6
Physical Security
Abstract
This chapter discusses various physical security measures and procedures to improve an organization's security and protection against unauthorized threats and other vulnerabilities.
Keywords
Access control; Alarms; Barriers; Closed-circuit television (CCTV); Defense in depth; Doors; Fencing; Lighting; Perimeter security; Physical security; Safes; Security cameras; Security integration; Security layers; Sensors; Vaults; Walls; WindowsPhysical security is one of the three primary areas within the overall safety and security arena, and arguably the most significant. This is particularly true if your business focuses on manufacturing or commodities, as the primary focus for physical security is on items and documentation that protect people and resources within your organization. Physical security will encompass and normally focus on equipment to include fencing and physical barriers around the perimeter of property or structures, door and window locks, lighting, access controls, alarm systems, closed-circuit television (CCTV), and safes and vaults. The other important item within physical security includes the necessary processes and procedures that provide safety and security guidance for your employees in relation to threats against your organization’s critical resources—guidance that can help to ultimately heighten security awareness within the organization. We will cover both the equipment and processes that integrate into a physical security program over the next several sections; however, we will start with an overview of principles to help you in the development and implementation of various physical security safeguards.
6.1. Overview
In Chapters 2 and 3, we discussed the need to identify critical resources within your organization’s infrastructure and provided you with the method to develop a Risk Assessment Matrix in order to accomplish this task. As we discussed, it is necessary to not only identify your organization’s critical resources, but it is also necessary to develop a prioritized list. Again, this prioritization of critical resources is vital in developing your safety and security program, as this list will assist you in identifying what resources and areas within your company require more protection and focus—and normally indicate more money to be spent on security measures—than to protect other resources. In this manner, you will be better able to utilize your limited resources and be more efficient with the money you have allocated to safety and security. Once these critical areas are identified and placed into a priority order, the most effective implementation of any physical security safeguards is to provide defense in depth, or layering of security measures, around that asset with redundant systems to ensure better protection.
An example that should highlight the security fundamental of defense in depth, as discussed in Chapter 2, is the use of physical security measures in the protection of critical resources located on a military installation—we’ll use military aircraft parked on a flight line.
As shown in Figure 6.1, there are several layers of physical security boundaries that provide security through the defense in depth fundamental. The exterior and initial layer of security, shown in blue, is a perimeter fence and entry control guards to verify that anyone entering the installation meets the necessary requirements. The perimeter fence, although fencing is not perfect security by any means, at least provides a clear delineation of the exterior boundary of the base and will normally be posted with warning signs to identify that the property belongs to the government. The number of access points into the installation is minimized along the perimeter where there are entry gates that allow people and vehicles to enter and exit the base. These entry gates are manned by security personnel who check identification and authorization of personnel prior to allowing access onto the installation itself. The second layer of security, shown in yellow, surrounds the flight line and runway areas in order to limit access to locations where the aircraft are parked. Access to these areas is limited and traffic is funneled through the use of barriers, fencing, and buildings—the buildings also have the added benefit to limit visibility of the flight line area from other portions within the installation. Similar to entry onto the base, entry to the flight line area has a minimum number of entry control points that are under the observation of aircraft maintenance personnel, and security patrols that are dedicated to the flight line. The final layer of security, shown in red, surrounds the aircraft parking area itself through the use of marked boundaries, where additional security patrols that are solely responsible to protect the aircraft are located.
Within this example, we moved from the perimeter of the protected area inward ultimately to the critical resources that are of primary concern. As we look at the various physical security measures over the next several sections, we will move through these layers in a similar fashion: working our way from the exterior of a facility’s property, moving inwards toward the interior of the building, and ultimately reaching the areas with the highest security as they contain an organization’s critical resources. With this in mind, we will begin with physical security measures placed at the perimeter of the property.
6.2. Perimeter Security Measures
As discussed in the example, perimeter security measures not only attempt to hinder access to the facility and its property, but also help to define your facility’s physical limits. These limits can include areas that are necessary for the activity of the facility, such as warehouses, storage and loading areas, multiple facilities, parking structures, and any common areas within the compound. It is important to remember that any perimeter security measure cannot stop all access onto your property; however, it has several other uses and advantages that we will discuss.
