Chapter 8
Security System Design and Implementation: Practical Notes

Security Threat-Level Factors

There are various factors that may influence the security of any industrial facility, as was discussed in detail in the previous chapters. These factors vary from system- or plant-related threats, to chemical–biological threats, which may directly affect internal security as a whole.

Security within the industrial plant or oil facility may also be affected by external threats, ranging from planned terrorist activities, to sabotage and individual attempts by disgruntled staff of opponents in the market. Terrorist activities are becoming more prevalent where facilities sustaining sensitive and/or expensive operations may fall victim to such attempts, especially in light of most conflicts being more asymmetric of nature (asymmetric warfare: conflicts that are nonconventional and difficult to define; the intended hostility and identity of the belligerent are not visible).

Considered Factors

Existence of a terrorist threat and its ability to gain access to a given facility will be influenced by the following factors and should be analyzed according to its perceived manifestation and the prevailing trends and tendencies as mapped within a specific country and certain political arenas.

The acquired assessed or demonstrated abilities or capabilities of the terrorist group must be analyzed in detail by utilizing security information analysis. It may also be advisable to approach existing sources of intelligence gathering on regional and national levels.

The intentions of the terrorist organization must be obtained or assessed. These may be found in recently demonstrated company hostile activities or intent, or stated intent to demonstrate hostility toward the company or a country. If the company represents a symbol of the country of may be classified as a national key point (NKP), the threat potential will be far higher than expected. The following are critical considerations: What is the history of the group? Have they conducted terrorist activities in the past? What is the current credible information on activity indicative of preparations which indicate attack is imminent? The US Department of Homeland Security (DHS) uses the following color code to assist during the analysis of threat levels (Table 8.1).

Table 8.1 US Department of Homeland Security color code: security threat levels

DHS color code
CriticalRedFactors, 1, 2, and 5 present, maybe 3 and 4 also
HighOrangeFactors 1, 2, 3, and 4 present
MediumYellowFactors 1, 2, and 4 present
LowGreenFactors 1 and 2 present, factor 4 maybe present
NegligibleFactors 1 and/or 2 present

Terrorist or other hostile activities may be attempted to destroy a facility or to affect its specific output of a specific chemical or product. In most cases, these activities are conducted by using any form of explosives, varying from manufactured munitions to improvised explosive devices. Vehicle bombs are best known for these attempts, due to its mobility and opportunity to enter a facility through the standoff zone and will be discussed later.

Vehicle bombs

Vehicle blasts can develop very high pressures, but the pressures decrease rapidly with distance. This was clear during the highly destructive nature of the explosion at the Khobar Towers in Riyadh—1996. The terrorists were reported to have smuggled explosives into Saudi Arabia from Lebanon. In Saudi Arabia, they purchased a large gas tanker truck and converted it into a bomb. Al-Mughassil, Al-Houri, Al-Sayegh, Al-Qassab, and the unidentified Lebanese man bought a tanker truck in early June 1996.

Over a 2-week period, they converted it into a truck bomb. The group now had about 5000 lb of advanced, high-grade plastic explosives, enough to produce a shaped charge that detonated with the force of at least 20,000 lb of TNT, according to a later assessment of the Defense Special Weapons Agency. The power of the blast was magnified in several ways. The truck itself shaped the charge by directing the blast toward the building. Moreover, the relatively high clearance between the truck and the ground gave it the more lethal characteristics of an airburst. It was originally estimated by US authorities to have contained 3000–5000 lb of explosives.

Later the General Downing report on the incident suggested that the explosion contained the equivalent of 20,000–30,000 lb of TNT. The terrorists prepared for the attack by hiding large amounts of explosive materials and timing devices in paint cans and 50-kg bags, underground in Qatif near Khobar. The bomb was a mixture of gasoline and explosive powder placed in the tank of a tanker truck (Figs. 8.1 and 8.2).

c08f001.gif

Figure 8.1 One view of Khobar Towers bombing (Riyadh, Saudi Arabia) in 1996.

c8-fig-0002

Figure 8.2 Damage at Khobar Towers, note size and depth of bomb crater.

In order to prevent such an attack, the barriers on the perimeters must prevent penetration of the vehicle beyond the standoff zone. There are three levels of protection based on building damage:

  1. Low: Buildings destroyed
  2. Medium: Buildings damaged but re-usable
  3. High: Only superficial damage (buildings may be designed to be specially blast resistant)

There are two very important measures to be instituted of improved to ensure that barriers and perimeters are impenetrable:

  1. Reinforced vehicle barriers
  2. Planning and maintenance of the standoff distance

It is however important to first understand the levels of threat and types of weapons that may be used to attack a facility, before the importance of vehicle barriers and the enforcement of the proclaimed standoff zone and distances could be understood best.

Standoff weapons

Standoff weapons include machine guns, artillery, heavy caliber guns, and mortars. They cannot be detected in advance. The best protection is prevention of line of sight from exterior vantage points. Screen with trees, walls, or fencing. Even wooden fences can be used for pre-detonation devices.

If mortars are a concern, strengthen roof surfaces to withstand blast and add a layer of protection to reduce line of sight. The facility may require added internal reinforced concrete walls to serve as sacrificial walls for blast resistance. Masonry is generally resistant to all but armor piercing rounds. For military weapons, thicknesses must be doubled to 18–20 cm of brick or 18 cm of reinforced concrete.

Minimum standoff distances

The minimum standoff distance is 50 ft (20 m) or more depending on the type and amount of explosives anticipated. Use tools such as ALOHA or Archie (disaster management tools or the formulas presented in earlier chapters) to calculate blast damage based on the size of the vehicle and anticipated weight, and adjust accordingly. Walls may tend to magnify blast and can create missiles if blast is next to wall (Figs. 8.3 and 8.4).

c8-fig-0003

Figure 8.3 Minimum standoff zone. Note distance is a minimum depending on type of weapon attack anticipated.

US Army Field Manual on Physical Security: FM-19.30 Physical Security.

c8-fig-0004

Figure 8.4 Standoff zone for medium-to-large facilities.

US Army Field Manual on Physical Security: FM-19.30 Physical Security.

For nonexclusive standoff zones, an additional layer of distance (protection) is required (see Fig. 8.5).

c8-fig-0005

Figure 8.5 Exclusion zone for larger facilities.

US Army Field Manual on Physical Security: FM-19.30 Physical Security.

The best protection is achieved thorough search and not allowing any vehicles inside the standoff zone, unless cleared by security after searching.

Fencing is not a barrier. Most fencing will delay people less than 10 seconds, 4 seconds to climb and 10 to cut. A bomb inside a building (mail room) is much more hazardous than a bomb outside because the force is not dissipated. Keep the mail room and delivery points separate and rather of light construction or revetment grade (revetment grade is designed to withstand and dissipate a blast). Receiving areas should be kept away from other areas and designed to prevent blast damage. Utility openings, including drainage ditches, and sewer openings of greater than 20 cm diameter should be protected against intrusion or insertion of a weapon. Seal manholes and close gaps for drainage swales. Barrier fences should be at least 2.1 m tall, with barbed wire or concertina wire on the top. Maintain a clear zone around the perimeter of the exclusion zone.

