How to Layer a Comprehensive Security Plan
By Richard D. Maurer
June 2002
With the public's increased awareness of
physical security, many security directors and facility managers are being
called upon to increase the security and safety of their workplaces. Usually
this request comes with the provision that there is no extra money available.
When developing a comprehensive security
plan you must remember the three basic elements of physical security:
Mechanical (electronic systems)-Covering
the use of security hardware including access control, CCTV, door locks,
monitoring systems and intrusion alarms.
Operational (security staff and procedures
as well as organizational security)-Covering the involvement in the security
programs by management, security staff and employees.
Natural (architectural elements)-Covering
basic security philosophies involving property definition, natural surveillance
and access control.
Sadly, many security programs focus too heavily on just one of the above
basic security philosophies. Some facilities rely too much on security
guards who may be fooled into allowing unsafe individuals access. Other
facilities focus on mechanical security, leaving their security staff
and tenants untrained and uninvolved in the security process. Still other
facilities forgo the use of mechanical and organizational security, depending
on the goodwill of others or the psychological effect of signage.
Establishing a security program that utilizes
a balance of all of the above philosophies will keep the program flexible
and ready to handle potential risks that may appear.
Examine Risk
You start your security plan by evaluating the level of risk to your facility. First, what is your neighborhood like? Do you have neighbors that might attract unsafe individuals to your neighborhood? Does your facility contain individuals or activity that also might bring unsafe activity to your doorstep? Do you have a building filled with dentists or a building filled with federal law enforcement agencies or a major media outlet? Each of these buildings has different levels of risk, and the security plan would be different in each case. How well known is your facility on a local, national or international basis? Is it near railroad tracks or major freeways? More American office buildings have been evacuated due to toxic fumes from derailed trains and overturned trucks than terrorist activities. Are you near a university or college? Do any of the tenants in your building have negative media exposure? Are there certain organizations that are not thrilled with the existence of one of the tenants in your building?
Examine Your Perimeter
Now that you have determined if you have
a high-, medium- or low-risk facility, you need to start your plan from
the outside. First off, who are you allowing in your building? If your
organization is the lone user of the building, what type of background
investigations are you conducting on new employees or contractors? Do
you know if the new individual coming through the door is a legal resident
of the United States? Does this new employee have a history of violence,
drug use or theft? If he or she is handling money, have you conducted
a credit check? Are you allowing undocumented members of your cleaning
crew to have free access to every office in your facility at night? The
costs for a background investigation for each new employee are dwarfed
beside the losses you might suffer if you allowed a violent individual
into your work areas. In the case of contract firms that supply personnel
to your facility, does your contract ever require them to conduct background
investigations of their staff, and do you ever audit this activity?
Do your new tenants or employees get some
form of security and safety orientation? Do they know who to call in an
emergency? Do they know who should have access to their work area? Do
they know the emergency evacuation routes, and do they know where they
should meet after they evacuate the building so a headcount can be conducted?
Are you in regular contact with the local
law enforcement authorities to learn what criminal activity is happening
in your immediate neighborhood? Do you have a method of passing on this
information to your tenants or employees?
Now look at your facility as a stranger
might from the outside. Are your property boundaries clearly defined?
Would a stranger know if he or she were walking or driving from public
to private property? Is this defined by signage or architectural design?
Is your property given the appearance of being well maintained? Is graffiti
quickly removed or covered? Are bushes trimmed low? Is the lawn maintained?
If not, you will give the stranger the impression that you don't care
about your facility's appearance and probably also do not care about security.
At night, is the area around your property
dark and foreboding or well illuminated? Do your employees or tenants
feel apprehension when they walk from your building to the parking lot
or parking deck at night? Could they see danger at a distance or are there
shadowy hiding areas where unsafe individuals could be lurking?
If you have a large parking lot or a parking
deck, do you provide your employees, visitors or tenants emergency call
boxes? Are these boxes well illuminated and marked? Are they easily seen
from all areas of the parking facility? Are the call boxes regularly checked
to make sure they are working? Is there someone always ready to answer
an emergency call from the call box? If the call comes in, will the person
answering know where the call is coming from if the person making the
call cannot speak?
Now we have only made it to the outer walls
of your facility, but we have already discussed four layers of physical
security involving lighting, background investigations, employee orientation
and property definition.
Access Points
How many entrances are there to your building?
Are these entrances monitored? When we say monitored we could mean a lobby
receptionist, a CCTV camera or an employee that can observe the entrance
from his or her desk. Could an office creeper or stalker enter your facility
without ever being seen or recorded by anyone or any system? Don't forget
about the back doors and the loading dock. Limit the number of access
points to your building and use some form of natural or mechanical surveillance
so that those approaching and entering the facility have the feeling they
are being monitored.
When using mechanical security systems,
such as CCTV, look for systems that will give you the best bang for your
buck. Which would be more helpful, a CCTV system that records individuals
walking down a hallway at three in the morning or a system that records
and alerts your monitoring station that someone is walking down that hallway
and advising them what action may need to be taken? Make sure you are
using all the features available in your security systems.
One other access point is your air intake
vents. I am not talking about a disgruntled ex-employee entering the facility
through the vent, but introducing some toxic substances to your building
to disrupt your operations. Are your air vents on the roof or at ground
level? I have found many of these vents, in buildings built in the 1960's,
in the loading dock area where a badly positioned vehicle could introduce
exhaust into the HVAC system. Are your ground-level air intakes monitored?
How quickly can you turn off your HVAC system in the event a foreign substance
is introduced to your system?
Lobby Security
The front lobbies of many buildings can
be an amazing layer of security. Have you ever walked into the lobby of
a commercial building to observe the lobby attendant with his head down,
behind a counter, reading a book or watching TV? What was your first impression
of the security of that facility? If you were an unsafe individual, would
you feel comfortable trying to continue on into the building? What if
you walked into the same building and the lobby attendant stood up, greeted
you, made eye contact and asked if he could be of assistance? What would
your initial feeling of the facility security be under this scenario?
Make sure all members of your lobby staff
team follow the same procedures when it comes to access control. If your
procedures call for an authorized photo ID to be examined before an employee,
visitor or tenant is allowed into the facility, make sure all members
of your lobby team are following this rule. All it takes is one lobby
staff member who thinks he or she knows everyone who works in the building
without checking the ID as required. An employee who has been terminated
and had their corporate ID removed could gain access not as an employee
but as a disgruntled ex-employee. When the know-it-all lobby staff member
goes on vacation and is replaced by a staff member who does not claim
to know everyone, then you will start getting phone calls from tenants
or employees wondering why, if their ID hadn't been checked in the previous
two years, was it checked today?
Depending on the level of risk at your
facility, you may want to introduce an inspection layer in your lobby.
You may want to install signage that indicates you plan to randomly inspect
packages carried in by visitors. You may have visitors walk through a
magnetometer. Again, this will be defined by the potential threats to
your facility.
Here is where the use of physical or optic
turnstiles can make your physical security plan more effective. If you
have hundreds of employees or tenants, there is no way a lobby attendant
is going to remember who is authorized access and who is not, especially
if you have a 24-hour-a-day operation. Using a turnstile system, the employees
or tenants will display their access card and be allowed access. In lobbies,
the low turnstiles will require an attendant to be available to deal with
visitors or persons who jump over the hardware. But at backdoors or little-used
entrances, a full-size turnstile system could keep unsafe individuals
from entering the facility. There are systems available that even weigh
the individual gaining legal access to make sure he or she is not trying
to squeeze someone else through at the same time. These turnstile systems
even allow persons legally leaving the building to not accidentally let
unsafe individuals into the building.
Security Command Center
Many large buildings I have reviewed will
have a security command center located in an area separate from the lobby
or loading dock. This is the area where a facility evacuation or other
emergency will be monitored or controlled. Does your command center have
a separate HVAC system? Does the command center have back-up power? Are
there simple, easy-to-read emergency action plans in the command center
for the staff to use, or do you expect the staff to remember what steps
to take in an emergency? The emergency action plan should include, at
a minimum, plans for handling:
o Fire
o Elevator entrapment
o Flooding
o Local natural problems (earthquakes, tornados, etc.)
o Hazardous material spills
o Medical emergencies
o Loss of electrical power
o Armed intruders
o Hostage situations
o Bomb or terrorist threats
o Suspicious packages
o Workplace violence
o Civil disturbance
The odds are in your favor that you may never have to handle one of these emergencies, but wouldn't it be easier to sit down and develop a simple plan of action beforehand than to try and figure out a plan as the emergency goes down?
High-risk Areas
Now we have gotten into the building, where
are the strategic areas of the facility that require greater security
coverage? Does your company or any some of your tenants rely heavily on
technology? You may have carefully secured the server rooms, but how secure
is the phone room where all phone lines and Internet access come into
the building? I have reviewed far too many buildings where the computer/server
rooms are beautifully secured with even biometric systems and the phone
room was found unlocked right off the main lobby in a semi-public area.
A person wanting to disrupt your business or have access to your secrets
just needs access to that phone room. Make sure the phone rooms are secure
and monitored.
What other strategic areas are in your
building? It could be a filing room, a safe, a money counting room, etc.
What work area is the most important to your business or function? Be
sure to place an additional layer of security around these strategic areas.
This layer can take the form of physical or electronic access control,
CCTV monitoring, intrusion alarms or security staff. Post signs at each
of these strategic areas indicating "Authorized Persons Only."
Depending on the level of risk in your
building, another security concern comes with mail and other deliveries.
If you have a high-risk building, does your mail get delivered and handled
in a separate messenger center? Does this message center have a separate
HVAC system? Does the staff in the message center have adequate training
and access to safety equipment such as gloves, masks and plastic bags?
Does the staff have training in how to handle suspicious packages and
who to contact in the event a suspicious package is found?
Levels of Response
Now that you have layered the security
of your facility you have one additional concern. What will your security
levels of response be? What we have described so far are the layers of
security planned for your building on the average workday. What if your
facility comes under some form of alert? A neighborhood protestor or a
disgruntled ex-employee may direct a threat towards your building, company,
tenant or area.
You need to develop a plan for additional
layers of security in the event of such threats. Will you add security
staff? Will you shut down some access points? Will you increase access
control? Will you increase package inspections? By having an increased
security plan already in place with your staff trained in their new duties,
when a threat comes around, you are ready and don't have to start planning
on the fly.
As you can see, planning the security of
your facility comes in layers of organizational, mechanical and natural
security. By using all these areas of physical security, you can develop
a security program that is both effective and cost effective.
About the Author: Richard D. (Rich) Maurer is a senior associate
in the Security Services Group of Kroll Inc, the risk consulting company.
He has more than 30 years of experience as a law enforcement and security
manager. He also is the vice-chairman of the ASIS Physical Security Council.
Rich manages risk analysis as well as security reviews of government,
corporate, hospital, retail and educational facilities nationwide. If
you have questions, Rich can be reached at [email protected]
or at 678-232-8768.