In addition to providing a clear delineation of your facility’s property, these security measures also ensure individuals and vehicles are funneled to areas where you can provide greater security and visibility, which meets one of the security fundamentals discussed in Chapter 2 —establishing and using choke points. These choke points are extremely useful in that they limit the number of areas that allow access to the facility, and thus minimize the costs to place observation devices along the exterior of the facility by only needing to concentrate on these primary entry points. There are also several types of perimeter barriers that can stop a vehicle from approaching the facility, which protects against a vehicle-borne explosive threat (as was used in the Oklahoma City bombing). Lastly, most perimeter security measures, such as fences and walls, provide the opportunity to clearly identify the property through the use of warning signs or notifications announcing that the enclosed area is private property. Although signage will probably not stop a motivated intruder from gaining access to your location, a clear delineation and notification along your property boundaries can deter some individuals and make it easier to stop others who may suddenly wish to create problems simply because they are passing through the area. These boundaries also clearly highlight individuals who attempt to access the facility without authorization—it is much more difficult for an alleged perpetrator to justify why they cut through a fence when attempting a break in than if there are no perimeter security measures to protect your property. Lastly, signage and the clear delineation of your facility boundary by some type of barrier can also help to cover your organization from liability issues.
There are several different types of perimeter security measures that can be used, and is a major factor to consider when you are looking at what type works for your property and what type of impression you wish to convey to the public and your potential customers. In other words, most facilities have some type of security measure to define its boundary, but what type of barrier should you use based upon your business and level of security you require? There are many options. Natural barriers such as berms, ditches, water features, and stone walls can be used, or there are many types of manmade barriers to include fencing and walls. Many of these perimeter security measures can provide a vastly different impression to the public although still meeting the need to provide some type of obstacle onto your property—an attractive pond provides the same result as a fence topped with razor wire—but these options portray a vastly different persona. It is up to each company and its unique personality to determine what solution works best for their business.
6.2.1. Natural Barriers
Natural barriers consist of topographical features that are normally an attractive feature that still deny access to your facility’s boundary. These barriers include terrain, vegetation, obstacles (such as rocks, stones, walls, etc.), and water features. The obvious advantage to natural barriers is that they provide a striking and aesthetic appearance to your facility although still maintaining a significant deterrence against unauthorized entry. Unfortunately, natural barriers will typically be more expensive than manmade barriers, unless you are able to construct some of these natural barriers during the initial construction of your company’s facility, or if the topography surrounding your building already has many of these features in place.
6.2.1.1. Terrain Barriers
Terrain barriers include berms and ditches that surround your facility. These types of barriers are primarily used to stop vehicle access, but will also assist in clearly identifying any people who may try to access the facility’s perimeter. Figure 6.2 below shows typical dimensions of these barriers to ensure that they would stop most vehicles from accessing the area you wish to protect.
As stated earlier, costs for many of these terrain barriers will normally be more expensive than a simple chain-link fence; however, you should definitely consider their use if you can incorporate them during either new facility construction or if your facility is accomplishing major landscaping projects.
6.2.1.2. Vegetation
Certain types of plants or vegetation can provide a lower-cost alternative to terrain barriers that provide security to your property and facility, although still portraying a gentler persona to the public. Vegetation can be used to funnel people, and even vehicles depending upon the type of plant, toward primary entrances and areas that are under observation of either cameras or personnel. When using vegetation to prevent or hinder access onto your property or facility, you should consider thorny and hardy types of plants that will deter people from trying to move through these areas.
Of course, a major consideration in using vegetation is that it may take several years for these plants to form an effective barrier after they have been planted, so you will likely require another type of perimeter security measure in the interim. Another consideration is the upkeep required of many plants—it can take a significant amount of work in order to maintain plants as an attractive and useful feature. If you are considering using plants as a barrier, it would be recommended to work with a landscape designer or a local nursery in your area to get advice on what type of vegetation would work best in your environment and region; however, there are some plants that work well in many environments and also provide a good natural barrier as shown in Table 6.1.
6.2.1.3. Natural Obstacles
Obstacles, such as rocks, stones, and walls, can provide exceptional barriers against both vehicles and personnel around the perimeter of your facility and at the entrances. They can be used in the same manner as berms and ditches, and they are an attractive landscape feature that can be used in the middle of pedestrian walkways to block vehicles from approaching building entrances. An example of natural obstacles in this manner is shown in Figure 6.3.
The last natural barrier we will look at are water features. These provide a superb barrier to either people or vehicles, and as with many of the other natural barriers, they will also funnel traffic to areas that are under observation by cameras or security personnel. Additionally, there are a variety of different water features that can be used to provide barriers or pathways such as waterfalls, ponds, and running streams. Two examples can be seen in Figure 6.4.
Table 6.1
| Trees | Shrubs |
| Hawthorne is a dense hedge that grows 25 ft high and has sharp thorns, which can range from 1 to 5 in in length | Pyracantha, a thorny evergreen shrub, produces red, yellow, or orange berries in fall |
| Hardy orange is a fruit-bearing tree that grows up to 20 ft high and wide and is covered to the ground with lacerating thorns | Barberry are characterized by their distinctive three-spined thorns |
| Black locust produces creamy white flowers and short thorns at the base of each leaf | Some varieties of roses will grow into a dense thicket that is impenetrable to trespassers |
Duffy D. Thorny solutions: bushes and other plants that deter trespassing. CSO Online; 2007
There are several disadvantages to these types of natural barriers: water features will have very high initial costs for installation; they will require a good deal of time and manpower to perform daily maintenance, cleaning, and upkeep; and there will be periodic costs needed in order to properly maintain the water features and keep them in working order. Even with these disadvantages, many companies will still utilize these types of natural barriers because of their attractive features—particularly when compared with many of the other perimeter security measures.
Overall, natural barriers provide a much more subtle solution to the manmade barriers we will look at next, and depending upon the impression you wish to convey to the public, they can be an excellent investment to not only improve the security of your facility’s perimeter security, but also to provide an attractive site for your business.
6.2.2. Manmade Barriers
Like natural barriers, manmade barriers also deny access to your facility’s boundary; however, they do so with structural construction to the area. Although they are normally not as attractive, nor do they blend in with the environment to the extent of natural barriers, they are usually much less expensive and can be added to existing facilities much more easily.
6.2.2.1. Fencing
There are many types of fences that you can use should you decide upon this type of perimeter security measure, and these different types can provide very different impressions to the public. The types of fences can range from very attractive and relatively open, as is the case with wooden fencing, to the other end of the spectrum as shown by the forbidding nature of concertina wire fencing typically used by the military in hostile locations. Several different types of fencing that can provide viable perimeter security are shown in Figure 6.5.
There are several considerations for fencing to improve its ability to secure your building’s perimeter. For chain-link, barbed wire, and concertina fencing, you should use the minimum gauge and other parameters that meet federal specifications. Fencing should also be securely attached to the ground; for example, chain-link fencing should ideally be placed in concrete footings and buried a minimum of 2 in into the ground. Table 6.2 contains specifications for chain-link, barbed wire, and concertina fencing.
It is important to note that fencing will not provide a serious deterrent to a motivated intruder—military security planners are advised that fencing will only delay an intruder for 10 s [1]—so your security plan should not depend solely on building a fence around your facility and thinking that your building is secure. As discussed earlier, using the security fundamental of defense in depth and having redundancies within your security system will be necessary. As with any security measure, fencing is not fool-proof; however, it does accomplish several things that add to your physical security posture, to include providing a clear delineation of your facility’s boundaries, controlling pedestrian and vehicle traffic, and providing a means to identify potential intruders when they climb or cut these obstacles.
Table 6.2
| Chain-Link | Barbed Wire |
| 9 gauge or heavier | 12 gauge or heavier |
| Minimum height of 7 ft | Minimum height of 7 ft |
| No larger than 2 in mesh openings | 4-pointed barbs no more than 6 in apart |
| Vinyl or galvanized coated | Twisted double strand |
| Fence must reach within 2 in of hard ground or pavement | Firmly affixed to metal posts no more than 6 ft apart |
Military handbook 1013/10. Design guidelines for security fencing, gates, barriers, and guard facilities.
6.2.2.2. Walls
Constructed walls provide another manmade barrier option and can be much more attractive than many types of fencing options. Walls will also limit visibility into your facility and grounds; however, this visibility will also limit the ability for security personnel and other employees inside the property to be able to see along much of the exterior of the perimeter. If it is necessary to ensure visibility outside your location due to the area your company is located, this problem can be resolved through CCTV cameras placed along the wall. However, this additional cost should be taken into account when considering walls as your perimeter security measure. Like many of the natural barriers we discussed earlier, these walls are typically going to be more expensive than fencing. An example of a security wall is shown in Figure 6.6.