Security System Design

Security design is probably the most important element for the future existence and profitability of any industry or company. The security architecture is therefore dependent on detailed consideration, planning, and implementation of various facilities and infrastructure upgrades to ensure a proactive and technologically relevant security environment. Aspects to be considered, as well as discussed further in this chapter, are as follows:

  • Perimeter barriers
  • Vehicle control barriers
  • Entry roadways and control stations
  • Reinforcement of buildings and infrastructure
  • Security lighting
  • Electronic security systems
  • Exterior sensors
  • Access control
  • Employee screening
  • Visitor identification and control
  • Personnel and packages control (deliveries and contracting)
  • Lock and key control
  • Security and guard forces
  • Cargo security
  • Port security (where applicable)

Perimeter barriers

Perimeter barriers are fixed around the perimeter of the standoff zone and include the following types which may vary according to the threat potential and level of fortification required:

  • Chain link fence
  • Hedges
  • Curbs at least 8″ (20 cm) high
  • Jersey barriers (Fig. 8.6)
  • Cable reinforced bollards
  • Spacing 1.2 m or less

Active vehicle barriers are much more expensive, but with proper design can stop vehicles of 7000 kg at speeds of up to 85 km/h. Much heavier construction is required which further ensures anchorage in the ground. Active vehicle systems include bollards, cable beams, sliding gates and drum, and so on.

c8-fig-0006

Figure 8.6 One type of perimeter barrier.

Photo of a New Jersey Barrier: www.safety.fhwa.dot.gov.

Active vehicle barriers

Active vehicle barriers are installed and constructed at all main entry and exit points to facilitate controlled movement. Although movement control is exercised from these locations, active vehicle barriers must be able to prevent forced entry in the best possible way. This aspect is again dependent on the level of the anticipated threat and the analyzed methods of forced entry expected. In Figure 8.7, different active vehicle barriers are illustrated, varying from cable beam barriers and retractable bollards, to drum-type barriers.

c8-fig-0007

Figure 8.7 Active vehicle barriers.

US Army Field Manual on Physical Security: FM-19.30 Physical Security.

Entry roadways

Speed control is important. Establish an entrance lane that provides a serpentine path and that limits vehicle speeds to 15 km/h. Use Jersey or other types of barriers to slow vehicles. Establish barriers both inside (after) and outside (approaching) the perimeter barrier. The sides of the entry roadway should have high curbs to prevent vehicles from leaving the roadway.

Entry control stations

Entry control stations should be located at main entry points where guards and control staff are present. A holding area should be established for unauthorized vehicles and the turnaround for other vehicles prior to inspection. Vehicles passing through the entry control stations should display a vehicle sticker or temporary visitor card. Entry control stations should be manned 24 hours and should be equipped with quality interior and exterior lighting. Exterior motion detectors have to be installed to enable threat detection or vehicle movement from a distance. Entry control stations should further be reinforced for it to be bullet or blast proof as the threat may indicate. First-class communications systems must be installed and made available with secure interfacing between telecom and radio facilities. Sufficient technology must be considered to assist signaling potential threat indicators. Signs clearly signaling all control requirements and law enforcement policies, where applicable, must be displayed (preferably in most local languages possible) at least 30 m from control and entry stations.

It is important to consider that the master command, communications, and control center should not be located at the main entrance unless the building is blast proof. In every event, a backup location away from the front gate should be established, and all communications should be routed to this station in parallel so that it has the same information as the main station in the event that the main station is disabled by blast, attack, or incident. All sensors should be routed to this backup station as well, but not through the primary station.

c8-fig-0008

Figure 8.8 Design of the electronic security system.

Reinforcement of buildings and infrastructure

Blast forces will be substantially horizontal, but will require reinforcement of floors and walls to withstand blast pressure. Most buildings nowadays are designed to withstand 2.3 kPa; explosion pressures can be significantly higher. The use of reinforced masonry or concrete is added to newer buildings to absorb or counter blast pressures.

Windows

Windows present a special problem. Flying glass accounts for 85% of injuries. The following preventative and reinforcing methods may be considered and applied according to the nature of the anticipated threat potential:

  • Use fragment retentive films.
  • Install blast curtains.
  • Reinforce window frames or replace it with blast resistant designs.
  • Design narrow windows, preferably on top of occupied space to reduce glass hazards and the likelihood of thrown or fired projectiles.

Security system lighting

Security lighting is probably one of the most important elements of security and will enhance all other technologies and planned efforts to secure any environment. Without quality and sustainable lighting in all strategic locations, security services are rendered blind. In order to plan and install a guaranteed security lighting system, the following critical considerations are applicable:

Considerations

  • Cost of replacement, cleaning, and maintaining fixtures including bucket trucks for high lights
  • Manual override provisions during blackouts—requires separate power sources
  • Local weather and its impact
  • Electrical requirements, voltage fluctuations, grounding requirements, and rapid bulb replacements
  • Use of lighting for CCTV support
  • Exclusion areas and critical areas (high risk)
  • Protective lights—redundancy and independence so multiple failures do not occur
  • Requirements of adjacent properties
  • Restart time (after power failures)
  • Color accuracy and illumination levels
  • Parking and control areas and guard and fence areas

Lighting system design

The value of a well-planned and sustainable lighting system design is that it will assist in discouraging intrusion by making detection likely and that it will enhance all re-active efforts by the guard force and other observers.

Boundary areas must be lit so that guard paths are darker, in order to present glare in the eyes of attackers. High brightness and contrast between intruders and background is required. Though it may sound ridiculous, it is crucial to keep buildings brightly painted and clean to assist in providing sufficient silhouetting of the intruder. Standby or emergency lighting should duplicate existing patterns. Illuminating both dock areas and approaches is required. Docks should have at least 10.74 and 5.37 lx/m2 for water at least 30 m out from the pier (port/plant security).

Electronic Security Systems Design

Electronic Security System (ESS) is the placement and implementation of electronic systems to serve as early warning to unauthorized intrusion or other planned attacks. This may include closed-circuit television (CCTV), security lights, various forms of sensors, alarms systems, and a well-trained and adequate guard force for response. ESS should be reliable, accurate, and updated according to most recent technologies. ESS must delay the intruder from achieving their objectives until response arrives. A well-designed system minimizes the possibility of covert intrusion. All sensor systems have nuisance alarms and physical design constraints for detection. Respect those constraints! Manufacturers do not provide information on nuisance alarms: they occur from environmental conditions (wind, birds, etc., and from electrical faults). If alarm system sensors are delayed, it increases the area of search.

The speed in which detection is achieved is important. If a fence is scaled or cut in 10 seconds and man runs 6 m/s, a 2-minute delay could result in an area search of over 80 ha (200 acres). CCTV cameras must be independently illuminated. A scanning system should be installed for more than 10 cameras. Most exterior intrusion sensors are exposed to much more rugged environmental conditions and generally do not detect movements above 2.5 m even on fences. Buried sensors generally are not able to detect movements more than a meter from the ground surface. Interior Electronic Security System (ESS) sensors are generally less costly than external sensors. For entrances, windows, and so on, there has to be an access mode where the alarms are shut off for normal access and a secure mode where they are activated. The secure mode should never be locally controlled and access mode must not de-energize the alarm. Duress and tamper switches must never be put into access mode. Each type of sensor has its limits. Fog, rain, and dust limit infrared (IR) capabilities—it might therefore be advisable to consider thermal imaging to supplement IR. Wind may cause fence-mounted sensors to give false alarms. Vegetation can cause many false alarms and conceal intruders. Line of sight is extremely important for detection and confirmation (Fig. 8.8).

