Guess what, the secret is in the process or formula to getting security right. If you don’t follow it you won’t be safe or secure.
Three Basic Realities
Security must be in place before the event occurs. You can’t protect against all threats. And protection from one threat will offer protection from a variety of others.
First, before the event occurs. I don’t know how many times I’ve heard someone say, “Well I’ll get a camera system if I get broken in to.” How dumb. There won’t be anything else that they come back for because they’ve already took your valuables, stupid. Second, it is just too costly to provide protection from everything. If you were to try, you would have to create a solid lead box without a door that can’t be moved. If it can be moved, given enough time, someone will break into it. Besides, it wouldn’t be very effective to have a box that you the owner can’t get into in the first place. And thirdly, protection from one risk will provide protection from other risks. For example, a laminated glass window will keep shards from a bomb blast from injuring people and it will also keep a burglar from breaking in.
The Risk Formula
The formula is comprised of three factors; asset criticality, the threat and vulnerabilities. Asset criticality is just that, how critical is it to you or your stated function. Asset criticality is affected by a variety of factors, a couple being direct support to what you do or lack of redundancy somewhere else. You can affect asset criticality by recreating redundancy of services/products or function at a second location that won’t be effected by a hazard at the first location. But the bottom-line is do you have something that someone else might want?
The threat is the threat. It can be either natural or man-made. I bet you can come up with, and in pretty short order, about 50 or so threats. Natural hazards, of course include hurricanes/high winds, rain/snow, earthquakes, and the like, and here in California – fire. This is a great segway, into man-made threats, which include; fire/arson, criminal activity including terrorist attack, burglary, and vandalism and so on. A lot of time is spent on thinking you can affect the threat. Well, the truth is you can’t.
You can affect its likelihood of occurrence or how bad it can become but that really has to do with vulnerability. So, the question to ask yourself is how vulnerable am I? Each hazard has its own tactic(s). Some require tools and others don’t
The Process - Make a List
First, determine how critical is what you are trying to protect to your overall service/product/location. That will tell you if you need to protect it or not. Think of it this way, you wouldn’t build a $1,000 shed to put your $15 bike inside of.
Then make a list of possible hazards – both natural and man-made. For example, I live in California so fire is on my list twice. Then make a list of possible tools that would be needed for the “bad guy” to perpetrate his/her crime or for the hazard to occur. And, then for each tool, see if you are susceptible to its use. Now you’ve completed the risk formula and have developed your Design Basis Threat (DBT). Use this “new” DBT to determine what security system you need to use in order to protect yourself. Some threats require the application of electronic security systems and others don’t. Incorporating non-electronic mechanisms, especially when designing inhabited space or in the built environment are usually more effective. Security for the most part should be hidden, it’s there but the untrained eye doesn’t see it. People use the space because it makes them feel warm and fuzzy. You know the feeling – like when you get a puppy.
Remember, two things: First, security cannot be a burden to those using the premises. If it is, people will figure out how to circumvent it and it will become ineffective, and second, when you think you’re done, start over.
Doug Haines, MPSE, is owner/CEO of Haines Security Solutions, Ventura, Calif.
Sign up is quick, easy, & FREE.