How Preventing the Wrong Threat Will Cost You

My nephew used to work for an IT company.  Upon returning to work after Christmas holiday, they noticed that the rear windows of the building had been broken and all of the computer equipment had been stolen.  The owner of the company did what anyone would do.  He called a security consultant. 

The consultant recommended fixing the windows, adding motion sensors in the hallway and an access management system at the main entrance.  


When the company employees returned after the Easter weekend, they noticed the rear windows had been broken out – again, and all of the computer equipment had been stolen – again. 


Why did this occur?  The security company had misanalysed the Design Basis Threat or DBT.  

Everything of value has a threat that goes with it.  If it has value then someone wants it - either the owner or someone else.  It is also possible that a treat can be naturally occurring, like a earthquake or tornado. Usually, protection from these types of threats are governed by ordinances or laws; i.e., earthquake or tornado protection in construction standards.  For man-made threats, on the other hand, there really isn't any legislation that governs prevention or protection, so it's up to us to focus on man-made threats.  There are four general categories of aggressor types; 1) criminals (sophisticated/unsophisticated and organized/unorganized), 2) protestors (both organized/unorganized), 3) terrorist (domestic/trans-national/state-sponsored, and 4) subversives (saboteurs/foreign intelligence agents).  Each type of threat has an Modus Operandi or tactic and tool it uses to execute its objective.  If you make a list of what those may be you can actually design the space so that it provides protection to the things of value inside.  It is also important to understand the objective of man-made threats, too.  They fall into one or more of these categories; 1) inflict injury or death to people,2) destroy or damage property, equipment or resources, 3) steal equipment, material or information, or create adverse publicity. Understanding the motives, the tactics and tools they use will go a long way in prevention and protection.

The solution the security company had provided failed because, they didn't address the correct DBT; which was, breaking and entering and not unauthorized access.  Although, entering through the window is a form of unauthorized entry.  They had recommended the solutions they normally would suggest to deter or reduce the effects of theft, and focused on electronics, but they hadn’t addressed the DBT of the windows being breakable in the first place and didn’t add non-electronic solutions to the mix.  Had the windows been replaced with laminated glass they would not have been able to be broken and then the other countermeasures would have been effective.  Another solution would have been to prevent access to the parking lot behind the building.  I don't prefer this method because it would be more aggressive and unsightly to use a gate or fence with gate.  Just replacing the windows would not have changed the aesthetics of the space, so that is my preferred solution.

More about non-aggressive/aesthetically pleasing security measures can be found here: https://www.securityindustry.org/2018/04/05/the-puppy-movement/

Case Study: Unimpeded Access Allows Illegal Dumping

The issue was that people were driving up to the banks of a stream and dumping trash; i.e., tires, mattresses, rubbish, etc.  The city called a security consultant.  And as expected, he recommended adding a camera to the site so that “things” could be monitored.  The camera fed back to the superintendent’s desk.  Of course, when the supervisor wasn’t there (weekends, evening/late at night, attending meetings, lunch, naps, etc.), all the time when someone would dump trash the dumping occurred and continued.  The superintendent was scratching his head on what to do.  After all, he just spent several thousands of dollars on the latest technologies and they didn’t seem to work.

Our solution was not electronic.  Instead, we suggested that they build a raised berm/curb using natural landscaping (trees/boulders/bushes, even park benches) so that the vehicle couldn’t drive up to the water’s edge in the first place.  We suggested specific landscaping strategies due to low cost and ability to prevent vehicles from reaching the stream.   We imagined that since the culprits couldn’t physically access the stream embankment without using a vehicle they would be  less likely to want to carry heavy objects from the roadway, across a bicycle/walking path and then into the wood clearing to reach the stream.  Our second reason was to ensure the aesthetics of the area were kept intact.  Sure, we could have suggested a fence along the embankment to deny access and achieve the same effect, but who wants to walk along a fence with barbed wire when they’re taking the dog out or jogging or cycling.

Related articles: 

https://www.securityindustry.org/2018/04/05/the-puppy-movement/

https://www.securityindustry.org/2018/09/14/creating-invisible-security-to-prevent-vehicular-attacks/ 

https://issuu.com/eqinternational/docs/urbana_25_april_2017-ilovepdf-compr/52

YEP – IN SECURITY WE STILL NEED TO OCCUPY THE GROUND, WE CAN’T LEAVE IT ALL UP TO ELECTRONIC TECHNOLOGIES 

Despite the advances in electronic security technologies one fact remains, we (“the good guys”)still need to occupy the ground.