Alarm configurations and design

Alarm configurations for small systems may provide individual alarms for specific areas or a general alarm depending on configuration. An ideal system will provide specific area notifications to increase probability of detection and minimize false positives. Computer-assisted systems may use multiple computer processors and automatic reset as well as entry/card acceptance for certain functions. All alarm systems should be connected through redundant data transmission links to prevent local loss of signal from inactivating regional and zone alarms. Alarms should be logged, preferably by printer. There are five possible alarm levels:

  1. Duress or life-threatening emergency alarms
  2. Intrusion detection
  3. Electronic entry control
  4. Tamper signals
  5. CCTV and equipment malfunction alarms

Exterior sensor types

Exterior sensors are quite straight forward and differ from facility to another facility, again based on the threat levels and the type of intrusion/violation that could possibly be expected. All external sensors have the mutual objectives to provide early warning and during extreme measures to terminate the attack/intrusion. External sensors may consist of the following:

  • Fence sensors
  • Strain-sensitive cables
  • Taut wire sensors
  • Fiber optic strain
  • Electrical fields
  • Capacitance proximity sensors
  • Buried line sensors
  • Line-of-sight sensors
  • Microwave sensors
  • IR sensors (active and passive)
  • Video motion sensors

Access control

Access control is the primary point for the enforcement of security and is probably the most vulnerable area, providing entry to the processes of the industry or complex. The main focus of effort by security staff, the guard force, and detecting technology should be directed here. History has taught that most unauthorized entry, especially vehicle improvised explosive devices proceed through access control points. In many case studies performed, this is usually supported by staff within the complex, either being supportive to the intruder or being forced to participate. There are three main types of access control points that should be established to ensure controlled entry.

Three types of areas are as follows:

  1. Controlled area—The area surrounding an exclusion zone entry. This area is controlled, but all movement remains unrestricted.
  2. Limited area—An area surrounding a sensitive security interest. Escorts may be required.
  3. Restricted area—This is the area where the security interest is located. It includes control rooms and guard facilities. Clear restriction and warnings signs should be posted outside each area.

Employee screening

All employees must be screened to eliminate potential threats. Before hiring any personnel, the following aspect should be checked and verified:

  • State, local, or national police
  • Former employees
  • Public records
  • Credit agencies
  • Schools at all levels
  • References not furnished by the applicant

Medical screening may be necessary to establish the mental and physical condition of the candidate. Family medical history may also be appropriate for severe medical stress or sickness.

Identification cards may be adequate for low security areas. Badges with personal details are required for areas with over 30 employees/shift personnel. Personal recognition systems (uniforms or color coding) depend on guard force protocols. Multiple badges and cards/color coding may be required for varying levels of security entry. Card or badge specifications should include designated areas where cards/badges are required. Description of the badge in use and authorization limitation of the bearer must be indicated and verified to the employee and control point. This must be presented when entering or leaving each area at all times. The disposition of cards upon termination of employee, or other causes, must also be clarified.

Visitor identification and control

Visitor identification is a critical part of access control. Due to the fact that any industry is dependent on contracted services, deliveries, shipment of cargo, and other consignments from the facility by other industries, hostile or unauthorized entry occur through this aspect. Visitor identification and the control of all cargo/items entering or leaving the facility will limit the vulnerability against any form of unauthorized/hostile intrusion. The following are the most important aspects to consider and check during the authorization of visitors to the complex/facility:

Written policies and procedures establishing visitor control

  • Prearranged approvals for admission must be cleared.
  • Escorts must accompany all visitors in the limited and restricted areas at all times, especially in the event of foreign nationals.
  • Visitor classifications must be qualified and clearly defined.
    • Suppliers, customers, inspectors, vendors, and regulars
    • Visitors for educational purposes
    • Visiting groups of foreign nationals and guided tours, and so on
  • The following is applicable to the reception of all visitors:
    • Authority must first be established whether plant personnel may receive the intended visitor.
    • Positive identification (ID) documents of the person receiving visitation must be verified (permit or credentials from employer).
    • Cards/badges must be used at all times, where applicable.
  • Cleaning teams should also be screened and clearly identifiable by plant security.
  • Supervisory coordination based on work hours and restrictions must be on the security schedule of the specific shift.
  • Procedures for admission must be uniform and enforced.
  • Limit entry/exit control points within the facility.
  • Educate guard force and employees to work together on all protocols.
  • Single file admission with verification must be in place.

Packages, personnel, and vehicle control

A package checking system must be enforced prior to entering all restricted areas. Inspect all outgoing packages for authorization (cuts down on pilferage). If 100% package control is not possible, use frequent random checks and inspections. Personal vehicles and packages, tool boxes, and so on, need to be inspected during entry and exit. Visitor’s vehicles must be clearly marked. Truck and rail movements in and out must be inspected. Truck and rail gates must be locked. Shipment must be sealed and seals inspected upon entry. Incoming trucks and rail cars must be logged in. The following details must be logged:

  • Driver’s name, license, load description, and time of entry and departure.
  • Check operator’s license.
  • Escort when necessary.
  • Verify seals unbroken and unhampered with.

Lock and key systems

Key locks are only good for low security systems and offices. Dead-bolt locks and mortise locks are only slightly better than straight key locks. Drop-bolt locks are better than dead bolt. Combination locks need to be backed up by other locking devices when area is unoccupied. Padlocks are mostly low security devices, except high security padlocks that have hardened parts. ALL LOCKS ARE DELAYING DEVICES AND IS NOT A POSITIVE BAR TO ENTRY OR FORCED ENTRY BECAUSE THEY CAN BE DEFEATED!

Security forces

There is a vast difference between security staff recruited from a local home grown origin and that of a contracted nature. The type of security required versus the potential threat to the facility will determine the type of guard force required to protect the security interest. Factors like the origin of candidates, qualifications, and cost obviously have to be considered, but the perceived threat potential will ultimately determine the type of security forces needed. You should answer the following questions: Do you want a local rent-a-cop or a professional. There is a difference in cost and level of involvement.

It is further important to determine the levels of authority and jurisdiction. What special powers or authority is required to effect arrests? What jurisdiction will the guard force have in lieu of existing policing and/or defense forces jurisdiction? What other armed force response are available to contribute to the capacity of a guard force? Consider liabilities for accidental deaths. Relations with local police and military are important. Consider force organization and response when co-coordinating roving patrols. Who responds, with what, where and how many?

