Beyond the Email Scandal

How To Properly Design and Construct

a Sensitive Compartmented Information Facility (SCIF)

I don’t know your political affiliation and honestly, I don’t care.  But one thing I do care about is, the way some political beings believe they are above the rules or beyond the approach of the rules.  The recent incident with Hilary and her emails highlights this phenomenon.  Even though I don’t have any “insider” information I can almost assuredly bet that several procedural and policy protocols were circumvented.

Since, there seems to be a common thread throughout the investigation that emails that were not classified upon further examination should have been.  So that’s the first issue.  Correct classification.

Second, I question how, were those emails physically stored.  Rumor has it there was a secure server.  If that’s the case, where was the server located and when dealing with classified was it done at the kitchen table or within a secured space that had been authorized for the handling of classified or, at least, sensitive material?

Almost certainly, there were printed copies of those emails, where were they physically stored? Due to her position I’m sure she had a SCI type clearance.  If that’s the case, did the space where she worked and stored the classified meet technical specifications of IDC/IDS-705 and other pertinent, guidelines?

Like I said, I don’t know for sure but I’d speculate they didn’t since there seems to have been a lackadaisical approach to the classification portion of the process; I would suspect the rest of the approach was “short” too.

We discuss the proper design and construction of a sensitive compartmented information facility (SCIF) which meets official government requirements for a secure area where classified information is handled. The stringent physical security requirements; such as, access control systems, thickness of doors, the strength of concrete and the use of alarms, and acoustical controls which prevent eavesdropping, information exposure or “jamming”, and surveillance prevention will be discussed.  The use of electronic media within the facility will also be explored during a 3-day workshop, held at Willow Grove Air National Guard Base (Horsham, PA), 24-26 May. 

Find out more about other physical security engineering workshops and our Physical Security Engineering Training and Certification Program at https://www.hainessecuritysolutions.com

3 COMMON MYTHS ABOUT

ACCESS CONTROL AND PERIMETER SECURITY

Most people think access control involves using technology or a guard who checks some form of identification to allow entry into a facility or building – a guard or electronics, and that it.  The security industry has made tremendous gains in the last several years with regards to increasing technology’s capabilities to enhance control at building or compounds.  While these advances assist they are not the cure all.  They are simply tools that assist in the detection of unwanted behavior.  

With that in mind here are three common myths about access control:

Myth 1 – The perimeter or boundary line must be robust in order to adequately provide access control.  This simply is not true.  The US Air Force uses a painted red line on the ground around its nuclear deterrent capable aircraft.  There’s no fence, there no standing guard – just a red line.  The line basically says to everyone, “If you’re on that side of the line, we don’t care who you are or what you do, but, if you want to come on this side of the line we want you to go down to the opening so we can check you out”.  So, really anything can be used – a rope, series of shrubs/plants or a painted line, something that says, here’s the line of demarcation that I care about.

Myth 2 – Fences are a deterrent – NOT!  It takes less than 4 seconds for an unskilled person to climb over a fence, including those with concertina or razor wire.  While adding some type of top guard makes them look formidable they’re really not very effective as a deterrent.  They’re real values comes in the form of detection.  They allow us to detect unwanted behavior.   Think about it, most authorized people will proceed to an access control point, they won’t climb the fence.  Only unauthorized people climb fences; therefore, it serves as a detection mechanism.

Myth 3 – The boundary line or perimeter is the only point available for security personnel to affect access control.  Actually, there are four layers of physical security and each can provide for effective access control, if used correctly.  The layers are; 1 – boundary line or property perimeter, 2 – exterior enclave, 3 – asset façade, and 4 – internal controlled or restricted spaces.  Each layer provides an additional opportunity for control, if used effectively.  Not every asset has a layer 2 or 4 but all have layers 1 and 3, even if, the asset is free standing.  In this case, the façade serves as both layers 1 and 3.  Each layer should be used to deter (albeit limited), delay, detect and allow for response.  This layered approach is fundamental to effective access control.