6.2.3. Cost Considerations for Perimeter Security Measures
A primary focus of any security measure—whether you are looking at your perimeter or at other areas within your overall security system—will be cost. As we have now gone through the perimeter security measures you have to choose from, it is important to know the relative costs of these options. Figure 6.7 shows the costs of each of the perimeter security measures we have discussed in relation to one another.
Since actual costs can vary greatly based on several factors, such as year-to-year price increases, what region of the country you are located in, and the climate of the area you live in. The figure does not show actual costs but instead shows relative costs. For example, lower cost options such as planting vegetation and fencing are less than 1/10th the cost of the higher cost options. Still higher are options such as stone walls and water features, which are exponentially higher in terms of relative cost.
6.3. Doors and Windows
Doors and windows are part of the inner barriers of a building, and they are one of the weakest links in the security of the structure since they are much more fragile than the surrounding walls and foundation. In order to strengthen these weak links, aside from the obvious consideration that all doors and windows should normally be closed and locked, they must also be designed to resist attempts for forcible entry. This not only includes the doors and windows themselves, but also the surrounding frames.
6.3.1. Doors
Exterior doors to your facility, along with interior doors located at entrances in areas housing critical resources, should to be evaluated in regard to their structural strength and the type of locking mechanism. The doors themselves should be made of heavy and solid material, either solid wood or ideally steel. It is also a good practice that doors open toward the likely threat direction to preclude an intruder from being able to kick the door inward.
In addition to construction of the door itself; the frames, hinges, and locking mechanisms should also be reinforced. Ideally, door frames should be constructed using heavy and solid steel. Hinges on exterior doors and doors providing entry to your critical resources should never be located along the exterior of the structure (or the area from where a potential intruder would be approaching). If the hinges cannot be moved to the interior of the door structure, they should be either spot-welded or flanged (inserting a headless machine screw through the hinge leaf) in order to preclude an intruder from being able to dissemble the door and gain entry. The locking mechanism used on these doors should ideally be a dead bolt that meets a Grade 1 Specification as rated by the American National Standards Institute (ANSI).
6.3.2. Windows
Since windows are easy to break in order to gain access into a facility, they are typically viewed as the weakest point in the building’s defenses. As such, potential intruders will typically look to these when attempting to gain entry to your facility. One option to combat this vulnerability is to consider placing bars, grills, or heavy screens across any windows that are less than 18 ft from ground level. Although this is one of the most secure options to protect windows, placing bars along all your exterior windows may not promote an open and inviting environment—particularly if you are in a customer-service business. If this option is undesirable, other options that still provide protection to these vulnerable windows are to reinforce them through the following methods:
• Burglar-resistant glass or safety glass that meets Underwriters Laboratories (UL) standards.
• Glazing, using either plastic or acrylic (Plexiglas), which will provide shatter resistance and in some cases bullet resistance.
• Wired glass, usually used in fire doors and windows.
• Tempered glass, which is four times stronger than annealed glass. When shattered, it will usually break into small fragments to protect against flying glass hazards, which may be a good option if a vehicle-borne explosive threat is a possibility.
Although doors and windows are some of the weaker points in any structure, there are a variety of options that can strengthen these areas and better protect your facility against unauthorized access.
6.4. Lighting
Lighting is an essential element of your physical security measures since security lighting will make detection of any potential intruders more likely. Furthermore, proper use of lighting can provide a significant psychological deterrent.
It is important to note that effective lighting is the single most cost-effective deterrent against crime since it is relatively inexpensive to maintain, and when used effectively can actually reduce the need for security personnel in some cases. Security lighting is one of the many physical security measures that should not be used as a stand-alone system, since the purpose is to provide observation to some type of response. As a result, lighting should be augmented with either security personnel or cameras to allow the detection of any unauthorized individuals and ensure an appropriate response to assess their intent. We will be examining lighting and how it improves security both outside and inside your facility.
6.4.1. Exterior Security Lighting
Exterior lighting allows observation in and around your facility in order to notify and provide detection for security personnel, cameras, or both. Adequate exterior security lighting consists of even light along areas bordering your facility’s perimeter. Exterior lighting should ideally create glaring light into the eyes of potential intruders, although providing only low light in areas where security posts and patrols operate. There is a balance in the amount of lighting, however, since too much can actually become detrimental, making it difficult to see into surrounding areas. This results in standard exterior security lighting having less intensity than working lights.
When designing and planning an exterior security lighting system, the following considerations should be taken into account:
• Weather conditions that are common to your area that may affect the lighting system (e.g., fog, rain, clouds, etc.).
• Automatic lighting controls should normally be installed in order to regulate hours of operation. Since the majority of exterior lights are used in darkness, it is recommended that photoelectric cells be used since they turn off and on based on sunlight. This lighting control system is much easier to regulate than timers due to the ever-changing times for sunset and sunrise.
• Perimeter lighting should be under the control of security personnel and also be secured from attack or intentional disruption.
There are four standard types of exterior lighting typically used: Continuous Lighting, Standby Lighting, Movable Lighting, and Emergency Lighting. We will look at each of these separately.
6.4.1.1. Continuous Lighting
Continuous lighting is the most common form of exterior security lighting. This type of lighting consists of stationary fixtures and lights that are arranged to continuously flood a given area during hours of darkness. These types of exterior lights are most effective when illuminating boundaries around your facility and any entry points either into the facility or onto the grounds.
6.4.1.2. Standby Lighting
6.4.1.3. Movable Lighting
Movable or portable lighting employs manually operated searchlights that can be used as needed by security or maintenance personnel. These can be effective in the use of emergencies and contingencies that occur in darkness.
6.4.1.4. Emergency Lighting
Emergency lighting operates on an alternative power source, such as fixed or portable generators or batteries, and is used in the event of power failures or other emergencies.
6.4.2. Interior Security Lighting
Interior security lighting will normally serve two purposes: to provide additional lighting for critical resources and emergency lighting. Critical resources should be kept under continuous observation, by either security personnel or cameras. With the additional use of dedicated security lighting directed onto these resources, it enables improved observation and provides a level of deterrence to any unauthorized personnel who may be able to get near these assets. Emergency lighting, which again operates on an alternative power source, provides lighting to enhance safety for all employees during power outages and provides visibility to security personnel, should they need to respond to an incident during a power failure.
6.5. Access Control
In Chapter 2, we discussed the use of choke points, which is one of the nine security fundamentals. Access control is the security measure that directly ties into this fundamental by providing a process to identify the authorization of all individuals attempting to enter the facility through these choke points. It should be emphasized that access control is probably the single most important aspect of any physical security system. If you are able to account for and validate the authorization of all people entering and exiting your facility, it is extremely difficult for any individual to surreptitiously gain access not only to your critical resources but into your facility itself.
An access control system must be able to accomplish several objectives:
• Allow only authorized personnel to enter or exit the facility.
• Control access to sensitive areas inside the facility and ensure that this access is granted only to personnel with the appropriate clearance.
• Detect and prevent the entry or exit of contraband materials.
• Notify and provide information to security personnel for assessment and response as necessary.
An access control system can be as simple as checking an individual’s identification against an approved list of authorized employees, or it can be an automated, computerized system that integrates employee identification cards with card readers and information databases to record each and every entry and exit for any employee. An area that is also included within the area of access control, but typically overlooked, is a process to maintain facility keys and locks—typically designated a key control system. We will look at these various areas within access control and provide you guidance on what you need to consider and what type of items you should include when designing your access control system.
6.5.1. Access Control Considerations
Before we look at specific access control systems, there are some simple and inexpensive improvements that any business can accomplish in order to provide better access control.
6.5.1.1. Limit Building Entry Points
Most facilities have more exterior doors and entryways than is necessary to conduct business and allow access into the facility for all your employees. Although all these doorways must allow for exit in the event of an emergency, the number of entry points should be minimized in order to funnel any people entering the facility through a central reception point. This area should normally have an individual (either a security guard or receptionist) who not only can verify the authorization of any individual attempting entry into the building, but can also provide a greater degree of customer service and professionalism to guests. Since a primary obstacle to minimizing the number of entry points is usually convenience among your employees, they can be better sold on the idea based upon the advantage to the company of having an individual with a professional demeanor greeting individuals who are entering the building.
6.5.1.2. Employee Identification
To better determine which personnel are authorized within the facility, and particularly in areas containing critical resources, your organization should provide employee identification cards to all your personnel and require everyone to wear these cards while at work. These cards should be designed so that they are highly visible and relatively simple; however, they should have some identifying markings to make duplication difficult. At a minimum, employee identification cards should include:
• Recent picture of the employee
• Employee name
• Organization or Corporate logo
By issuing and mandating wear of identification cards, it will become much easier to identify employees—particularly if your organization is large enough that all your personnel do not know each other. Additionally, these employee identification badges will cause many personnel to question an individual that is not wearing one, so that over time and with training, along with emphasis by management, employees will gain heightened security awareness and they will begin to assist in access control by identifying personnel within the building who are not wearing the proper identification.