Standard operating procedures (SOPs) have to be drafted and implemented to guide and control all security force activities within the facility. It must be designed to clearly stipulate procedures, responsibilities, accountabilities, and roles, especially in the event of emergencies, attacks, and other unauthorized activities. The security forces must be controlled from a centralized command and control location, in some cases referred to as an Operations Control Center or Headquarters, and all staging and forming-up areas must be known and rehearsed, as part of contingency planning.

Security personnel must have provisions for shelters, relief, and breaks (at least every 2 hours). Security Personnel may only be utilized for security, not firefighting (unless in an emergency)—but cross training for use when off duty is permitted. Strict instructions and posting assignments must be issued, as well as for actions required during emergencies elsewhere in the plant.

Training must be supported with regular evaluations, testing of skills, and rehearsing of drills. Security forces may require uniforms, specialized vehicles and equipment, dedicated communications infrastructure and radio equipment, traffic control equipment, sirens, flashlights, weather gear, and so on. Training should include the following:

  • Areas of responsibility
  • First aid and fire control equipment operation
  • Common forms of sabotage and espionage
  • Locations of hazardous equipment and material within the plant
  • Weapons where required and legally proportional and appropriate

Cargo security

Harbors, ports, and terminals are highly susceptible to security breaches because of high levels of foreign (non-plant) workers and movement of goods. Security needs to monitor the area and establish a perimeter and classifications for various personnel. Patrols should be combined randomly and regularly. Specialty (high-value) areas should be clearly designated and considerations include the following:

  • Type and value of cargos stored
  • Vulnerability of cargo to land threat
  • Likelihood of diversion, sabotage, theft, and so on
  • Location and nature of ports and cargos
  • Degree of entry and exit controls

Port security systems

Keep cargo secured while being transferred. Establish security perimeter and access control points. Erect field expedient barriers and limit personnel access to those required. Provide a separate holding area whilst truck cargo is inspected and sampled where required. Inspect inbound and outbound containers. Verify records, seals, and documentation. Respond to various threat levels with appropriate security measures.

Review and Assessment of Engineering Design and Implementation

Auditing and evaluation

Continuous auditing and evaluation of security systems is critical to ensure that the most appropriate and updated systems design is maintained at all times. Due to the fact that the threat scenarios continuously change in any facility, auditing and evaluation must be formal processes allocated to an accountable team within the security environment. A risk assessment team must be appointed and should consist of the following staff:

  • Risk Assessment Manager. The risk assessment manager is accountable for the continuous threat analysis and risk assessment within the facility. He/she will direct all activities-related threat analysis, security systems design, and the implementation of required upgrades and rectifications.
  • System Administrator. The system administrator keeps record of information, requirements, and future systems design, on behalf of the risk assessment manager. All administration has to be logged electronically, preferably using a system that keeps a paper trail of all findings and recommendations by the risk assessment team.
  • Technical Reviewer. The technical reviewer is qualified in the continuous testing and evaluation of all security-related systems within the facility.
  • System Business Advisor. The system business advisor gives recommendations toward the financial situation within the security environment and deals with the allocation of funds and the budget.
  • System Technical Advisor. The system technical advisor is responsible for analyzing all information during the auditing and evaluation of the security system design and to formalize recommendations for future required adjustments.
  • Executive Sponsor. The executive sponsor could range from the budget holder within the company, to a body of trustees or even external sponsors who may have interest in the capacity of the company and/or the necessity for a secure environment.
  • Security Officer. The chief security officer has to be co-opted onto the team or committee due to his responsibility for the implementation and management of security within the complex.

Risk assessment team

Figure 8.9 illustrates the preferred groups and individuals which should be incorporated into the Risk Assessment Team. The figure relates to Electronic Security System Design. The figure is an graphical representation of the Electronic Security System Design Elements.

c8-fig-0009

Figure 8.9 Security staff and committees to be trained and instituted as a risk assessment team.

Security management

Security management is an integral part of management as a whole. The executive staff of the facility remains accountable for security, even though qualified security staff is employed and appointed to fulfill different responsibilities within the security environment. Figure 8.10 indicates the relationship and channels of liaison from a management perspective.

c8-fig-0010

Figure 8.10 Security management.

Blank sheet approach to auditing and evaluation

The blank sheet approach to auditing and evaluation is the most effective model to implement in order to maintain a secure sequence for the identification of challenges within the security environment and the continuous rectifications and implementation of required upgrades.

The blank sheet approach provides a cycle of activities, which will continuously start and end, to ensure a live and frequent analysis of the security systems design, as follows:

  • Identify. Identify the needs of the system, and then identify the related risks.
  • Understand and agree. Ensure an understanding of what has to be implemented. Agree on what has been found as risks and what needs to be implemented.
  • Solutions. Find solutions for the risks identified and agreed upon.
  • Manage. Provide the necessary advice and tools (if need be) to manage the risk.
  • Evaluate and report. Once the risk is accessed, evaluate the management thereof and provide a report.
  • Audit. Provide periodical audits as required. If new risks are identified, the process repeats itself (Fig. 8.11).
c8-fig-0011

Figure 8.11 Blank sheet approach to auditing and evaluation from inception through implementation. A continuous and cyclic process.

Business approach to auditing and evaluation

The blank sheet approach to auditing and evaluation, as discussed earlier, is more informal and provides a logic cycle of assessment and rectification. The business approach is a more formal system related to the management activities and processes within the facility. We will examine this again later in this chapter.

The business approach to audits and assessment is a list of steps to be followed from the audit impact assessment down to the assessment report and follow-up assessment (see Fig. 8.12 for the business approach to audits and assessments).

c8-fig-0012

Figure 8.12 Business approach to auditing and assessments.

Benchmarking

Benchmarking is a continuous ongoing long-term process. It is a systematic, structural, formal, analytical, and organized process for evaluating, understanding, assessing, measuring, and comparing business practices, products, services, work processes, operations and functions of organizations, companies, and institutions that are recognized, acknowledged, and identified as best-in-class, world-class, and representing best practices for the purpose of organizational comparison, organizational improvement, meeting or surpassing industry best practices, developing products/process objectives, and establishing priorities, targets, and goals. (Source: Van der Zee HTM. Measuring the Value of Information Technology. Hershey (PA): IRM Press; 2002: p. 144.)

How to evaluate a physical security system?

A security system is more than the sum of its parts. The components of the system are just the basics. The system must address more than just fence line intrusions. There is a strong personnel component in any security system. It must be flexible and secure at the same time. The security system must be capable of considering multiple elements including natural disasters (typhoons, sand storms, Tsunamis, earthquakes, etc.), industrial accidents, including sabotage and arson, criminal acts (arson, theft, etc.), terrorism, and other possible scenarios.

A security system must consider assets, exposure, loss, and loss prevention within the framework of limited costs and personnel interactions and liabilities. A totally secure system is an empty tank in an abandoned plant. Activity incurs risk!

Security systems audits

A good audit is a thorough examination of all parts of a system and tests the system for response to activities. A good audit is more than a paper trail, but the paper trail is important. A good physical security system includes interviews and thorough physical examination of the mission and the system being evaluated. It is both active and passive and requires a team to evaluate.

