. But what if management is neglecting to follow the rules? It is a physical security mistake we see all the time.

You have to make a choice. If you are going to have badge-wearing program, you have to wear the badge. If you’re not going to wear one, do away with the program because if you don’t wear it, you undermine the program.

5) Failing to take time to understand your technology

Physical security technology, such as CCTV, has come a long way in the last decade. The problem is many people don’t know how to use it. Often, a good CCTV recording system will be for naught because if there is an incident, the staff doesn’t know how to find the recording they need.

Companies will have a contractor come in an install the cameras, and then there is no follow up to learn how to really use it.

Another common scenario is a building with 40 or more cameras around the facility which use a multiplexer to toggle between cameras and record images. But the switching is done at random and is therefore of little use.

If you don’t set that up properly you might have situation where a person is breaking in a door but you don’t capture the event because the recorder was not on the door at that time.

Instead, monitoring systems be configured to have event-driven recording, which means a camera is activated where ever an alarm goes off.

Check Out: How do your alarms communicate

6) Failing to secure important rooms inside the building

You may have people working the server room all the time (in organizations), but now they can control what is going on in there remotely. So if someone is going in and out of there, you really want to know who it is and why they are there.

Consider access control systems around data centers that include badges and/or access cards as well as cameras. Also, if you have concerns about proprietary information – secure your mail rooms as well.

Check Out: Transparent Security – not seeing it is the point

7) Overdoing security

Lastly, it’s important to remember that these tips are not a one size fits all prescription for your building’s security. The level of facility security will need to fit the level of risk an organization faces.

We’re opposed to going into a facility and having them do as much security as they can do. If you overdo it to where it doesn’t make sense, within six months people will have figured out ways to get around security, not to be dishonest, but to avoid the hassle and it will be a waste of money. It has to match the risk and culture of the business.

 

If you need your physical security processes reviewed, please feel free to contact me.