Physical security threat assessment

LOGO

 Physical security threat assessment

First of all, if you think this is just for professionals, don't be misguided! A threat assessment can be implemented by any person eager to improve their security at home, place of business, office, ranch, farm, flat, or even just a single room! It is just a simple step-by-step system that has been developed over a couple of years, and can be used by anyone willing to put some thought and research into it!

Why use it?

One of the most common risks an organization runs is stagnant and non-evolving security measures. Unfortunately, these things can only be addressed if it is known to the organization. For that reason, it is necessary to perform a complete threat assessment. Sadly, too often a comprehensive threat assessment is missing completely or never updated. So it's your responsibility as the Advisor/Consultant/Team-leader/Security manager or head of the house to make sure that all the risks are reduced to an acceptable level.

The biggest mistake most organizations make is waiting for a safety breach or incident to happen before they implement mitigation strategies. Preparing a thorough threat assessment will undoubtedly help in improving overall security. It will also help in identifying which preventative measures to implement and reduce the risk of possible threats.

Any organization will always have some form of physical threat. Whether it's from general crime, human error, or even natural elements. Physical security is not a one-size-fits-all package. It gets very specific to the organization itself, especially when it comes down to demographics and location.

Before we start

Before we go any further, you should have a clear knowledge of the differences between risk, threat, and vulnerability. If you are unsure or just need a little refresher to make sure you are on the right track, you can learn the difference >Here<. It's also important to note that there are different methodologies out there and each one probably works, but will not necessarily be comfortable for everyone. That's why you need to learn from each of them and develop something that you are comfortable to use.

That being said, you should make sure that the following points are covered in your assessment:

  •  Buildings, assets, and vehicles are characterized
  • Undesirable events should be identified
  • The consequences of those events should be determined
  • The types of threats should be identified
  • Testing and analyzing the protection security systems and procedures
  • Complying with law and regulations
  • Identifying reasonable control measures needed

To formulate the assessment:

Formulating a threat assessment can be done by following these 5 steps:

1) Characterizing facilities

So it should be obvious that you should first know what the actual basis is that your working with. The boundaries of the site, where buildings are on the site, all access points, floor plans, procedures in place, and current security measures if any should be noted. You will need to reach out to some contacts to get all of this information and make sure it is as accurate as possible. Depending on how long the organization has been up and running, you will be able to use things like building blueprints, municipal reports, security SOP's and IAD's, previous threat assessments and reports, environmental reports, site surveys, and a few more.

2) Now you need to determine what events are undesirable to the organization (the risks)

This will vary for every organization. Any crime or disruption in operations is undesirable, and sometimes you might be called in to address something specific, like for instance theft among employees or a physical threat that has been made known to the organization. The following are things to look for:

  • The crime rate in that specific area and also if there are high-risk areas close by.
  • Industry-specific crimes, for example, drug stores and banks will have different types of specific risks related to their trade.
  • Common crime, things like theft and crimes of opportunity.
  • The number of people who will be accessing the organization's infrastructure
  • Cameras and other monitoring systems
  • Lack of manpower
  • The political and religious standing of the organization can also attract more risks
  • Training of staff or team members
  • If there are any direct threats to the organization or one of its high-ranking officials

So now that you have your whole list of risks compiled. Its time to rank them in order of probability, frequency, and impact. Let's say you score each risk on each of these factors on a scale of 1 to 5. Then add up the total of each risk. So the higher the total (the probability and impact), the higher the risk, and that is a threat to the organization. In another column, you can add the control measures that are currently in place if any, and deduct that from the total of the other 3 columns. So if there is good access control currently in place you would score that higher than no access control.

Another important thing to look for is any vulnerabilities the organization has. These will be risks that are not addressed at all and have a good probability of happening, and also possible risks that will have a significant impact but are not being controlled. However, this is only vulnerabilities visible on paper, when on-site and assessing the buildings and controls, you will most likely find more vulnerabilities. This includes out-dated and defective equipment and uncontrolled areas.

3) SOP and IAD's

I would like to separate Standard Operational Procedures and Immediate Action Drills a bit as it is something that is being badly neglected. SOP's and IAD's are as important as any other security system in place, without it there is no guidance in reaction and things often turn out quite bad or undesirable to an organization. Once again the organization's aim should be kept in mind when drawing up these procedures. I like to look at procedures before implementing mitigation as it will assist a great deal when it comes to cost, as you will likely see how much man-power and how much equipment is needed to achieve operational objectives.

The way your system integrates and reacts to threats is an important risk to look at. If the response is slow, the risk is greater, if the response is incorrect, the risk increases. I am pretty sure you get the picture here. A common risk when it comes to applying IAD's or responding to a threat is when all staff members rush to the location of the threat, leaving their areas of responsibility unattended and opening up the proverbial back-door for intruders to sweep in unnoticed. Identify roles and responsibilities for each threat and make sure every staff member knows it!