A good security system must plan for the unthinkable and undesirable, and must be able to integrate internal and external organizations which function in its support such as the following:

  • Hospitals. Patient decontamination, transport, and equipment available.
  • Fire. Type of response available—is it suited to the plant needs?
  • Police, security, intelligence, crime scene investigation, and capturing of terrorists.
  • Military. Is the facility of critical interest? Does the military need to be involved in the response? Bomb disposal?

Define types of risk to be assessed and types of effects from incidents. Define the probability of occurrence. Prioritize the loss potential, interview personnel, review files, collect and analyze data, and compile a detailed report.

Conduct a preliminary data gathering effort. Obtain the mission statement and directives for the security function. It should be part of the overall company mission statement. It should also have a specific function and responsibilities. Interview long-term employees regarding incidents and activities; include management personnel. Oral history and written records is of tremendous value. Include retired employees where possible. Interview and record information as part of the database must be accessed. Observe and inspect security measures. Conduct a physical inspection and finalize the security audit.

Gather assets, exposure, and loss data from the corporate risk manager and controller’s offices.

Fixed assets$_______
Owned, leased assets$_______
(Less) Facility losses−$_______
= Total tangible assets+$_______
Total intangible assets$_______

This may include various categories of exposure and collateral and contributory losses and liabilities, for example, losses from business interruption, replacements, cleanup and decontamination, disposal, and other sources.

Types of losses to be considered may also include the following:

  • Crime
  • Cargo pilfering and damage
  • Emergencies and disasters (earthquake, etc.)
  • Damage
  • Environmental controls and regulatory fines
  • Liability of officers
  • Business interruption
  • Errors and omissions (negligence)
  • Professional liability (third party on your property)
  • Product liability (not usually considered except by risk manager and lawyers)
  • Personnel and kidnapping

What to review?

The following aspects must be taken into consideration during the review and assessment of the security system within the facility:

Policy and programs

  • Policy directives as written document
  • Clear assignment of responsibilities by position
  • Designated (position) individuals
  • Is the top manager available to the security director?
  • Published, clear regulations, and directives

Written disciplinary procedures

  • Written description of offenses
  • Includes written description of penalties and offenses
  • Uniform enforcement of policies (Trojan Powder policies)2
  • Actions must be recorded
  • Actions must be reviewed by upper management
  • Sign off by upper management is required

Published, clear regulations and directives

  • Especially important for multiple facilities
  • Must be available to all employees

Operations

  • Full-time security supervisor or only a percentage of time is spent on security matters.
  • Chain of command direct to plant manager.
  • Number of personnel (adequate?/shift?).
  • Other duties of security personnel. (Do they have a priority for security or something else?)
  • Training: What training, documentation and type.
  • Written incident reports with full documentation.
  • Follow-up (after action) reports and records.
  • Policy on criminal prosecution of violators?
  • Background checks on security personnel.
  • Guard force adequacy.

Guard force adequacy

  • Are tours electronically tracked?
  • Do guards make written reports?
    • Secretarial assistance.
    • Permanent records.
  • Tour frequency and pattern (varied pattern?).
  • Number and location of reporting stations?
    • How do you make sure the guard is doing his job?
    • Key stations?
    • Who gets reports when the guard is on rounds?
    • Is there a backup system?
  • Written reports on each shift? Reports reviewed?
  • Guard training (especially if weapons authorized).
  • Condition of uniforms.
  • Numbers of guards for each shift balance against threat levels.
  • In house guard force or contracted guard force?
  • If contracted, does the plant security director select spot checks?
  • What qualifications and what criteria are required?
  • Are written contract and orders in place?
  • Are weapons carried?
  • Who inspects and maintains weapons?
  • Who furnishes weapons?
  • What type of weapons?
  • Weapons training for security personnel.
  • The level of the security threat and outside response must be balanced.
  • If weapons are carried, policy must be written and approved—think about the guard who has a bad day and may be irritable?
  • Posting about weapons warnings—is it clear and prominent?
  • Published security procedures and how are they distributed?
  • How frequently are procedures revised?
  • Do guards and security forces conduct drills?
  • Does security supervisor maintain contact with guard force?
  • Local police and military (if required)?
  • Is security supervisor aware of local community discontent or disorder or criminal activity?
  • Entry control and movement.
  • What type of plant barrier is there to prevent intrusions and is it continuous?
  • Are non-barrier areas illuminated at night and observed?
  • What are the non-barrier areas?

Fencing

  • Three meters high?
  • Five-centimeter mesh or difficult to climb?
  • What is wire gauge (thickness)?
  • Fastened to fence posts securely?
  • Barbed wire on top?
  • Fence posts set securely (concrete or depth)?
  • Gates same height and construction? When open (only during use)? Deliberately locked after use? Observed and guarded when open? How guarded?
  • At least 3 m clear zones each side of fence?
  • Is the fence on top or at least 7 m from bottom of embankments?

Walls

  • At least 3 m tall?
  • Topped with razor wire or barbed wire?
  • All doors equipped with alarms?
  • Means of observation?

Windows

  • Permanently closed?
  • Accessible for removal of property?
  • Can they be used for entry or exit?
  • Protected by bars? Alarmed?

Perimeter doors

  • Guarded?
  • Alarmed? Specify type.
  • Security controlled?
  • Impact resistant?
  • Hinges and locks tamper proof and non-removable?
  • Do outside door locks have a keyway? (NO!)
  • Are the doors dead bolted?

Lighting

  • Is the entire perimeter lighted? On both sides of the fence?
  • Is the illumination sufficient to enable the detection of human movement at 100 m?
  • Are the lights checked daily before it becomes dark?
  • Are burned-out lights replaced immediately?
  • Is the power supply for the lights tamper-proof and readily available to the guard force?
  • Are switches and controls readily available but tamper proof, weather proof, and inaccessible from outside, with a centrally located master switch?
  • Is there good illumination for guard routes inside the fence?
  • Are the materials receiving and shipping area sufficiently lighted?
  • If there are docks or bodies of water, is the illumination sufficient to enable detection of movement?
  • Is there an auxiliary power source for lighting?
  • Recommended lighting levels:
Illumination
Condition(ftcd)(lx)
Full daylight100010,752.7
Overcast day1001,075.3
Very dark day10107.53
Twilight110.75
Deep twilight0.11.08
Full moon0.010.108
Quarter moon0.0010.0108
Starlight0.00010.0011
Overcast night0.000010.0001
ActivityIllumination (lx, lumen/m2)
Warehouses, homes, theaters, archives150
Easy office work, classes250
Normal office work, PC work, study library, groceries, show rooms, laboratories500
Supermarkets, mechanical workshops, office landscapes750
Normal drawing work, detailed mechanical workshops, operation theatres1000
Detailed drawing work, very detailed mechanical works1500–2000

Locks and keys

  • Are all locks and keys under control of security supervisor?
  • Who has authority for changes in locks and keys?
  • Is there a written policy for key and lock issuance? Is it approved?
  • Do nonemployees have keys?
  • Is the issuance of keys documented, reviewed, and approved by appropriate management?
  • When employees leave, are they obligated to turn in keys?
  • Are master keys unmarked?
  • Are spare keys kept under double lock?
  • Locks on perimeter doors changed annually?
  • Manufacturer’s number on locks obliterated and changed to plant number?
  • When gates and doors are opened, are locks relocked to prevent substitution?
  • Regular checks for tampering?
  • Do door lock bolts extend at least 1.5 cm into jamb to prevent tampering?
  • Is the bolt covered by a tamper proof plate?
  • Are combination locks regularly changed? How often? When employees leave?
  • Are combinations memorized (must not be written)?
  • Are combinations in any specific sequence?
  • Are combinations disclosed on the basis of operational necessity rather than convenience?