More access control and perimeter security tips at: http://issuu.com/securitymiddleeastmagazine/docs/sme_july-_aug_2015_web/33?e=3061242/14215610

We’ll discuss perimeter security and entry control facility design during a workshop 19-21 July near Tacoma, WA. For more information contact us at +1 (805) 509-8655.

What Makes Great Space?

What Makes Great Space?

Making Smart Buildings Wise

With the explosion of the Internet of Things (IoT) and the push for interconnectivity of devices we've been concentrating on making buildings, transportation, and every other facet of our lives "Smart".  Many conferences or symposiums are being held all over the world to discuss this phenomena.  In fact, I participated in the Smart Cities India 2015 Conference and Expo and provided input to the IFSEC Security Conference this past December and will again participate this coming May at the 2nd Smart Cities India 2016 Conference and Expo in New Delhi, India. 

Our discussion centered on the technological ability of connecting devices to more efficiently and effectively manage systems  - transportation, food supply, energy, etc.  I think we can go a step beyond that and say, "Efficiency is nice but what I really care about is the ability to raise my family somewhere where I don't have to worry about them being safe".

By shaping the built environment and integrating solutions, both physical and technological, that are transparent we can create neighborhoods where people actually want to work, live and raise their families- not because they are efficient but because the are safe.  As urban centers of the future increase in population so will the demand for functionality on a multitude of levels. 

One clear local example of the effective and efficient use of space is "The Collection" located at River Park area in Oxnard, CA.  The neighborhoods, both residential and retail, are vibrant with dynamic examples of "Great Space" usage. 

We'll discuss Crime Prevention through Environmental Design (CPTED) and other design principles that define "Great Space" with a 2 day workshop on  May 2nd and 3rd at the River Park Executive Suites, in Oxnard. Please join us. Click on https//hainessecuritysolutions.com for the latest details.

That's Like Closing the Barn Door After the Horses Get Away

How many times have we heard that?  Well, it happens all the time.  Just because you live in the country or away from city folks it doesn’t mean you can’t become a target of vandalism or theft or worse.  Here are some very common sense things you can do immediately to keep the horses safe and from loosing your britches, so to speak.

Check all gates and fence for damage.  If properly maintained they will keep animals in but the will not keep bad guys out.  You may have heard of the “broken window theory”.  Basically, it says in areas where there are rundown buildings, with broken windows crime is sure to follow.  Same goes for fences.  Fences that are not maintained suggest that security is not a very high priority and other areas of the farm, ranch and homestead are vulnerable, too.

Ensure ditches are maintained and clear of debris.  You need to do this for several reasons; 1) to make sure the ditches drain properly, 2) so that they don’t provide hiding places for the bad guys, or 3) allow the bad guys to drive through your fence.  A properly maintained ditch provides some protection.

Keep chemicals/fertilizer under strict control, especially, if being used in the field.  Do not leave outdoors overnight.  Bring the wagon back to the barn and secure it.  You’re going back that way anyway, so there’s really no extra effort.

Report unsolicited requests to buy fertilizers or chemicals from you to the authorities.

Control access to all buildings.  There are lots of electronic gadgets out there these days to assist in that area.  But they all basically fall into one of three categories, each being more secure and more expensive than the previous.  Something you have – like an access card, something you know – like a pin number, and something you are – like a retinal scan or fingerprint.  A system that has a combination of two of the three is preferable.  Make sure all buildings are protected.  Beside the animals, there are lots of items to steal.  Copper wiring, metal tubing, and lead seem to be high the thieves priority list these days.

Install visible deterrents, such as, motion activated lights and cameras.  Some systems allow for you to talk from the camera and warn the bad guy that they’re being watched.  Might be useful to "shoo" those high schoolers away who are "cow tipping" or "snipe hunting".

More common sense tips available https://hainessecuritysolutions.com/Technology_Improvements.html or under the Technology Improvement Tab.

8 Tips for Do-It-Yourself

Home and Small Business Security Alarm Systems

There are lots of alarm companies that will tell you, that you need their alarm system in order to monitor activity in and around your house or business.  They will sell you an “all-inclusive package” of X number of cameras and sensors.  The reality is, whatever X represents is in most cases not going to be enough the cover your entire building or home.  They make their money when they sell you additional equipment.  They include X but what you really need is X more to provide complete coverage. 

New alarm systems allow the homeowner/business owner to monitor activity via an IP connection.  So you can monitor your system from anywhere there’s an internet signal.  With that in mind, alarm companies now have the owner monitor the activity and notify them instead of the old way where they would monitor and notify the owner when sometime seemed amiss.  In either case, if the responding patrol car doesn’t get there within 10 minutes chances are very high that the perps will be gone and all you will have is evidence on film that they stole something.  Don’t be fooled by what you see played out by Hollywood and on TV shows – Fact: 98% of crime captured by video surveillance does not result in an apprehension.

Now that you’ve been warned, here’s the other side.  Nowadays, relatively inexpensive systems are available for do-it-yourselfers.  Eventhough surveillance cameras are an assessment tool they can provide some deterrence, if there’ visible and especially if there’s a warning sign in the yard or at the front entrance.  Actually, the sign is the deterrent not the cameras or sensors, but you get the idea.  Additionally, if properly placed, electronic security along with an appropriately equipped and trained response force can be effective.  Here are ten things you can do to make sure your alarm system benefits you and provides the protection you seek.

• Place outside cameras so that they view avenues of approach and can detect people as they come up to the front door or entrance.
• Placement of cameras internal to structures is a little trickier.  They have to be able to capture the entire room and high enough so that the bad guy can’t knock it down or spray paint the lens.  Discreetly placed “nanny cams” can help but it seems they are always pointing in the wrong direction or covered up by something.
• Perform regular maintenance by cleaning the lenses and housings.  Nothing worse than getting burglarized and find out that your camera system captured Charlotte building her web.
• Test the system regularly.  Find out from the monitoring company how often you’re allowed to test the system without a charge.  I would recommend, at least twice a year.  More often if necessary.  Find out the priority for response.  If you live in a high crime neighborhood guess what, they’re not coming – unless the perps still there and in that case you shouldn’t be.  Police departments maintain these types of stats.
• Check the cameras field of view.  Is it viewing what you want viewed?  Sounds pretty stupid doesn’t it, but how often have the camera angles changed because of high winds or by being bumped by a cat or other critter.
• Insure you have the latest software available.  If password enabled, make sure you change the factory installed password once you start using it.
• Get an Uninterrupted Power Supply (UPS) that is capable of running your security system until the power can come back on.  The UPS should be able to maintain the system for at least a day.
• Don’t rely solely on one type of electronic security equipment, if you have cameras augment them with sensors and vice versa.  Chances of both systems failing at the same time is pretty slim.
• Place volumetric sensors so that the beams shoot out across a room and not directly at the door or windows.  These sensors work by detecting variations in the beam, so as a person walks between one beam and another they get detected.  Think of it like your hand with the fingers being the beams radiating across a room.

Don’t forget that just because you have an alarm system it doesn’t make you invincible.  If the rest of your security posture sucks, they’re gonna get you.  It’s just matter of time!

More common sense tips available under the Technology Improvements Tab on our homepage or here: https://hainessecuritysolutions.com/Technology_Improvements.html

FOR ME IT’S PERSONAL

How the 1983 Beirut Marine Barracks Bombing Changed
My Life – Forever  

In October 1983, I was the Assistant Flight Sergeant, responsible for law enforcement duties at Rhein Main Air Base, Germany.  A couple of days after the worst attack suffered by the US Marine Corps took place in Beirut, Lebanon, the bodies of the dead Marines were brought to Rhein Main via two C-141 transport aircraft.

 I was standing on the tarmac waiting for the aircraft to taxi over and park.  A third aircraft with the Commandant of the Marine Corps arrived almost simultaneously.  His plane was suppose to go over to the VIP lounge at the control tower, where various dignitaries were waiting.  So I didn’t think too much of it when the plane landed and taxied toward the control tower. 

After the two C141’s parked next to each other, the rear cargo doors opened.  One and then the other.  All I could see were metal caskets.  Both planes were full.  From the deck to the ceiling - FULL! 

As the ground crew was moving the k-loaders into position, I saw out of the corner of my eye, the “follow me truck“ racing across the parking ramp.  It was going fast, too fast - well over the speed limit allowed for the parking ramp.

As I turned and walked toward the vehicle to tell the driver to slow down.  It stopped just short of me and out of the passenger’s door jumped Gen PX Kelly, USMC Commandant.  As he walked toward me,  I saluted him.  He returned my salute and said to me, “Sarge, are those my boys?”.  I answered, “Yes, sir.” And he and I stood there until every one of HIS Marines were taken off the plane.

I wish I could say, that while I stood there I had profound reflective thoughts but I didn’t.  Those didn’t come until a few days later.  When it hit me, I thought of those Marines.  They were MY Marines, too.  No, they were OUR Marines.  Anyone of them could have been a son, a brother, a dad or an uncle to anyone of us.  They were the sons, brothers, fathers and uncles of all Americans.  Not just his and not just mine.  They were OURS! 

They had taken an oath to protect America “from all enemies…”.  I had taken the same oath.  So, from that day forward, I was going to do everything in my power, however small in my little piece of the universe it was, to prevent  this kind of thing from happening again. 

I’ve spent the last 30+ years fulfilling that promise to myself and OUR Marines.

Perimeter Security - What is it Good For?

Absolutely Nothing, If Done Wrong

DEFINITION

Webster describes perimeter as, “the boundary or circumference of a figure having two dimension; the sum of all sides of the boundary.  Webster goes on to describe security as”…freedom from danger or risk.”  So when we put them together our most common definition of perimeter security goes something like this, “an identifiable boundary to provide safety from threats”.

We take that a step further in our definition:  A boundary comprised of several different “layers” of defense, with each layer providing an opportunity to deter, delay and detect unwanted activity.

PURPOSE

Most people think you have to have a fence in order to establish that boundary or perimeter and once you’ve done that, the fence will act as a deterrent and stop the threat.  Both assumptions are wrong.  You don’t need a fence to establish the perimeter.  You just need to identify it in some way to let people know, “Hey, this is my space.  If you want to come in here, then go down there and let me check out who you are”.  Good folks will follow the rules and go down to the entry control or access point.  The bad guy will climb over the fence in about 4 seconds or less, so not much deterrent here.  So in reality the fence doesn’t act as a deterrent, it acts as a method of identifying good and bad intentions. 

Therefore, the perimeter  is merely a line of demarcation that says, if you’re over there we don’t care what you do but if you come over here, we want to know who you are, so go down there where we can check you out.  Now, many of you will disagree with that.  You will say, “No, the fence keeps the bad guys from doing bad things because they have to climb over it and they don’t want to get caught”.  Exactly!  But, the fence doesn’t deter them, it makes it so that if they climb over it we will detect this bad behavior and can possibly catch them.  After all, the good guys will follow the rules and go down to where there is an opening in the fence.

This opening is usually in the form of an access or entry control point (ACP/ECP) of some sort, manned or manned.  The ECP is where we check to see if the person trying to enter is allowed.  There are many ways to do that but we’ll have to discuss that in a future article.  For the time being let’s concentrate on perimeter security excluding its access control mechanics.  There are three distinct purposes for establishing a perimeter.

We already established that, first, it delineates the property line that we care about (deter).  Second, it may slow (delay) the bad guys as they approach with the idea that if we can delay them we may be able to spot their bad behavior.  Which leads us directly into point three – it serves as an early warning systems (detect).  It immediately allows us to determine ill-intent.  Think about it.  If the person climbing the fence wasn’t trying to circumvent the access control point then why climb over the fence.  Why not, go down the ECP, show or use your authorized credentials and enter.  Another way to think away it is, if a person were to break through a wall, you would think this behavior bizarre and want to check them out.

Which brings me to my next point; there are actually four perimeters or layers of defense and each provides an opportunity for us to design against our threats.  Threats come in all shapes and sizes, but we usually are most concerned with vehicle or pedestrian threats.  In pretty short order I can come up with about 40 natural and about 20 or so manmade threats.  For the purpose of this article we’ll concentrate on vehicles and people.

Perimeter Design Considerations

• Visibility – what do people see - both good and bad?  Consider proximity to your neighbors.
• Demographics/Statistics – crime rates, terrorist activity, first responder locations and emergency access
• Landscape and Environmental Conditions - Type of terrain and extreme weather
• Power Requirements - availability, if electronics are used to augment passive barriers
• Accessibility – whether by foot or vehicle, during normal and emergency operations.

Protection Components

• Physical barriers (most common) – fencing or vehicle barriers, landscaping
• Intrusion Detection/Access Control – quickly becoming the norm
• Response Forces – without them the other components are useless.  Forces MUST BE well-trained, well-equipped and regularly drilled and exercised.

Common Mistakes

• If we build a fence high enough, we’ll be okay
• Assume the property boundary to be the external perimeter that requires the most robust system
• Making it look substantial – fortress like will deter everybody and all threats
• Putting barbed or concertina or razor wire on top will deter the bad guy
• Putting CCTV to capture activity without having response force capabilities
• Forgetting about moving vehicle threats (ask the security staff at the Brussels airport about this one.  Had they installed cable-reinforcing to the fencing the diamond thieves would not have been able to cut the fence and drive up to the plane unnoticed.)
• Lighting portions of the perimeter that cannot be patrolled by security forces.

THE FUTURE

• Non-aggressive methods
  • Landscaping and Designing Crime Out strategies
• Arial surveillance
  • Balloons.  This might be the most promising since they can stay airborne for very long periods of time.  One advantage is they can be placed high enough to see three of the layers of defense.
  • Drones.  There are several companies out there that already have off-the-shelf products available.  Once manufacturers are able to overcome the current short battery life cycle and extend them to 10-12 hours or longer and add analytics this will become a great tool.
• Robotics (mobile, semi-fixed or stationary)
  • Mobile – with the advent of self- driven or remotely controlled vehicles I don’t think it will be too long before we see a company promoting a self-driving security patrol vehicle; equipped with sensors, camera systems and audible/visual capabilities
  • Semi-fixed – these systems are attached to or immediately adjacent to a boundary line and can patrol randomly or in a sequential order (not advised).  They can be equipped with sensors, CCTV cameras, spotlights and speakers.
  • Stationary – these systems already exist.  There are many systems out there that have CCTV fields of view of perimeters with video analytics, combined with sensors, DVRs, etc.  Really the sky's the limit based on budget.

CONCLUSION

Don’t fall into the trap of thinking that the property boundary is your only perimeter and therefore, it’s the only one you protect.  Use every layer of defense to deter, delay, detect or defend a would-be aggressor.  Remember, it won’t happen on its own; you have to design your security system to be integrated because if it’s not – it’s worth absolutely nothing.

For more information about perimeter security see our article in Security Middle East magazine Jul/Aug issue 

http://issuu. com/securitymiddleeastmagazine/docs/sme_july-_aug_2015_web/31?e=3061242/14215610

or send an email to info@hainessecuritysolutions.com.