Physical security threat assessment
First of all, if you think this is just for professionals, don't be misguided! A threat assessment can be implemented by any person eager to improve their security at home, place of business, office, ranch, farm, flat, or even just a single room! It is just a simple step-by-step system that has been developed over a couple of years, and can be used by anyone willing to put some thought and research into it!
Why use it?
One of the most common risks an organization runs is stagnant and non-evolving security measures. Unfortunately, these things can only be addressed if it is known to the organization. For that reason, it is necessary to perform a complete threat assessment. Sadly, too often a comprehensive threat assessment is missing completely or never updated. So it's your responsibility as the Advisor/Consultant/Team-leader/Security manager or head of the house to make sure that all the risks are reduced to an acceptable level.
The biggest mistake most organizations make is waiting for a safety breach or incident to happen before they implement mitigation strategies. Preparing a thorough threat assessment will undoubtedly help in improving overall security. It will also help in identifying which preventative measures to implement and reduce the risk of possible threats.
Any organization will always have some form of physical threat. Whether it's from general crime, human error, or even natural elements. Physical security is not a one-size-fits-all package. It gets very specific to the organization itself, especially when it comes down to demographics and location.
Before we start
Before we go any further, you should have a clear knowledge of the differences between risk, threat, and vulnerability. If you are unsure or just need a little refresher to make sure you are on the right track, you can learn the difference >Here<. It's also important to note that there are different methodologies out there and each one probably works, but will not necessarily be comfortable for everyone. That's why you need to learn from each of them and develop something that you are comfortable to use.
That being said, you should make sure that the following points are covered in your assessment:
- Buildings, assets, and vehicles are characterized
- Undesirable events should be identified
- The consequences of those events should be determined
- The types of threats should be identified
- Testing and analyzing the protection security systems and procedures
- Complying with law and regulations
- Identifying reasonable control measures needed
To formulate the assessment:
Formulating a threat assessment can be done by following these 5 steps:
1) Characterizing facilities
So it should be obvious that you should first know what the actual basis is that your working with. The boundaries of the site, where buildings are on the site, all access points, floor plans, procedures in place, and current security measures if any should be noted. You will need to reach out to some contacts to get all of this information and make sure it is as accurate as possible. Depending on how long the organization has been up and running, you will be able to use things like building blueprints, municipal reports, security SOP's and IAD's, previous threat assessments and reports, environmental reports, site surveys, and a few more.
2) Now you need to determine what events are undesirable to the organization (the risks)
This will vary for every organization. Any crime or disruption in operations is undesirable, and sometimes you might be called in to address something specific, like for instance theft among employees or a physical threat that has been made known to the organization. The following are things to look for:
- The crime rate in that specific area and also if there are high-risk areas close by.
- Industry-specific crimes, for example, drug stores and banks will have different types of specific risks related to their trade.
- Common crime, things like theft and crimes of opportunity.
- The number of people who will be accessing the organization's infrastructure
- Cameras and other monitoring systems
- Lack of manpower
- The political and religious standing of the organization can also attract more risks
- Training of staff or team members
- If there are any direct threats to the organization or one of its high-ranking officials
So now that you have your whole list of risks compiled. Its time to rank them in order of probability, frequency, and impact. Let's say you score each risk on each of these factors on a scale of 1 to 5. Then add up the total of each risk. So the higher the total (the probability and impact), the higher the risk, and that is a threat to the organization. In another column, you can add the control measures that are currently in place if any, and deduct that from the total of the other 3 columns. So if there is good access control currently in place you would score that higher than no access control.
Another important thing to look for is any vulnerabilities the organization has. These will be risks that are not addressed at all and have a good probability of happening, and also possible risks that will have a significant impact but are not being controlled. However, this is only vulnerabilities visible on paper, when on-site and assessing the buildings and controls, you will most likely find more vulnerabilities. This includes out-dated and defective equipment and uncontrolled areas.
3) SOP and IAD's
I would like to separate Standard Operational Procedures and Immediate Action Drills a bit as it is something that is being badly neglected. SOP's and IAD's are as important as any other security system in place, without it there is no guidance in reaction and things often turn out quite bad or undesirable to an organization. Once again the organization's aim should be kept in mind when drawing up these procedures. I like to look at procedures before implementing mitigation as it will assist a great deal when it comes to cost, as you will likely see how much man-power and how much equipment is needed to achieve operational objectives.
The way your system integrates and reacts to threats is an important risk to look at. If the response is slow, the risk is greater, if the response is incorrect, the risk increases. I am pretty sure you get the picture here. A common risk when it comes to applying IAD's or responding to a threat is when all staff members rush to the location of the threat, leaving their areas of responsibility unattended and opening up the proverbial back-door for intruders to sweep in unnoticed. Identify roles and responsibilities for each threat and make sure every staff member knows it!