Safes

Are safes substantial, fireproof, rated, lighted (24 hours), and covered by motion detectors?

Fire alarms

  • Water flow? Water pressure? Valve open or closed?
  • Combustion detection, heat or smoke sensing. How is it monitored? Continuously monitored? Directly connected to fire or police? Regularly tested and documented?
  • What else do the alarms do? (Shut off power, A/C, lights, etc.)

Intrusion alarms

  • Plant perimeter?
  • Type of alarm? (motion detection, heat sensing, and other)
  • High-value storage areas and type of alarm?
  • Types of sensors in each area (list and check for adequacy)?
  • Are alarms reported to a central station?
  • Are alarms tested regularly and results documented?

Communications

  • Separate and multiple methods of communication for guards—telephone, radio, and so on.
  • If radio shared does security have an override?
  • How is request for help given to outside parties? Can it be interrupted?
  • Plant-wide signal for an emergency condition? Specify the condition and the signal.

Property control

  • Procedures must be written, must use specific forms, serially numbered, auditable, authorized (by higher authority).
  • All property transfer actions monitored at exit?
  • All exits controlled?
  • Control points and inspection between parking and work area on incoming packages?
  • Spot checks on trucks?
  • Company tools clearly marked? Issued with receipts?
  • Lost equipment and tools reported? Follow-up investigation? Written record? Monitored?

Shipping and receiving areas

  • Guarded and surveilled or within protected areas?
  • Inspected regularly and spot checks?
  • Written policy on outside drivers in plant?
  • Checks on all incoming and outgoing vehicles, including tailgate checks?
  • Are storage areas monitored and all withdrawal receipts checked and audited?

Scrap and salvage

  • Procedures for collection and disposal must be written. Bids must be sealed, and independently reviewed. Scrap may never be given to employees without management approval.
  • Wastes must be stored in a locked area, spot checked for saleable materials and high grading.
  • Wastes may be removed only:
    • With signed authorizations, checked, and compared with receipts.
    • Supervised by security and spot checked.
    • Auditable on the basis of transactions.

Personnel

  • Employees must apply on approved forms.
  • Candidates must be interviewed and should include the following:
    • Previous employers and dates
    • Position and duties (watch out for inflation)
    • Salary and quality of performance (supervisors’ names)
    • Education (verified)
    • Criminal record (verified)
    • Reputation (investigated)
    • Medical records:
      • Illnesses
      • Handicaps
      • Work injuries
      • Occupational illnesses
  • All positions, especially financial, must be investigated and background checks performed.

Review the emergency and disaster plan for completeness and contingencies

The Emergency and Disaster Plans are integral to the operation of the facility. The plans should be reviewed and updated periodically to insure that the actions and contacts and equipment required for emergency response are all in good repair and usable in an emergency. It is also necessary to drill on these plans for a number of different contingencies.

Implementation of risk assessment

Risk assessment process flow

The risk assessment process flow is depicted in Figure 8.13 in three phases, as follows:

c8-fig-0013

Figure 8.13 Risk assessment process flow.

The risk assessment project

The phases for the risk assessment flow are further followed to outline the different timelines or sequencing of the risk assessment project as follows (Fig. 8.14).

c8-fig-0014

Figure 8.14 Risk assessment project.

Severity of impact and risk levels

During the risk assessment and auditing process, the severity of the perceived or expected impact of the risk identified and the levels of intensity thereof must be compared according to the scales indicated in Table 8.2.

Table 8.2 Severity of impact and risk levels

Insignificant. Will have almost no impact if threat is realized and exploits vulnerability.
Minor. Will have some minor effect on the system. It will require minimal effort to repair or reconfigure the system.
Significant. Will result in some tangible harm, albeit negligible and perhaps only noted by a few individuals or agencies. May cause political embarrassment. Will require some expenditure of resources to repair.
Damaging. May cause damage to the reputation of system management, and/or notable loss of confidence in the system’s resources or services. It will require expenditure of significant resources to repair.
Serious. May cause considerable system outage, and/or loss of connected customers or business confidence. May result in compromise or large amount of Government information or services.
Critical. May cause system extended outage or to be permanently closed, causing operations to resume in a hot site environment. May result in complete compromise of Government agencies’ information or services.

Security risk analysis report

Once the security risks had been analyzed according to the severity and intensity thereof, an initial report must be compiled per assessed risk, listing all system components and establishing the system boundaries for the purpose of the report. System policies and procedures related to the risk must also be taken into consideration, when drafting the report (in order to define the risk and the required management).

The report must clearly state the list of identified threats and the related vulnerabilities, as well as the severity of the impact it may have and the likelihood of occurrence. This must go hand-in-hand with a list of suggested safeguards for controlling these threats and vulnerabilities. A list of recommended changes, with the appropriate levels of effort for each recommendation, must further be included in the report. Each suggested change must include the resulting reduction in risk, which will have to be achieved when implemented.

Finally, the report must indicate the level of residual risk that would remain once the recommended changes are implemented.

SQUARE: Prioritizing security requirements

SQUARE is the abbreviation for Security Quality Requirements Engineering. It is an extremely valuable model assisting during the eliciting and prioritizing of security requirements. It starts with the technical definitions, serving as the baseline for all future communications between the requirements engineering team and project stakeholders.

This is followed by clear security goals, documenting the understanding of the relevant security system and the risk assessment, clearly defining all possible likelihoods and impacts. The best methods for eliciting the initial security requirements are drafted by the engineering team according to the size and complexity of the project. Finally, an initial set of security requirements are established based on risk assessment results and artifacts. Figure 8.15 depicts the earlier format.

c8-fig-0015

Figure 8.15 SQUARE: method for implementing and prioritizing security requirements.

The following steps are followed to make use of SQUARE, indicating the input and techniques required, the participants, and the desired outcome (Table 8.3).