As many of you know, I’m a former Air Force Security Policeman – a blue grunt, if you will.  So consequently am a little partial to “zoomies” when it comes to the defense of the country.  Our strike capabilities are so sophisticated that we really don’t need the other services (now, don’t get your knickers in a twist and let me explain).  We could just bomb the hell out of the bad guys until they surrender.  But bombing the hell out of them doesn’t do anything for us, because in the end we still have to occupy the ground.  And that’s why the Air Force is just not enough.

The same holds true in the security business.  Everyone is moving towards electronic technologies and the advances in predictive behavioral analyses and other artificial intelligence (AI) technologies is “mind blowing”.  

In the ‘80’s we posted guards, in the ‘90’s we put cameras because guards became expensive and since that time we’ve been using analytics to understand better what we are observing.  With the technologies that are currently “off the shelf” we can do allot more than we used to be able to do.  We can have one guard monitor several cameras and with analytics s/he uses can monitor even more as the software interprets what it’s seeing and notifies those responsible when something is amiss.

This is all well and good, but electronics can’t do it alone.  We still need to “occupy ground”.  By that I mean we need to design the built environment so that it complements the technology we use.   The use of non-electronic technologies will become even more important in the future, and especially in the urban environment.

The city of New York employs thousands of cameras around the city but they also deploy thousands of beat officers.  Both rely on each other to enhance the other‘s effectiveness.  If a patrolman sees something, she/he can have a colleague at the central station bring the field of view into focus and zoom in.  And by looking at adjourning screens or from different angles maybe get a clearer picture of what is happening.  Likewise, if the monitor sees something suspicious, he/she can dispatch a patrol to investigate further and cover those areas that the camera can’t see.

So with the utmost respect, we still need the grunts.

The Truth About Walls (Fencing)

A few years ago, I was asked by the editors of Security Middle East magazine[1] to write an article about perimeter security.  During the conversations with the editor that lead to the eventual article, she asked me to summarize what the article would be about.  I told her that in order to understand perimeter security you first needed to accept the fact that if you have a ten-foot fence the bad guy will bring an eleven-foot ladder. 

The idea that you can build a fence or wall and keep the bad guys out faded out sometime after the medieval ages when new technologies and new ways of conducting warfare came about.  Well, the same holds true today.

If you look up on Google the difference between a wall and a fence you’ll get the following explanation: “A fence is usually a wooden or metal structure that encloses a yard, pasture or other area…The difference between a fence and a wall is that you can almost always see through a fence, at least to some degree, while a wall is solid”.

If you look up fence purposes, you’ll get the following explanation; “A fence is a structure that encloses an area, typically outdoors, and is usually constructed from posts that are connected by boards, wire, rails or netting.  Alternatives to fencing include a ditch (sometimes filled with water, forming a moat)”.

Both definitions suggest that a boundary is formed between property that is not controlled and property that is controlled. 

Whether using a wall or fence, the purpose is to delineate a boundary; usually at a property boundary.  This is the true meaning of fencing or "walling", if you will.  To delineate property boundaries, in other words, you’re over there and I don’t care what you do but it you come over here you need to go down to the access point so I can check you out.  With that in mind, you could paint a line on the ground and put up a sign that says, “stay out or go over there for access”.  Both would achieve the same effect as a wall of fence.  So, why not just paint a line.  Because the value in constructing a fence or wall, is 1) to identify the boundaries of the controlled space, 2) to cause a delay in unauthorized access, and 3) to identify unwanted behavior.  An authorized person will not climb over a fence or wall, tunnel under it or cut through it.  An unauthorized person will, especially if they have nefarious intentions.  So, with that in mind, the fence serves an early warning system.  It tells us when someone breaches it that they have  “bad intentions”.  If they didn’t, they would not breach the fence/wall and would proceed to an access control point to display the proper credentials to gain entry.  Hopefully, the fence will be constructed in such a way as to delay their unauthorized access.  Sadly, even without tools a eight foot chain link fence with three strand barbed wire outrigger can be scaled or climbed over in about four seconds.  With tools, like a ladder or a truck to stand on it takes even less time.

Which brings us to the next truth, unless there is a guard or technology monitoring the fence-line in real time, we have no way of knowing if the boundary has been breached.  We must monitor for unauthorized access, respond to it, and engage the aggressor in real time.  The operative word here is “real time”.  If we don’t what’s the use?

Another thing to remember, no matter how solid, sturdy, high or how many bells and whistles are added, there will always be a way to circumvent whatever is put in place.  The key is, making sure there is enough time to delay the “bad guy or gal” so that his or her behavior can be identified and the “good guys/gals” have time to respond and engage.

