Physical security threat assessment

LOGO

 Physical security threat assessment

First of all, if you think this is just for professionals, don't be misguided! A threat assessment can be implemented by any person eager to improve their security at home, place of business, office, ranch, farm, flat, or even just a single room! It is just a simple step-by-step system that has been developed over a couple of years, and can be used by anyone willing to put some thought and research into it!

Why use it?

One of the most common risks an organization runs is stagnant and non-evolving security measures. Unfortunately, these things can only be addressed if it is known to the organization. For that reason, it is necessary to perform a complete threat assessment. Sadly, too often a comprehensive threat assessment is missing completely or never updated. So it's your responsibility as the Advisor/Consultant/Team-leader/Security manager or head of the house to make sure that all the risks are reduced to an acceptable level.

The biggest mistake most organizations make is waiting for a safety breach or incident to happen before they implement mitigation strategies. Preparing a thorough threat assessment will undoubtedly help in improving overall security. It will also help in identifying which preventative measures to implement and reduce the risk of possible threats.

Any organization will always have some form of physical threat. Whether it's from general crime, human error, or even natural elements. Physical security is not a one-size-fits-all package. It gets very specific to the organization itself, especially when it comes down to demographics and location.

Before we start

Before we go any further, you should have a clear knowledge of the differences between risk, threat, and vulnerability. If you are unsure or just need a little refresher to make sure you are on the right track, you can learn the difference >Here<. It's also important to note that there are different methodologies out there and each one probably works, but will not necessarily be comfortable for everyone. That's why you need to learn from each of them and develop something that you are comfortable to use.

That being said, you should make sure that the following points are covered in your assessment:

  •  Buildings, assets, and vehicles are characterized
  • Undesirable events should be identified
  • The consequences of those events should be determined
  • The types of threats should be identified
  • Testing and analyzing the protection security systems and procedures
  • Complying with law and regulations
  • Identifying reasonable control measures needed

To formulate the assessment:

Formulating a threat assessment can be done by following these 5 steps:

1) Characterizing facilities

So it should be obvious that you should first know what the actual basis is that your working with. The boundaries of the site, where buildings are on the site, all access points, floor plans, procedures in place, and current security measures if any should be noted. You will need to reach out to some contacts to get all of this information and make sure it is as accurate as possible. Depending on how long the organization has been up and running, you will be able to use things like building blueprints, municipal reports, security SOP's and IAD's, previous threat assessments and reports, environmental reports, site surveys, and a few more.

2) Now you need to determine what events are undesirable to the organization (the risks)

This will vary for every organization. Any crime or disruption in operations is undesirable, and sometimes you might be called in to address something specific, like for instance theft among employees or a physical threat that has been made known to the organization. The following are things to look for:

  • The crime rate in that specific area and also if there are high-risk areas close by.
  • Industry-specific crimes, for example, drug stores and banks will have different types of specific risks related to their trade.
  • Common crime, things like theft and crimes of opportunity.
  • The number of people who will be accessing the organization's infrastructure
  • Cameras and other monitoring systems
  • Lack of manpower
  • The political and religious standing of the organization can also attract more risks
  • Training of staff or team members
  • If there are any direct threats to the organization or one of its high-ranking officials

So now that you have your whole list of risks compiled. Its time to rank them in order of probability, frequency, and impact. Let's say you score each risk on each of these factors on a scale of 1 to 5. Then add up the total of each risk. So the higher the total (the probability and impact), the higher the risk, and that is a threat to the organization. In another column, you can add the control measures that are currently in place if any, and deduct that from the total of the other 3 columns. So if there is good access control currently in place you would score that higher than no access control.

Another important thing to look for is any vulnerabilities the organization has. These will be risks that are not addressed at all and have a good probability of happening, and also possible risks that will have a significant impact but are not being controlled. However, this is only vulnerabilities visible on paper, when on-site and assessing the buildings and controls, you will most likely find more vulnerabilities. This includes out-dated and defective equipment and uncontrolled areas.

3) SOP and IAD's

I would like to separate Standard Operational Procedures and Immediate Action Drills a bit as it is something that is being badly neglected. SOP's and IAD's are as important as any other security system in place, without it there is no guidance in reaction and things often turn out quite bad or undesirable to an organization. Once again the organization's aim should be kept in mind when drawing up these procedures. I like to look at procedures before implementing mitigation as it will assist a great deal when it comes to cost, as you will likely see how much man-power and how much equipment is needed to achieve operational objectives.