Table 8.3 Steps for the use of SQUAREa

Steps to performing SQUARE
Step 1: Agree on definitionsStep 4: Perform risk assessmentStep 7: Categorize requirements as to level (system software etc.) and whether they are requirements or types of constraints
Input: Candidate definitions from IEEE and other standards agenciesInput: Misuse cases, scenarios, securityInput: Initial requirements, architecture
Technique: Structured interviewsTechniques: Risk assessment method, analysis of anticipated risk against organizational risk tolerance, included threat analysisTechniques: Work sessions using a standard set of categories
Participants: StakeholdersParticipants: Requirements engineer, risk expert, stakeholdersParticipants: Requirements engineer, other specialists as needed
Output: Agreed to definitionsOutput: Risk assessment resultsOutput: Categorized requirements
Step 2: Identify security goalsStep 5 Select elicitation techniquesStep 8 Prioritize requirements
Input: Definitions, candidate goals, business drivers, policies, procedures, examplesInput: Goals, definitions, candidate techniques, expertise of stakeholders, organizational style, culture, level of security needed, cost/benefit analysis, etc.Input: Categorized requirements and risk assessment results
Technique: Facilitated work session, surveys, interviewsTechniques: Work sessionTechniques: Prioritization methods such as triage, win–win, etc.
Participants: Stakeholders, requirements engineerParticipants: Requirements engineerParticipants: Stakeholders facilitated by requirements engineer
Output: GoalsOutput: Selected elicitation techniquesOutput: Prioritized requirements
Step 3: Artifacts to support security requirementsStep 6: Elicit security requirementsStep 9: Requirements inspection
Input: Potential artifacts (e.g., scenarios, templates, forms, etc.)Input: Artifacts, risk assessment results, selected techniquesInput: Prioritized requirements, candidate formal inspection techniques
Technique: Work sessionsTechniques: Joint application development, interviews, surveys, model based analyses, checklists, lists of reusable requirements types, document reviewsTechniques: Inspection method such as Fagan, peer reviews
Participants: Requirements engineerParticipants: Stakeholders facilitated by requirements engineerParticipants: Inspection team
Output: Needed artifacts, scenarios, models, etc.Output: Initial cut at security requirementsOutput: Initial selected requirements, documents of decision which record process and rationale

aModelled after Mead NR, Viswanathan V, Padmanabhan D, Raveendran A. Incorporating security quality. Requirements Engineering (SQUARE) into Standard Life-Cycle Models. (CMU/SEI-2008-TN-006). Software Engineering Institute, Carnegie Mellon University, May 2008. http://www.sei.cmu.edu/publications/documents/08.reports/08tn006.html.

Security monitoring and enforcement

It is the responsibility of application coordinators to implement appropriate measures to detect attempts to compromise the security or integrity of information or information technology systems. When implementing monitoring capabilities, consideration should be given as to what situations are to be monitored based on the extent of risk, the most effective means for monitoring security activities, the resources available for monitoring, and system constraints that limit the ability to monitor security events. If appropriate measures are not available within a system environment to effectively monitor security events, additional controls should be implemented to mitigate security risks.

When activity occurs that is in conflict with security policies and standards, application coordinators should take the appropriate steps to enforce desired security practices. The steps involved range from training of the users, revoking access, altering security parameters, and possibly disciplinary actions.

The facts surrounding an intrusion or system compromise must be documented, reported to the security officer, and include the circumstances that led to the discovery of the incident, actions that were immediately taken, the names of persons involved in investigating the incident, and detailed observations about what transpired, what damage was caused, and what systems or files were compromised.

The security officer must enforce and support the security policy by responding to business ethics violations through disciplinary action, termination of services, suspension, or prosecution.

Security awareness program

It is the responsibility of management to ensure that all employees understand how to protect company assets, including information and information resources and comply with security policies, standards, and procedures. Supervisors and managers must ensure that persons working within their department understand general security requirements and that they are sufficiently knowledgeable about the security policies, standards, and procedures to recognize the need for protection and the requirements for which they are specifically responsible.

The security officer with assistance from the security team is responsible for developing and implementing an information security awareness program that supports employee awareness.

Managers and supervisors need to be aware of performance in this area, encourage good security practices, and address inappropriate behavior. Application coordinators can assist in implementing specific awareness programs.

Proposed future training requirements

The following are critical training requirements for security staff within the company. Application and levels will be determined by the appointments and responsibilities of staff:

  • Semi-quantitative risk assessment techniques—Machinery based
  • Hazards identification and analysis techniques
  • Techniques for hazard identification and analysis—HAZOP
  • Failure modes and effects analysis or “FMEA”
  • Analysis of the consequences—mechanics of fire, explosion, and toxic releases
  • Role of fault tree analysis to identify how accidents can happen
  • Application to critical activities onshore and offshore—HAZOP
  • The role of event tree analysis in scenario development.
  • The role of fault tree analysis for multi-causation analysis
  • Applications for ETA and FTA
  • Human contribution to accidents
  • The role of root cause analysis in identifying management system failures
  • Accident investigation techniques I: fault tree analysis or “FTA”

Security management

The security manager has a different focus and responsibility than the rest of the organization. The rest of the organization is focused on providing production, research, shipping, and so on. The security manager is focused on avoiding losses through internal and external undefined sources.

Security department cuts across various disciplines. The security manager is more than a glorified guard force manager, although that is the general perception. The security manager cannot do the entire job alone; he or she needs subordinates, and the subordinates are the first line of defense and form the perception of the company by visitors. Sometimes, loss prevention and control is considered a part of security.

There is often a conflict between the organization and the people due to the differing histories of the people and their talents and abilities. This sometimes causes conflicts within the organization. Every organization has a formal and an informal organization chart for effectiveness—You know what the organization chart says, but when you want to get something done, who do you really go to?

Every organization has a culture, and it is often based on who has the ear of whom in management and what special privileges does that individual get or get away with, that is, the company doctor’s parking space. It is important to recognize these factors and deal with them on a practical level.

The differing roles of the security department

The following are the different roles within the security department:

  • Arrests and prosecutes persons committing attacks, theft, and so on
  • Designs and implements physical control for access
  • Conducts pre-employment screenings
  • Monitors pertinent security information from military, police
  • Administers vehicle parking
  • Administers company lock and key policy
  • May provide supervision of fire/rescue and medical services
  • Conducts security indoctrination and training
  • Investigates all criminal activity committed on company property
  • Protects executives against kidnapping and extortion
  • Conducts financial stability or due diligence on vendors, merger candidates, and so on
  • Coordinates special protection during periods of civil unrest or disaster
  • Contracts for outside security services as required

Stress management techniques

Everyone is subject to some stress, because it is a part of everyday life. Security personnel may have a bit higher stress than some other occupations because of the nature of their differing and sometimes contradictory roles in keeping the plant, its equipment, and personnel safe from various known and unknown hazards. Oftentimes, the security force must worry about the attacks from outside by persons unknown, with unknown armaments, plus worry about employee theft (and theft is not confined to plant workers, but it can also involve top management). Here are some suggestions for handling job stress.

Stress is another name for fear, and or worry. When we are worried or stressed, we cannot perform at our peak. Stress has physiological effects that include the following:

  • Increased adrenaline in the blood
  • Headaches
  • High blood pressure
  • May cause diabetes and other stress-related diseases
  • Can cause heart attacks

The following techniques will help us to reduce or eliminate worry:

  • Live in “day to day” with respect to worry.
  • You have enough to worry about each day.
  • Next week’s deadlines are next week’s worries.
  • You can and must organize for upcoming events, but you cannot worry about things beyond your control.
  • Worry about today’s tasks today and do your best to achieve the end results.

How to analyze worry?

  • Get all the facts—you cannot worry about what is unknown.
  • Think about how you will approach the problem making you worry.
    • Try and develop two or three ways in which the problem can be solved or be made to go away.
    • Outline these scenarios and write them down.
    • Select the best solution.
  • Weigh all the facts and then come to a decision.
  • When you reach the decision—act.
  • Save your thoughts and analysis in case you need it later.