SOP's and IAD's should also be time/shift relevant! During holidays and night shifts for example there might be fewer staff members on duty. This can change things dramatically. There should never be any regulation changes, strict procedures should be attained at all times! The last thing you want is a burglary at night because staff members or cleaners left a door/gate unlocked or open.

Another thing to remember here is a detailed plan and list of immediate contacts that should be activated during emergencies or incidents. A touch of automation can be good in certain situations and again not so good during other situations. You do not want to be dropping security barriers and trapping employees inside when a fire breaks out, but dropping barriers when a deranged shooter tries to get access can be a good move. And also having a procedure of who to be contacted in case of more serious threats is very important! Will a tactical team be needed to respond from outside? Who will that be? do you have the relevant contacts and procedures to follow in case of a bomb threat? Who has to be contacted in case buildings need to be evacuated? Neighboring buildings could start burning, who do you contact then?

4) Addressing the threats

After you have compiled your list of risks and figured out what lacks in the procedures you should now be able to see the threats to the organization. Now you need to determine the course to be taken to minimize the risk of these threats. It should come as no surprise that the cost will greatly affect the course you will take. Staying within budget and getting maximum security optimization is not easy at all! Tip -This is where your contact list can be a great source of success.

Start by looking at the biggest threat on your list (the highest score one). What equipment will be needed to address it? Think of detection, cameras, man-power, and every other piece of equipment and training needed to reduce this threat to a lower score. A lot of times the same type of equipment and so on will automatically improve the other threats too. Or at least some of the same equipment and manpower can be used to tackle other threats.

Now re-asses the other threats according to the equipment, etc. that was added to the security system. From there, again, take the highest ranking threat and address it like the first one. Just continue this cycle until you can reach a reasonable level of risk from each threat. Always remember to KISS it as far as possible or use automation as much as possible, just be cautious of the cost factor, especially when it comes to software updates and such.

5) Analyzing system effectiveness

Physical protection systems should be described in detail before it can be tested! Ideally, you would like to stop a threat immediately and without any delay or negative outcomes and with as little as a possible disturbance in normal operations. But in reality, this rarely happens and one will always have to deal with some sort of shortcoming.

So to stop any threat you should first be able to identify it. A continuous threat assessment will outline threats and should be communicated with team members to remain effective and ahead of the threat. Team members should be trained in identifying abnormal behavior and activities, technology implemented and physical barriers used for this purpose. Strategically designing entries and exits can be just as valuable, to make sure any threat has to pass the detection phase before being able to access any facilities or inflict any damage to the organization.

After a threat has been detected, there should be a way to confirm that the detection is valid and of real concern and not just a nuisance alarm. This can be done via team members in contact with a Control-room/Security management or Team-leader. There should be good knowledge in the team about how criminals operate and how target selection works and everything that goes hand-in-hand with it. One can use the OODA loop to great effect here. Find out more about how the OODA loop works and the different phases criminals or a probable threat uses to select their attack right >Here<.

Once a threat has been confirmed, the aim is to delay the threat to get reaction forces to the threat and minimize its undesired actions. Of course, it is ideal for a team member that is in the vicinity already, to be able to neutralize the threat. But it is also ideal to have more than necessary force available. One adversary can be extremely determined or under the influence of narcotics and over-power or out-think a team-member and then become a more aggressive threat.  The effectiveness of response is measured by the time taken to get to the threat and to neutralize the threat.

So keep in mind that some organizations might require you to try and neutralize a threat without using aggressive force, I know, it's not something I am very much happy to say but to spare you a potential client or project you need to know how to act. And in this instance you need to know non-lethal options available, but, it is your job to convince these organizations about the reality we face each day. Organizations would likely want to avoid PR damage because of an unjustified shooting on their premises.

Testing effectiveness

To test the effectiveness you should be sure to fully understand all of the above points and what is required of your system to achieve maximum effectiveness. Only then can you define what is required and to be implemented. Once that has been put in place, there are a few ways to test its effectiveness, you could use penetration testing, call in other experts and run some drills over different times to see if detection and neutralization systems work. Nothing can prove effectiveness more than an actual criminal attempt, it's important for organizations to immediately assess their response after an attempt and identify any issues and improve on them.

Upgrading systems

If for whatever reason you can identify any viable threats after implementing mitigation strategies, you need to check for possible upgrades or changes in the system. This includes equipment, manpower, procedures, and software. When you implement new strategies or add anything you should again test for effectiveness, and repeat until the level of risk is acceptable. Always remember the cost affected with upgrades and additions or changes.

More on this topic

To follow up on this piece will be a few more posts regarding principal profiling and equipment and some more tips and tricks to help you formulate a threat assessment.

Until then, feel free to comment below!

Please subscribe to the site or follow me on Facebook @https://web.facebook.com/ALPHADefense

Cover vs Concealment

To cover, or to conceal

That is the question! But the answer is slightly more complicated. In basic terms, it sounds quite easy to differentiate. Cover is anything that effectively stops bullets. Concealment is anything that hides you from someone else's sight. Pretty simple right?...Wrong!
The most important thing you have to always remember: Cover is the one that's going to save you when things take a turn for the worse.
Cover
Cover is something that will not necessarily conceal your location but stop a bullet, or any other projectile being lunged toward you for that matter. Do keep in mind that some forms of cover can also deflect high-velocity projectiles and send them off into the unknown. You do not want to unwillingly send rounds to a teammate or someone else, and you probably will not be able to control this either. And, then there is the initial "kick" it will project onto whatever it is hitting, for example, a thick plate of steel hanging loosely in front of you will stop or deflect an incoming round, but will also probably kick back a bit and still send you off balance or if it is light enough, give you a nice slap in the face! The important thing, however, is to not be penetrated by any projectiles. Think of your bulletproof vest, for example, if you take a round from a 9mm at say 10m out, it will stop the projectile, but the force that was initially behind the projectile is now being spread into the size of your plates and that can leave you with a proper bruise and send you off balance.
It is also dependent on what the bad guy is shooting. Materials that will stop a 9mm or other pistol rounds will likely not stop more powerful rifle rounds for example.
In general, something that provides you with good cover also conceals you, but there are exceptions, like bulletproof glass for example. In the movies you see guys flipping dinner tables for cover or hiding behind some wooden wall while rounds are hitting it with no mercy, and walk away unscathed. That is not a good idea at all! Unless you have a table that's at least as thick as a small tee! And no, the door panels on your vehicle is not likely to stop even a .22 round! Unless you upgrade it with some good quality steel of proper thickness.
The only few things on your vehicle that will properly stop incoming rounds, are the engine, an axle (if it is big enough to hide behind anyway, and a good thickness wheel.
Keep in mind that cover should not limit your maneuverability too much, as you might still need to deal with the threat. You should either be able to shoot from behind it or when the threat changes position, you should be able to change accordingly as well. You do not want to be stuck in a small space and have a threat walk straight to you. The human body can also stop some projectiles, just do not use your spouse for that duty...

Concealment

If it doesn’t stop a projectile, then it is only hiding you. Which essentially is concealment. If you had to quickly hide behind a couch, you are concealing yourself from who/whatever is trying to find you. You know, like when the debt-collector makes a visit and you quickly lock the door, dive behind the couch and wait for him to leave. If he had to fire off a few rounds into the living room, you would likely have been hit behind the couch. Using darkness or shadows to hide in during the night or in poorly lit hallways are also a favorite way to go for criminals. You often do not see them there, but if you had to throw a rock into their direction, you would probably get a reply. Whereas if they were behind cover as well, you would have a hard time to know they are there.
It is just like the camouflage hunters use, they blend into the environment and conceal themselves from the unsuspecting game. Here in SA for example, our police forces wear a kind-off light blue uniform, which is not that easy to see during the night and is not reflective at all.

I often talk about not setting up bright lights facing toward your home, rather than facing outwards toward exterior walls, as that can be a great form of concealment for criminals scouting your home. Just as much as you cannot see a person from behind a flashlight during night time. The same concept applies. See this post to read about lighting up your yard.

Two dead giveaways exploit you from behind concealment: Noise and motion, Heavy breathing is very audible, and shaking from fear tends to shake and rattle lighter concealment, like curtains for example.

Conclusion:

Good cover is not that easy to find, especially when you are inside a building. So for this reason, you will need to utilize the concealment you have access to and move unnoticed to a place with decent cover, or to escape the threat. So if you're thinking about adding some decent cover to your home defense plan, I would suggest adding some bulletproof vest or blanket of some sorts in your safe room. If you do not have a safe room, I suggest you make one! However, adding some simple pieces of furniture, filled with something like solid wood, cement, or plating.

For more on home defense, read here.

Risk/Reward ratio

barbed-wire-black-and-white-crime-2057

Risk/Reward

Now and then a well-protected premises gets broken in to, and no matter what the reason was, someone found a way to break through the security systems. Why is that? Well, honestly, unless you live like a well-protected president (who also gets some attacks now and then), you will never be impenetrable or completely safe from every threat. I am not quite sure what other protectors like to call this, but it generally floats around as the risk/reward ratio. Meaning, if ever the reward that is to be gained is worth the risk associated or even more, then the likelihood of it happening still exists. You implement measures to irritate and keep someone from simply taking whatever they want from you. But, you can never really eliminate the urge of someone eager enough to grab it.

How is it still possible?

We have to remember that skills can be learned by anyone willing to learn them. Perhaps not always by the conventional manner we are used to, but either way, a skill can be learned. Many “masters” of their crafts become masters in the first place by developing beyond the conventional ways.

So, with that mouthful out of the way, here is what I mean. In reality, if I have to get or take from you what I so desperately want or need, especially when I have no other choice, I will be motivated enough to get it. And in that case, whatever means you have put in place to prevent me will be vulnerable to my motivated mind. I will most likely figure out some ingenious or perhaps absurd way to pass your measures and get what I want.

I like to call it the Risk/Reward ratio. But whatever the real term is for our industry, It simply means that if my reward is worth the effort, I might just take the risk.

I can think of various ways I have defeated some security systems and things I have seen in the industry, and for obvious reasons cannot mention them here. As I am always confident that just as we protectors are utilizing the internet, social media, and various skilled courses to enhance our capabilities, so are those we fight against. Many wolves amongst the sheep.

Closing off:

So, closing off, I hope it is clear to you that not any measure is impenetrable, think about how the enemy adapts, how technology advances, and how the sheer willpower of one man can change and revolutionize our industry. If an army is in my way, will 2 armies behind me defeat them? If an alarm system is in my way, will something be good enough to defeat it? Face it, we can never, ever be complacent. If you are wondering how to plan around this, then please read here.

Till next time, keep developing.

Risks VS Threats

adult-chart-close-up-1043514

Risk, Threat, and Vulnerability

Before any security detail can be put in place, you first need to determine the risks and threats that are present in your area of responsibility and the vulnerabilities they are open to. So, to start, it is very important to know the difference between risk, a threat, and vulnerability. I do however have to start by saying, this is just my explanation of how I see and measure Risk, Threat, and Vulnerability. You will indefinitely meet more people with more elaborate definitions or even some who sound quite the opposite of what I am going to attempt to explain in this post. So keep an open mind and try to KISS it. (Keep It Simple Stupid).

Here goes:

Risk: Risk is the potential for an unwanted result. For example a financial loss, loss of life, emotional trauma, or disruption of activities.

Threat: A threat is that occurrence or event that leads to, or causes the unwanted result (Risk). For example damage to infrastructure or property, murder, traumatic event, or sabotage. These events can happen by nature, the lack of maintenance, wear and tear, or it can, of course, be inflicted/implemented by a person.

Vulnerability: A vulnerability is a specific flaw or weakness in a system or a design in general. Such as someone with an allergy, it is not necessarily a risk on its own, as long as it is avoided. It can, however, be exploited by a potential attacker and used as a method of attack.

A quick example:

You have a nut allergy (Vulnerability). A long-standing business partner wants to eliminate you by exploiting your allergy (Threat). If he is successful in his covert operation, you will most likely lose your life (Risk). So, for you to survive, you will have to devise a plan to test your food and drinks, or even anything that may enter your bloodstream. A habit of chewing your pen (Vulnerability) may even be used, by applying some peanut oil on the pen.

So you can also see that some vulnerabilities can be used in conjunction with another, to achieve a less suspicious attack. One can get quite creative once you learn to exploit vulnerabilities and determine the risk it carries.

A proper risk assessment can tell a very definitive story. Once you make the connections, you will know where to focus your attention and do what is necessary to avoid the risk. Some risks will require more attention than others, depending on your mission results.

Perhaps you are not a security operative or into Risk-Management, and you wonder how this methodology can help you in normal life?

Picture yourself driving down the street on your way home. Looking around, you notice a bunch of everyday things, like people walking on the sidewalk, some garbage bags alongside a bin or two, a few potholes in the road and here and there a tree leaning over to the side.

What can this simple picture tell you? What if someone slips and falls off the sidewalk right in front of your car? What if he is drunk and deliberately walks in front of the car to draw your attention? Did you compensate for that? What if one of the garbage bags is half-way on the road, forcing you to swerve into oncoming traffic? Same with the pothole, or it can also cause a tire to blow and force your vehicle to collide into oncoming traffic? And what if that tree starts to fall right as you attempt to drive past it?

Conclusion:

It's a simple equation, anything that can cause a negative outcome (Threat) when coupled with asking "what if", can lead to a Risk. Some more severe than others. So it's evident that a risk is something that could happen, and a threat is a likelihood with which that same thing can happen.

If you would like to read more advanced terminology and explanations, I suggest you visit: https://protectioncircle.org/2017/01/27/threats-and-risks/