The way your system integrates and reacts to threats is an important risk to look at. If the response is slow, the risk is greater, if the response is incorrect, the risk increases. I am pretty sure you get the picture here. A common risk when it comes to applying IAD's or responding to a threat is when all staff members rush to the location of the threat, leaving their areas of responsibility unattended and opening up the proverbial back-door for intruders to sweep in unnoticed. Identify roles and responsibilities for each threat and make sure every staff member knows it!

SOP's and IAD's should also be time/shift relevant! During holidays and night shifts for example there might be fewer staff members on duty. This can change things dramatically. There should never be any regulation changes, strict procedures should be attained at all times! The last thing you want is a burglary at night because staff members or cleaners left a door/gate unlocked or open.

Another thing to remember here is a detailed plan and list of immediate contacts that should be activated during emergencies or incidents. A touch of automation can be good in certain situations and again not so good during other situations. You do not want to be dropping security barriers and trapping employees inside when a fire breaks out, but dropping barriers when a deranged shooter tries to get access can be a good move. And also having a procedure of who to be contacted in case of more serious threats is very important! Will a tactical team be needed to respond from outside? Who will that be? do you have the relevant contacts and procedures to follow in case of a bomb threat? Who has to be contacted in case buildings need to be evacuated? Neighboring buildings could start burning, who do you contact then?

4) Addressing the threats

After you have compiled your list of risks and figured out what lacks in the procedures you should now be able to see the threats to the organization. Now you need to determine the course to be taken to minimize the risk of these threats. It should come as no surprise that the cost will greatly affect the course you will take. Staying within budget and getting maximum security optimization is not easy at all! Tip -This is where your contact list can be a great source of success.

Start by looking at the biggest threat on your list (the highest score one). What equipment will be needed to address it? Think of detection, cameras, man-power, and every other piece of equipment and training needed to reduce this threat to a lower score. A lot of times the same type of equipment and so on will automatically improve the other threats too. Or at least some of the same equipment and manpower can be used to tackle other threats.

Now re-asses the other threats according to the equipment, etc. that was added to the security system. From there, again, take the highest ranking threat and address it like the first one. Just continue this cycle until you can reach a reasonable level of risk from each threat. Always remember to KISS it as far as possible or use automation as much as possible, just be cautious of the cost factor, especially when it comes to software updates and such.

5) Analyzing system effectiveness

Physical protection systems should be described in detail before it can be tested! Ideally, you would like to stop a threat immediately and without any delay or negative outcomes and with as little as a possible disturbance in normal operations. But in reality, this rarely happens and one will always have to deal with some sort of shortcoming.

So to stop any threat you should first be able to identify it. A continuous threat assessment will outline threats and should be communicated with team members to remain effective and ahead of the threat. Team members should be trained in identifying abnormal behavior and activities, technology implemented and physical barriers used for this purpose. Strategically designing entries and exits can be just as valuable, to make sure any threat has to pass the detection phase before being able to access any facilities or inflict any damage to the organization.

After a threat has been detected, there should be a way to confirm that the detection is valid and of real concern and not just a nuisance alarm. This can be done via team members in contact with a Control-room/Security management or Team-leader. There should be good knowledge in the team about how criminals operate and how target selection works and everything that goes hand-in-hand with it. One can use the OODA loop to great effect here. Find out more about how the OODA loop works and the different phases criminals or a probable threat uses to select their attack right >Here<.

Once a threat has been confirmed, the aim is to delay the threat to get reaction forces to the threat and minimize its undesired actions. Of course, it is ideal for a team member that is in the vicinity already, to be able to neutralize the threat. But it is also ideal to have more than necessary force available. One adversary can be extremely determined or under the influence of narcotics and over-power or out-think a team-member and then become a more aggressive threat.  The effectiveness of response is measured by the time taken to get to the threat and to neutralize the threat.

So keep in mind that some organizations might require you to try and neutralize a threat without using aggressive force, I know, it's not something I am very much happy to say but to spare you a potential client or project you need to know how to act. And in this instance you need to know non-lethal options available, but, it is your job to convince these organizations about the reality we face each day. Organizations would likely want to avoid PR damage because of an unjustified shooting on their premises.

Testing effectiveness

To test the effectiveness you should be sure to fully understand all of the above points and what is required of your system to achieve maximum effectiveness. Only then can you define what is required and to be implemented. Once that has been put in place, there are a few ways to test its effectiveness, you could use penetration testing, call in other experts and run some drills over different times to see if detection and neutralization systems work. Nothing can prove effectiveness more than an actual criminal attempt, it's important for organizations to immediately assess their response after an attempt and identify any issues and improve on them.

Upgrading systems

If for whatever reason you can identify any viable threats after implementing mitigation strategies, you need to check for possible upgrades or changes in the system. This includes equipment, manpower, procedures, and software. When you implement new strategies or add anything you should again test for effectiveness, and repeat until the level of risk is acceptable. Always remember the cost affected with upgrades and additions or changes.

More on this topic

To follow up on this piece will be a few more posts regarding principal profiling and equipment and some more tips and tricks to help you formulate a threat assessment.

Until then, feel free to comment below!

Please subscribe to the site or follow me on Facebook @https://web.facebook.com/ALPHADefense

Know yourself

LOGO

Question

So the last few weeks have been interesting, to say the least. All around the world people have come together to make great change and unite for a single cause, and although it means keeping your distance from family, friends, and co-workers, most spouses found themselves face to face for a few weeks (depending on which country your in any way), and this has made them either re-spark their interested in each other or a lot of cases spur a bit of anger and frustration amongst each other. Hubby can no longer claim he has no time to tick of the evergrowing list wifey has made up and wifey had to implement a few changes too. So this has led me to think, how well do you know yourself? And, do you know how to control, disarm, and de-stress yourself?

Easy right?

To some, it might sound like an easy question right? Whether they are just ignorant or cocky, or maybe they do invest a lot of time into their own mental and emotional well-being, and they probably do find it to be an easy question. Even if you do, have you ever come to face the type and the scale of the current challenge we find ourselves in?.  Especially as protectors in an active field, we tend to witness and endure some things we do not wish to talk about and humanity, in general, is not supposed to be imposing on each other. Early on you get taught to not attach yourself emotionally to any client, victim, or perpetrator. But, as protectors, that is just not always possible, as we feel duty-bound to care, and for that reason sometimes unintentionally find ourselves attached to some situation. And until that situation has been resolved, we rarely find true peace.

More questions

So again, I want to bring another question to you. Have you ever taken the time to sit with yourself and run over a little assessment on yourself for a change? How great is the risk on yourself, both mentally, physically, and emotionally? And what if one of these underlying stressors jump out one day at the wrong time, under the correct circumstance? Say for instance in a supermarket, an argument with a family member or as mentioned above, in the instance of a lock-down where you can not run and hide from facing your spouse or children?

Many a man/woman have ruined their lives because they have lost control, even for just a second or two. Learning to control our own emotions is something that we seem to have lost during the recent generations. And in the times we find ourselves in nowadays, we must regain control.

It's the challenge we all face

What makes this challenging is that even when you can control your emotions during a challenging situation and act rationally, others will not see it the same way, and ultimately might blame you for any negative outcome. Think of a policeman for a second. At some point in his/her career, he/she will be faced with a decision, such as having to take a young man's life, perhaps even the same age as his child. If he does take the shot, he will save the lives of many, and if he does not take the shot, well who knows how many innocent lives could be lost, especially if it involves explosives or other lethal weapons. Sounds simple in words, doesn't it? Well place yourself in his shoes for a second and imagine that young man is your son? Would you be able to pull the trigger?

Will it impact you?

For some people, it seems obvious, but being behind the trigger in that scenario can and will have a lasting psychological effect. Sometimes, as protectors, we have to do things or see things that are not supposed to be happening in the first place. This can be dreadful for some. As we are sworn to protect, we do not wish to harm anyone for no meaningful reason, unless we truly have to.

Your challenge:

So I want to challenge you today to take some time during this chaotic and emotional shift that is happening in the world and asses your strengths and weaknesses and develop a plan to make sure you do not crack under the pressure. You will find a great deal changes once you gain control of your emotional state and start to perform at your maximum. And yes, it will possibly push you to make challenging decisions, but in the long run, it would most definitely be of great value to you. Reach out to that position you always wanted, talk to more people, and put yourself out there and expand your capabilities. And, if you need to, reach out to others and take your problems by the horn and pin that pain in the arse to the ground! Set yourself up to attack life head-on as soon as this pandemic eases down.

If you'd like, find some questions here and see how you can make a change in yourself today.

I salute you all, and I commend you for the great change you bring every day. Even if you do not see it, you are making things better, and what an honor it is to serve those who need protection!

Risk/Reward ratio

barbed-wire-black-and-white-crime-2057

Risk/Reward

Now and then a well-protected premises gets broken in to, and no matter what the reason was, someone found a way to break through the security systems. Why is that? Well, honestly, unless you live like a well-protected president (who also gets some attacks now and then), you will never be impenetrable or completely safe from every threat. I am not quite sure what other protectors like to call this, but it generally floats around as the risk/reward ratio. Meaning, if ever the reward that is to be gained is worth the risk associated or even more, then the likelihood of it happening still exists. You implement measures to irritate and keep someone from simply taking whatever they want from you. But, you can never really eliminate the urge of someone eager enough to grab it.

How is it still possible?

We have to remember that skills can be learned by anyone willing to learn them. Perhaps not always by the conventional manner we are used to, but either way, a skill can be learned. Many “masters” of their crafts become masters in the first place by developing beyond the conventional ways.

So, with that mouthful out of the way, here is what I mean. In reality, if I have to get or take from you what I so desperately want or need, especially when I have no other choice, I will be motivated enough to get it. And in that case, whatever means you have put in place to prevent me will be vulnerable to my motivated mind. I will most likely figure out some ingenious or perhaps absurd way to pass your measures and get what I want.

I like to call it the Risk/Reward ratio. But whatever the real term is for our industry, It simply means that if my reward is worth the effort, I might just take the risk.

I can think of various ways I have defeated some security systems and things I have seen in the industry, and for obvious reasons cannot mention them here. As I am always confident that just as we protectors are utilizing the internet, social media, and various skilled courses to enhance our capabilities, so are those we fight against. Many wolves amongst the sheep.

Closing off:

So, closing off, I hope it is clear to you that not any measure is impenetrable, think about how the enemy adapts, how technology advances, and how the sheer willpower of one man can change and revolutionize our industry. If an army is in my way, will 2 armies behind me defeat them? If an alarm system is in my way, will something be good enough to defeat it? Face it, we can never, ever be complacent. If you are wondering how to plan around this, then please read here.

Till next time, keep developing.

Risks VS Threats

adult-chart-close-up-1043514

Risk, Threat, and Vulnerability

Before any security detail can be put in place, you first need to determine the risks and threats that are present in your area of responsibility and the vulnerabilities they are open to. So, to start, it is very important to know the difference between risk, a threat, and vulnerability. I do however have to start by saying, this is just my explanation of how I see and measure Risk, Threat, and Vulnerability. You will indefinitely meet more people with more elaborate definitions or even some who sound quite the opposite of what I am going to attempt to explain in this post. So keep an open mind and try to KISS it. (Keep It Simple Stupid).

Here goes:

Risk: Risk is the potential for an unwanted result. For example a financial loss, loss of life, emotional trauma, or disruption of activities.

Threat: A threat is that occurrence or event that leads to, or causes the unwanted result (Risk). For example damage to infrastructure or property, murder, traumatic event, or sabotage. These events can happen by nature, the lack of maintenance, wear and tear, or it can, of course, be inflicted/implemented by a person.

Vulnerability: A vulnerability is a specific flaw or weakness in a system or a design in general. Such as someone with an allergy, it is not necessarily a risk on its own, as long as it is avoided. It can, however, be exploited by a potential attacker and used as a method of attack.

A quick example:

You have a nut allergy (Vulnerability). A long-standing business partner wants to eliminate you by exploiting your allergy (Threat). If he is successful in his covert operation, you will most likely lose your life (Risk). So, for you to survive, you will have to devise a plan to test your food and drinks, or even anything that may enter your bloodstream. A habit of chewing your pen (Vulnerability) may even be used, by applying some peanut oil on the pen.

So you can also see that some vulnerabilities can be used in conjunction with another, to achieve a less suspicious attack. One can get quite creative once you learn to exploit vulnerabilities and determine the risk it carries.

A proper risk assessment can tell a very definitive story. Once you make the connections, you will know where to focus your attention and do what is necessary to avoid the risk. Some risks will require more attention than others, depending on your mission results.

Perhaps you are not a security operative or into Risk-Management, and you wonder how this methodology can help you in normal life?

Picture yourself driving down the street on your way home. Looking around, you notice a bunch of everyday things, like people walking on the sidewalk, some garbage bags alongside a bin or two, a few potholes in the road and here and there a tree leaning over to the side.

What can this simple picture tell you? What if someone slips and falls off the sidewalk right in front of your car? What if he is drunk and deliberately walks in front of the car to draw your attention? Did you compensate for that? What if one of the garbage bags is half-way on the road, forcing you to swerve into oncoming traffic? Same with the pothole, or it can also cause a tire to blow and force your vehicle to collide into oncoming traffic? And what if that tree starts to fall right as you attempt to drive past it?

Conclusion:

It's a simple equation, anything that can cause a negative outcome (Threat) when coupled with asking "what if", can lead to a Risk. Some more severe than others. So it's evident that a risk is something that could happen, and a threat is a likelihood with which that same thing can happen.

If you would like to read more advanced terminology and explanations, I suggest you visit: https://protectioncircle.org/2017/01/27/threats-and-risks/