How to break the habit of worrying?

  • Keep busy an idle mind or hand is the devil’s tool especially for worry.
  • Worries can be significant or insignificant. Decide which worries are worth your time.
  • Analyze what is making you worry.
  • Do not worry about insignificant things. “Don’t sweat the small stuff!”
  • You may have to make a list of priority things for the day, but then review it for significance and re-prioritize so that you have the most significant items handled.
  • On average, at least half or more of what we worry about never comes to pass.
  • You have enough to worry about, and what are the chances that things will arrive or not.
  • Chances are that the things you worry about may not come to pass—especially if you are going to be working to prevent them happening.
  • Learn that there are some things we just cannot influence, and so do not worry about them.1
  • You can learn from mistakes, but you cannot necessarily fix them. So what is done is done, and you need to move on and not worry about the mistakes. They are now in your past.
  • Do not worry about the past. You have done your best, and it is not worthwhile trying to worry about what you did or did not do. You did your best at the time.

How to eliminate the causes of worry?

  • Realize that listening to much of the news media will create unnecessary fear and worry. It is their job to get you worked up about things, and they do it well. So be skeptical and analytical when you listen to or read the news.
  • Plant rumors are just like the news. Do not pay attention to rumors or gossip because they may be unfounded.
  • Cultivate a positive mental attitude.
  • PUSH—Pray until something happens.
  • Fill your mind with thoughts of peace, courage, health and hope, religion, prayer, and positive and creative thoughts.
  • Never consider revenge against your enemies, it is an unfruitful exercise.
  • Expect ingratitude—especially in the guard force.
  • Count your blessings not your troubles.
  • Be polite and respectful to everyone—Do not try to imitate others.
  • Create happiness for others—do something nice and unexpected for others for no good reason.
  • Give unexpected appreciation to someone else.
  • Try to rest before you get tired. You know that you are approaching tired, so take a few minutes to rest and refresh.
  • Learn to relax at home.
  • Apply good working habits by the following:
    • Clean desks help you organize and prioritize your work, by eliminating distractions.
    • List the things you have to do. Then prioritize them based on their importance and schedule.
    • Face a problem and solve it and make the decisions you need at the time.
    • Learn to organize and delegate.
    • Be enthusiastic about your work.

Security management techniques

Theory X of human relations management

Often based on autocratic styles, it assumes the worst about employees. Average human dislikes work and will avoid it if possible. Because of dislike of work, most people must be coerced, controlled, directed, threatened, and so on, to get adequate performance from them. Average human prefers to be directed, wishes to avoid responsibility, has little ambition, and wants security above all else.

Theory Y management style

The average individual considers work as a part of life, and as natural as play or rest. External control and the threat of punishment are not the only ways of bringing about effort. Man will exercise self-direction and self-control when he has committed himself to the work. Rewards (part) are found in the execution and satisfaction of the work. Average person seeks responsibility under the right conditions—it gives him a sense of pride. People can be imaginative and creative in the fulfillment of their work if given a chance. The intellectual potential of an individual is only partially utilized by his work. The challenge is to get the commitment to utilize that intellectual role to its fullest.

Maintenance factors (job surroundings)

The following maintenance factors will have an influence on the behavior of employees:

  • Pay
  • Status
  • Policy and administration
  • Interpersonal relationships
  • Benefits
  • Supervision
  • Working conditions
  • Job security

Motivators (the job itself)

The following aspects can be regarded as motivators within the job environment and should be manage well. It must further be understood clearly that each individual has different personalities, backgrounds, upbringing, and skills. Even levels of maturity and experience will differ from person to person:

  • Responsibility
  • Achievement
  • Recognition
  • Advancement
  • Growth

Bad management traits

Bad management traits are serious and detrimental to any form of management. Management within the security domain is even more adversely affected by these forms of managerial conduct:

  • Nepotism rather than quality. Is the manager’s relative given an unwarranted promotion, or is the manager looking out for his kinfolk or clan? Unfortunately, in many societies, particularly in the Middle East, this tends to happen with unfortunate regularity.
  • Playing favorites. Does the manager give “good” assignments to a select few, or are those people really that extra qualified?
  • Manager who wants to be liked rather than respected. This is a common trait in supervisors and middle managers, and others who move up the ranks.
  • Difference between leadership and management. The acknowledged difference between leadership and management is characterized by the following: Management says, “Here’s what I want you to do.” Leadership says, “Let us to the following….” One is participative, the other is directive.
  • Being “one of the guys” can create avoidance of unpopular decisions that must be made. No manager likes to make unpopular decisions, but events happen and decisions have to be made.
  • Fine line between being respected and being feared! Many managers cross this line. When female employees are in the workforce, they should also be treated with respect and not bullied. In masculine cultures, this is often a difficult challenge.
  • Ivory tower “know-it-all” manager. This guy deserves to fail. The adage here is to remind people that, “The quickest way to foul up a project is to tell an individual to do, ‘Exactly as I tell you.’ Because it alleviates the individual from using judgment and responsibility.”
  • Improper delegation. This is a classic and common mistake. If you are going to delegate responsibility, delegate the authority to accomplish the task. Otherwise, It is like telling the worker to drive downtown, but not providing him with a car.
  • Blind insistence on the “company way.” There is always more than one way to complete a project, and new and different is not necessarily wrong.
  • Manager who ignores need for others and his own growth. This is more than an issue of training. People like to grow in their work and handle new and different challenges that can stretch them. It prevents them from being bored.
  • Manager who fails to give proper credit to subordinates. This guy is an egotistical thief who is only looking for his own aggrandizement. Make sure that is not you by giving proper credit where it is due.
  • RHIP Manager—Elitism. RHIP is short for Rank Hath Its Privilege. It is one thing for the manager to have a better car, or lifestyle because of earned salary, but when special favors are put in the job because of rank, well, that is just wrong!
  • Excessive secretiveness—failure to share information. The security business is often about secrecy and the “need to know.” Make sure that you share critical decisions with your subordinates.
  • Manager who views disciplinary process as punitive. This is one of the worst sins of management. Discipline’ root is the word “Disciple.” The best idea is to have a corrective process which points out the errors with a way forward so that the person receiving the discipline is led to the right path and shown the error of his or her ways and how to correct them.
  • Manager who is unreliable and/or two faced. Worst type of manager ever!
  • Manager who avoids decisions. A lack of decision on an issue is really a decision—a decision NOT to decide. Avoiding an issue would not make it go away.
    • The failure to decide is in itself a decision. See the preceding item.
    • The consequences of inaction are almost always worse than the wrong decision.
  • The manager who is a slave driver.
  • The crisis manager.
    • If everything is a crisis, there is no set of priorities.
    • Your failure to plan is not cause for me to have a crisis.
    • Crises can only happen occasionally.

Conclusion

Security is everyone’s business. We need to approach it in a professional manner with intelligence and personnel training on the important things. The people in the security force are professionals and deserve respect just as much as the plant operators and engineers. In that regard, we hope this book has been informative and helpful.

Notes

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset