Critical infrastructure sectors play a crucial role in maintaining the functioning and well-being of the United States. The Cybersecurity and Infrastructure Security Agency (CISA) identifies sixteen critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the country that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. Those sectors are:
- Chemical
- Commercial Facilities
- Communications
- Critical Manufacturing
- Dams
- Defense Industrial Base
- Emergency Services
- Energy
- Financial Services
- Food and Agriculture
- Government Facilities
- Healthcare and Public Health
- Information Technology Sector
- Nuclear Reactors, Materials, and Waste
- Transportation Systems
- Water and Wastewater Systems
This article will provide examples of how video surveillance can protect the industries that protect the U.S.; namely chemical, food and healthcare. In most cases, the specifier of video surveillance does not have to reinvent the deployment strategies, but through diligent research can identify standards that have already considered the inherent risk to critical infrastructure and determine how video can be most effectively deployed to mitigate those risks.
There are several references to industry guidance documents that have been developed to assist critical infrastructure facility leaders and specifiers of video systems. Leaders are encouraged to become familiar with applicable guidance or seek the assistance of an independent outside security expert to determine risks and requirements. Finally, whenever video is deployed, there should be a clearly defined purpose for each camera and use them for more than just forensic purposes whenever possible.
Video in the Chemical Sector
One of the primary threats and risks to be addressed in this critical infrastructure setting is the release -- theft or use of a volatile chemical to create the loss of life.
While the Chemical Facility Anti-Terrorism Standard has recently expired, the risk-based performance standards suggest for the perimeter security of the highest risk facilities, the use of extremely reliable video surveillance for the identification and evaluation of a perimeter intrusion in real-time, providing notification of intrusion to a continuously staffed location. In our experience, this performance standard is best met using thermal imaging cameras with proven “people, vehicle or boat detection” analytics. This technology achieves CISA’s extremely reliable definition as it is functional during all anticipated conditions, including complete darkness, twilight and inclement weather.
These same principles can also be applied in the chemical sector when an asset-based philosophy is used, versus providing security at the perimeter. Critical assets and choke points are fundamental principles to apply when specifying video surveillance. According to the risk-based performance standards, to effectively secure assets against forced entry or sabotage, detection of the adversary generally should occur at a point at which there is sufficient delay between the point of detection and the arrival of adequate response forces. Detection through monitoring may be achieved by direct human observation or by using a combination of technical security measures such as alarm sensors, thermal imagers or intelligent video with human assessment of the situation to initiate the correct response.The mission here is to continuously monitor restricted areas or critical assets such as chemicals of interest loading and unloading areas, critical valves, pipelines, manifolds, control rooms, or storage facilities. This same principle of continuous monitoring is applied to facilities regulated under the Marine Transportation Security Act (33 CFR §105.275) and more specifically:
- Facility and its approaches, on land and water.
- Restricted areas within the facility; and
- Vessels at the facility and areas surrounding the vessels.
Video for forensic purposes only is not going to get the job done in the chemical sector. Owners and specifiers should be looking to incorporate video analytics to convert the solution from passive mitigation to an active detection and alerting solution. Even in instances where video is used for safety matters such as process monitoring, an analytic can identify smoke or fire in the video feed, enabling early detection of fire incidents and enhancing safety measures.
Video in the Food Sector
One of the primary threats and risks to be addressed in this critical infrastructure setting is the intentional contamination of a food or beverage for the purpose of wide-scale public health impact or to otherwise damage the brand and reputation of an organization.
The use of video in the food sector is encouraged by the FDA, referred to as a technology-assisted mitigation strategy. The FDA suggests the use of technology-assisted mitigation strategies to enhance human supervision or observation of actionable process steps. An actionable process step in the food sector is defined as a point, step or procedure in a food process where a significant vulnerability exists and at which mitigation strategies can be applied and are essential to significantly minimize or prevent the vulnerability (21 CFR §121.3).
For example, using video surveillance systems or other monitoring devices can support the observation of highly vulnerable areas and actionable process steps. The mitigation strategy in this case is the act of observation and monitored video can be used to facilitate increased observation. Additionally, according to the FDA, a video system may support this mitigation strategy even without constant observation or an employee tasked solely with observing the video feed. For example, workers might monitor several processing activities from a control room, including an actionable process step through a video monitor. The facility’s evaluation of that mitigation strategy could conclude that the video monitor elevates observation of the actionable process step to the point that the significant vulnerabilities associated with that step have been significantly minimized because one or more workers in the control room would notice the actions of an attacker while routinely, but not constantly, watching the video monitor as part of their duties. While the logic used here by the FDA is questionable, this is in fact the guidance that they have provided the industry. The true risk reduction of the application of video in this context would be minimal at best, and other physical security strategies such as delay, deny (access) and detection would achieve far better outcomes.
The ASIS Food Defense and Agriculture Security Community has issued the document, “Physical Security Guidance for the Food and Beverage Industry to Improve Food Defense Outcomes.” Published in late 2021, it provides a variety of physical security considerations including a section on video surveillance. Some of the food defense use cases for video according to this resource include:
- The exterior and interior of the loading dock areas
- The area where Quality Control testing is performed
- Dispensing and mixing areas.
- Locations where labels, coupons and anti-fake stickers are stored
- Packing lines – recommend one at each end
- Returned / Damaged Goods areas
- Waste Processing Areas
- Other identified Critical Control/High Hygiene areas within the manufacturing areas
- Areas where controlled and/or listed chemicals are stored
Video in the Healthcare Sector
There are many risks to be mitigated in healthcare. We will focus on examples of risk to vulnerable populations and to sensitive assets.
The healthcare sector is one of the most complex arenas to deliver effective security. When focusing on high-risk areas, there are clear use cases for video grounded in industry best practices. For example, infant and pediatric care areas represent an area where the risk of abduction is universal. The National Center for Missing and Exploited Children (NCMEC) states, “Digital video recording, coupled with access control, serves to document a potential abduction as it unfolds. Video may also help in resolving and documenting false alarms of systems, varying according to the manufacturer, for supervisory and/or investigative follow-up. Additionally, video surveillance cameras and alarm panels coupled with security signage serve as a visual deterrent to the potential abductor. If properly used by facilities, these precautions clearly add to the potential of deterring an abduction; identifying and locating the abductor more quickly when an abduction does occur; prosecuting offenders; and, most importantly, aiding in the recovery of an abducted infant.”
NCMEC calls for cameras to be placed in strategic locations to cover all exit points where infants and pediatric patients are located. Consideration should be given to the entrances of units, the nursery, hallways, stairwells, and elevators. Cameras should be adjusted to capture a potential abductor’s full face, and care should be taken to avoid strong lighting behind the individuals on camera. Recording must always be functional and provide a minimum of seven days of prior activity. Seven days seems a little light, particularly when one considers the NCMEC profile of an offender which includes, “Frequently initially visits nursery and maternity units at more than one health care facility prior to the abduction; asks detailed questions about procedures and the maternity floor layout.”
These advance visits may exceed seven days, so with advanced investigative capabilities associated with IP video, a suspect could be quickly identified at all times while on hospital property for the duration of the recorded video. This will greatly assist police investigators.
Another use case from an asset protection perspective would be the pharmacy. The pharmacy houses scheduled narcotics and controlled substances that have a high value on the street and may also be targeted by persons with addiction. Some of the design standards associated with a pharmacy that can be effectively met with video surveillance coverage according to the International Association of Healthcare Safety and Security include:
- Clear and unobstructed view of persons requesting entry and the areas surrounding entry points.
- A video intercom or other mechanism should be installed to allow staff to view and communicate with those requesting access at delivery entrances.
- Main perimeter access points.
- Receiving areas.
- Narcotics vault or other controlled substances storage.
- Narcotics refrigerator, if located outside of room vault.
- Satellite storage locations.
- Transaction counters and windows.
- Bulk product packaging areas.
- The external perimeter of the pharmacy such as connecting hallways and lobby areas. A video monitor should be available to staff inside the pharmacy so they can view the hallway outside the entrance door for people loitering who may pose a risk of robbery or forced entry into the secure area of the pharmacy.
Conclusion
This article provided examples of the role video surveillance plays in protecting typical U.S. critical infrastructure sectors. Leaders and administrators of critical infrastructure sector facilities should become familiar with industry guidance documents or contact an independent security consultant for guidance and application of video management system best practices. Independent experts can ensure that when video is deployed, there is a clearly defined purpose for each camera and that cameras are used for more than just forensic purposes whenever possible.