---

[1] Security Middle East magazine article More Power to the Perimeter link https://issuu.com/securitymiddleeastmagazine/docs/sme_july-_aug_2015_web?e=0/14330179

How to Protect Yourslf Against Burglary or Housebreaking by Using Surveillance Systems and Safe-rooms

I was watching the news the other night and just like every night, they were showing criminals that had broken in to homes while the owners were away.  There was even footage of the family dog chasing the burglar away.  But one story caught my eye.  It was the story of a homeowner who had installed a doorbell system with a camera.  We’ve all seen the ad where the bad guy approaches the home and the owner say “Get off my lawn” or something to that effect.  Then the perps run away.  It was one of those types.

In this particular case, the homeowner was inside the house with her son.  When the would-be burglar approached the door she got an image of the burglar standing by her front door.  He knocked on the door and pulled a gun from his waist band.  The homeowner took her son and hid in a closet and called 911.

Can’t say I blame her.  After all this was more than a burglary this had all of the potential of being a kidnapping, sexual assault or worse.  I think she did the right thing in hiding.  That said, however, a closet offers very little protection from a dedicated intruder.  What she needed was a closet that had been converted into a safe-room.  A room that was impenetrable from the outside.  There are materials out there that can be used in new construction or retrofitted to an existing closet space for a few thousand dollars. It could even be a DIY project over a weekend.  Shouldn’t every home have one? 

But the real problem here is that the homeowner had bought the security system thinking that it would protect them.  I guess it did, sort of, because she was able to see the perps and take action.  The standard action is to tell the perps to go away.  She didn’t do that, so in essence she didn’t use the system the way it was designed to be used.  Fortunately, the perps weren’t able to force the door open and eventually gave up and left. 

There are two things to remember about having a home security system; 1) it must be used the way it was designed in order to be truly effective, and 2) unless, there is a police or guard force’s immediate response, it really only collects evidence.

More about turning a closet into a safe-room, here:  https://drive.google.com/a/amuletbb.com/file/d/0B_EElZXso5ZmdUVZYVlXNFRscEU/view?usp=drive_web

More about how thieves target homes, here: https://www.linkedin.com/feed/update/urn:li:activity:6466683287757733888/

More tips on what you can do so it doesn’t happen to you, here:  https://reader.mediawiremobile.com/NYREJ/issues/203922/viewer?page=57

A one-day class on safe-room and shelter design and construction will be conducted on 20 June 2019.  Sign-up by calling 805 509-8655 or sending an email to info@hainessecuritysolutions.com  

If Data is the New Currency of the Modern World Then Why

Is My Account Overdrawn?

According to a recent report in Security Megatrends: The 2018 Vision for the Security Industry published by the Security Industry Association 99.5 percent of all data collected via electronic devices goes unused.  Let that sink in for a second.  99.5% is wasted.  Less than .5 percent is accessed, analyzed and used in some type of constructive way.  I can’t imagine any other industry or area of life where less than one-half of one percent is good return on investment (ROI).

Here’s some data provided in the article "Accessing and Analyzing Smart and Big Data, Moving into Artificial Intelligence and Augmented Reality", using 60 seconds as the baseline, on just the social media platforms that I use:

·         Google – more than 3.8 million searches

·         Twitter – more than 350,000 tweets

·         Facebook – more than 243,000 photos uploaded and 70,000 hours of video content viewed

·         Linked-In – 120 new accounts created

So, why does this occur.  Well, it has to do with automation and the progressive nature of technology.  We’ve all heard the standard cliché that your phone has more data processing capability than the spaceships that went to the moon.  There have been surprising advancements in just about every sector of society.

I read an article some time back, that said your bank account could be hacked through your toaster.  At the time, I thought it a bit far-fetched,  But now the home improvement stores are selling refrigerators that can order food for you, if programed properly.  While, I think that was a little exaggerated but the point the author was making was, if your toaster has a microchip in it and that sensor report data somewhere, there is the potential that a person with malicious intent could through that sensor get to my bank account.

But is this a good thing?  For the most part yes.  I mean, think about it, only a few decades ago, if you were diagnosed with the big “C”, you started counting your days.  Now, more people survive and overcome the disease than don’t.  But on the other hand, let’s not get too carried away.  Technology is a tool and should be used as such; a tool that allows us to make better decisions about life choices.  Let’s remember that technology is not the solutions but it can be used to find the solution.

One of the areas where there is promise, within the security industry, is the area of “augmented reality” or AR.  We’ve all heard of “virtual reality” where the user is immersed in a fictional environment.  With AR the data augments the natural environment.  A simple example would be the ability to super-imposed a data screen on the visor of a motorcycle policeman that presents him or her with information about traffic up ahead, including accidents or breakdowns.  Or data information relayed to first responders during active shooter events.  This ability will undoubtedly save lives.

Estimates are that the Internet of Things (IoT) will mushroom in the coming years to between 34 Billion and 58 Billion devices connected to the data grid in some way by 2020.   Even if the world population doubles in the next two years (which is highly unlikely) that’s more than two devices per person.  

The hard part, in all of this is, will be figuring out what data to analyze, what to keep for the future and when to give it to someone to use now.    

The Marriage of Cyber and Physical Security is Not a

Match Made in Heaven

Megatrend #2 from Security Megatrends, The 2018 Vision for the Security Industry, produced and published by the Security Industry Association (SIA) is, “Cyber Meets Physical Security, Threats Magnify with Digital Innovation[1]”  hits the proverbial nail on the head.   With the connectivity of electronic devices to the internet, more and more of the different technologies we use in our daily lives are susceptible to compromise.  I read an article about a year back that talked about how in theory your new toaster could get hacked by someone with nefarious intentions and through that connectivity could steal your personal identifying information (PII).  While I believe that scenario to be a little far-fetched, I do believe the point was made.  The point being, that my smart phone, smart TV and even my smart refrigerator, especially if I had it set up to automatically order milk or bread for me directly with the store, is highly susceptible since I would most certainly have payment information in my stored profile.

The connectivity to the IoT is inherently vulnerable.  Since there’s an electronic connection, eventually given enough time, a “bad guy” will figure out a way to breach whatever security systems are in place.  Just ask Equifax, Sony Pictures, Target, etc.

The only absolute way to keep a breach from happening is not to connect to the IoT.  Unfortunately in today’s world that is just not possible.  We cannot function without being connected.  Now even my wife’s Jeep’s telling her she need servicing, before it was, “Hey, Honey, there’s a red light on on  the dashboard.  What’s that mean? “  Now, she gets a message on her phone that tells her  the tire pressure’s too low.

This convergence of cyber and physical means that physical security must be much tighter than it’s been in the past.  We can’t rely on the good guys to build a strong enough firewall, while vitally important, equally important is the physical security piece.  We need to teach our folks and ourselves how to spot vulnerabilities and how to protect those vulnerabilities from being exploited in a language they can understand.  I know a software engineer and whenever I talk with him, I have no idea what he’s talking about.   Listen if it’s a burden – I can’t understand it – I won’t do or use it. 

The vetting process, to ensure the right folks are working on our systems has to be comprehensive and continual.  Just because a person gets the job, it doesn’t mean the vetting process stops.  The vetting process must be continuing.  Physical security measures must also make sure that only people that have been cleared can physically access systems that they’ve been cleared for and not have a general run of the place.   I believe the DIY days are over.  Sure, there are some things any person should be able to do, like follow the tutorial on setting up a TV but other things that are in the Settings should probably be left up to an expert to change.  There is a tremendous assumption that just because I can read I can also understand the code being spoken.

Cyber security focuses on cyber-threats and the ability to detect and mitigate ransom ware attacks, especially as they’ve become a popular mechanism to extort businesses, will become more and more important.  I’m beginning to understand less and less about computers, how they work and what they can do to make my life simpler, because I have to do more and more of what use to be done by that weird guy down the hall.

I’m not sure I’m ready to have a micro-chip make all of the decisions of my daily life for me.  I have a feeling, it’s going to be a “rocky” marriage because I can't divorce her.

Next month:  If Data is the New Currency of the Modern World Then Why Is My Account Overdrawn?

---

[1] Security Megatrends 2018 edition is available here https://www.securityindustry.org/report/security-megatrends-2018-vision-security-industry/

Security Opportunities within the Booming IoT Market

The Future is Bright for Non-electronics, Too

The term Internet of Things was coined back in the late 90’s.  The somewhat official definition is “A network of dedicated physical objects that contain embedded technology to interact internally or externally”.  I think we can all agree that is a very broad brush definition.  I would rephrase it to be, basically “an ecosystem that includes electronic things, and the communications and data analysis between them”.

With that in mind, let’s look at where we are today and where we’re going.

Today there are an estimated 7billion devices connected via the internet and applications that use the internet.  That’s a device for every human on the planet.  In just five years that number will increase to over 50billion.  The use of The Cloud is fueling this increase.

What does this mean for the security profession?  Simply put lots of openings and an unlimited number of chances.  In other words, if you can think it, you can make it happen. 

This increase in the realm of possibilities will affect every aspect of our daily lives.  So whether you’re involved in the residential, small business or corporate security market, you can make it.

I usually think of security solutions as following into one of two spheres – electronic or non-electronic.

ELECTRONIC TECHNOLOGIES

Electronic technologies are just that – technologies that are electronic.  Kind of a no brainer, don’t you think?  These technologies run the gamut from intrusion detection systems to access control to surveillance and beyond.  They’re becoming ever more sophisticated and complex.

Unfortunately, as technology evolves it will probably become more invasive.  It will collect more and more data about you. 

These invasive technologies already assault our daily lives.  Just imagine how that will change in the future.  While there is tremendous resentment about governments collecting data on individuals.  Companies, such as, Google, Amazon, Microsoft and other major retailers are doing it and no one really seems to care.

The use of cellphones will become almost an extension of ourselves.  We will be able to do everything from or with our phone.  I suspect someone is going to develop a security app that will read your blood pressure or your heart rhythm to authenticate that you are the correct user, instead of the fingerprint reader or PIN code of today.  Your phone will become your “Mini-me”.  It will know your behavior patterns well enough to “help” you make choices.

If you’re a dealer, distributor, integrator, system installer or work in a parallel vertical the opportunities abound, as you provide solutions for your customers.  It really won’t matter which product or service you provide, as there is a place and need for all of it, and combining technologies will provide even more opportunities.

The development of “predictive analytics” based on data collection will allow companies to forecast their customers buying habits better.  My personal opinion is that “predictive analyst” will become a job title and many security companies will hire them to determine future sales projections and to forecast their future markets.  With that in mind, there is already some technology out there that can analyze behavioral patterns.  Does this mean that access control will be determined by a biometric sensor and as a back-up analysis app that says, this is you because you always show up for work at this time or an even more sophisticated analysis by the pressure you apply to the pin-pad as you type in your PIN code?

NON-ELECTRONIC TECHNOLOGIES

Non-electronic technologies on the other hand don’t use electricity to function. They can range from windows and doors to landscaping or even the way a particular building or inhabited area is designed. 

Fortunately, to counter the invasiveness of the electronic age, non-technologic innovation will become less invasive as we develop better materials and strategies as we design inhabited space. 

I believe we can “socially engineer” inhabited space.  We can incorporate specific urban design strategies that cause positive behaviors so that there is less reliance on the invasive use of electronic means to keep us safe.  Ultimately citizens don’t want cameras that watch their every move; instead they want space that is functional and free of crime and unwanted behaviors.  By increasing the effectiveness in controlling the social behaviors of the people using or transiting the space, the environments will become safer and need fewer electronic gadgets.

We are at the cusp of an explosion in technologies, both electronic and otherwise.  Whether you are in the business of providing solutions directly in the form of a product or service or in the business of providing solutions indirectly, i.e., architect, engineer, security consultant or government official strap yourself in and hold on to your hat because it’ going to be a great ride with lots of opportunities for all to excel.

Why People Are Wrong to Think That

CCTV is a Detection Tool

When we talk detection we are talking about observing behavior – all behavior both wanted and unwanted.  It is very common within the security field, and even outside of the security field, for people to think that detection means detecting the bad guy doing a bad thing.  Well, not really.  What we are trying to do is determine if the behavior we are watching is authorized or not.  If we assess it to be allowed, then we take no action.  If it’s not allowed, the security force responds.  Again, we can use electronic and non-electronics to assist us.  The thing to remember is technology is a tool to assist and it has to be treated that way.  It is not the “cure all”. 

Just putting a CCTV camera to watch a store shelf or a gas pump will not prevent crime.  The reality is, by putting a camera we are allowing someone who is monitoring what the camera sees to assess the behavior that is being seen.  Therefore, CCTV is actually an assessment tool.  Those installing cameras must remember how the system is going to be used for assessment and not how it will capture what happened.  An article in the Chicago Tribune a couple years ago mentioned that less than three percent of crime is solved by the use of a camera system.  Recent articles about the enormous number of cameras watching the public spaces in London puts that number somewhere around 22 percent.  I think it would be fair to say the numbers somewhere in between.  Just placing the camera is not enough it has to be monitored too, and in real time.  Otherwise, the bad guy will get away.

Other facts about CCTV discussed during Free webinar 12 December

The Security Industry Association (SIA) is sponsoring a webinar at 1pm (ET) on 12 December 2017, when I'll talk about the Five Pillars of Physical Security: Misconceptions, Myths and Truths at https://www.securityindustry.org/ .  I will post a direct link once we get closer to that date.  We hope you'll join us.