SOP's and IAD's should also be time/shift relevant! During holidays and night shifts for example there might be fewer staff members on duty. This can change things dramatically. There should never be any regulation changes, strict procedures should be attained at all times! The last thing you want is a burglary at night because staff members or cleaners left a door/gate unlocked or open.
Another thing to remember here is a detailed plan and list of immediate contacts that should be activated during emergencies or incidents. A touch of automation can be good in certain situations and again not so good during other situations. You do not want to be dropping security barriers and trapping employees inside when a fire breaks out, but dropping barriers when a deranged shooter tries to get access can be a good move. And also having a procedure of who to be contacted in case of more serious threats is very important! Will a tactical team be needed to respond from outside? Who will that be? do you have the relevant contacts and procedures to follow in case of a bomb threat? Who has to be contacted in case buildings need to be evacuated? Neighboring buildings could start burning, who do you contact then?
4) Addressing the threats
After you have compiled your list of risks and figured out what lacks in the procedures you should now be able to see the threats to the organization. Now you need to determine the course to be taken to minimize the risk of these threats. It should come as no surprise that the cost will greatly affect the course you will take. Staying within budget and getting maximum security optimization is not easy at all! Tip -This is where your contact list can be a great source of success.
Start by looking at the biggest threat on your list (the highest score one). What equipment will be needed to address it? Think of detection, cameras, man-power, and every other piece of equipment and training needed to reduce this threat to a lower score. A lot of times the same type of equipment and so on will automatically improve the other threats too. Or at least some of the same equipment and manpower can be used to tackle other threats.
Now re-asses the other threats according to the equipment, etc. that was added to the security system. From there, again, take the highest ranking threat and address it like the first one. Just continue this cycle until you can reach a reasonable level of risk from each threat. Always remember to KISS it as far as possible or use automation as much as possible, just be cautious of the cost factor, especially when it comes to software updates and such.
5) Analyzing system effectiveness
Physical protection systems should be described in detail before it can be tested! Ideally, you would like to stop a threat immediately and without any delay or negative outcomes and with as little as a possible disturbance in normal operations. But in reality, this rarely happens and one will always have to deal with some sort of shortcoming.
So to stop any threat you should first be able to identify it. A continuous threat assessment will outline threats and should be communicated with team members to remain effective and ahead of the threat. Team members should be trained in identifying abnormal behavior and activities, technology implemented and physical barriers used for this purpose. Strategically designing entries and exits can be just as valuable, to make sure any threat has to pass the detection phase before being able to access any facilities or inflict any damage to the organization.
After a threat has been detected, there should be a way to confirm that the detection is valid and of real concern and not just a nuisance alarm. This can be done via team members in contact with a Control-room/Security management or Team-leader. There should be good knowledge in the team about how criminals operate and how target selection works and everything that goes hand-in-hand with it. One can use the OODA loop to great effect here. Find out more about how the OODA loop works and the different phases criminals or a probable threat uses to select their attack right >Here<.
Once a threat has been confirmed, the aim is to delay the threat to get reaction forces to the threat and minimize its undesired actions. Of course, it is ideal for a team member that is in the vicinity already, to be able to neutralize the threat. But it is also ideal to have more than necessary force available. One adversary can be extremely determined or under the influence of narcotics and over-power or out-think a team-member and then become a more aggressive threat. The effectiveness of response is measured by the time taken to get to the threat and to neutralize the threat.
So keep in mind that some organizations might require you to try and neutralize a threat without using aggressive force, I know, it's not something I am very much happy to say but to spare you a potential client or project you need to know how to act. And in this instance you need to know non-lethal options available, but, it is your job to convince these organizations about the reality we face each day. Organizations would likely want to avoid PR damage because of an unjustified shooting on their premises.
Testing effectiveness
To test the effectiveness you should be sure to fully understand all of the above points and what is required of your system to achieve maximum effectiveness. Only then can you define what is required and to be implemented. Once that has been put in place, there are a few ways to test its effectiveness, you could use penetration testing, call in other experts and run some drills over different times to see if detection and neutralization systems work. Nothing can prove effectiveness more than an actual criminal attempt, it's important for organizations to immediately assess their response after an attempt and identify any issues and improve on them.
Upgrading systems
If for whatever reason you can identify any viable threats after implementing mitigation strategies, you need to check for possible upgrades or changes in the system. This includes equipment, manpower, procedures, and software. When you implement new strategies or add anything you should again test for effectiveness, and repeat until the level of risk is acceptable. Always remember the cost affected with upgrades and additions or changes.
To follow up on this piece will be a few more posts regarding principal profiling and equipment and some more tips and tricks to help you formulate a threat assessment.
Until then, feel free to comment below!
Please subscribe to the site or follow me on Facebook @https://web.facebook.com/ALPHADefense