6.5.2. Access Control and Individual Verification
We have alluded to some different methods to accomplish access control; however, a major decision you will need to make is how your business will actually provide access control into your facility. There are two primary methods to accomplish this: having personnel specifically designated to accomplish entry control, or the use of an automated access control system. We will look at each of these systems and discuss the advantages and disadvantages of each.
6.5.2.1. Entry Control Personnel
We have already discussed one advantage in having an individual that is dedicated to checking the authorization of personnel as they enter your facility. This advantage—adding a higher degree of customer service and professionalism to visitors when entering your facility—provides a significant reason to use some type of receptionist or entry controller; however, another significant advantage is in the improvement for security within your facility. Having an individual checking the identification of all personnel and validating their need to enter the facility is an extremely effective deterrent against unauthorized entry.
One of the business markets I have worked with is education, and within school districts, a significant safety and security issue they must face is the active shooter situation. Even though this threat continues to increase—and unfortunately occurs multiple times each month across the United States–many schools continue to allow access using multiple entries into their facilities, which violates the security fundamental of choke points. In addition to having these multiple entries, the problem is exasperated as very few entrances (if any) are normally under any direct observation from school administrators or teachers. This allows an individual to enter the school and gain access directly into classrooms and the students before anybody would even be aware the perpetrator is inside the facility. By limiting the number of entries into a school and posting individuals to stand at these entrances during high-traffic periods in order to validate the authorization of the personnel moving into and out of the building, this practice can greatly deter such a catastrophic incident from occurring.
In the case of your organization and the decision to utilize a receptionist, there are some disadvantages to having an individual posted to check authorization—the main issue being cost. If your facility is unable to limit the number of entrances, the costs of having entry control personnel or receptionists located at each area can quickly become cost-prohibitive. The costs can also be prohibitive if your business is small, since you may have to hire an additional employee to act as a receptionist, which could be a significant burden on an already tiny budget. If one of these reasons or another applies, the addition of a receptionist or entry controllers may not viable for your business, so another access control option to consider is the use of an automated access control system.
6.5.2.2. Automated Access Control System
The automated access control system is another option when looking to improve your entry control processes. Automated access control alleviates the need to hire a full-time receptionist or entry controller, and instead determines the authorization of an individual through the use of some type of credential, such as keys, tokens, or transmitters. The most effective credential in this type of system is photo identification card that can double as your employee ID. This photo identification card is encoded with each employee’s personnel information. Each exterior entrance to your facility, along with any entry into restricted areas, will have some type of card reader and key-card entry. These card readers can work by a variety of methods such as a card swipe, card swipe plus a Personal Identification Number (PIN), or combined with the use of biometrics identification (e.g., voiceprint, fingerprint, retinal scan, etc.).
As with any process, there are advantages and disadvantages associated with an automated access control system. We will first look at the advantages. A significant advantage of the automated access control system is the visibility that it provides on your employees. These systems record not only every individual’s entry and exit for any doorway with the installed card reader, but most systems will also record any door openings. This can provide an exceptional record of unauthorized entry, potential issues with employee theft, and employee attendance. Another advantage, as discussed earlier, is that the identification cards can (and should) double as your organization’s employee identification card. This is a minor cost savings since your organization does not need to procure separate employee ID cards, although it should be noted that access control cards will normally be more expensive than a standard identification card. The last advantage we will discuss is that an automated access control system is usually going to be cheaper than having to hire additional employees as receptionists whose sole purpose is to check and validate identification at every entrance. With the advantages, however, there are several disadvantages to this type of system. The automated access system does not work well if your business has a lot of visitors, since the only access to the facility should be through the card readers and identification cards. If your business has a significant number of visitors, you would either need to have a telephone located at an entrance where they could contact the employee they wish to visit, or your business could provide one entrance that has a receptionist for any visitors. With the first option, a telephone may not portray a very personal touch. There will also be security issues since you would need to post some type of employee roster with telephone numbers. With the second option, you have just incurred the additional costs that you may have been hoping to save due to the need of this additional employee. Another disadvantage of the automated access control system is the accountability that must be required for the employee ID cards. If an employee loses their card or if they are leaving employment with your company, there must be several tasks that must now be accomplished. There needs to be a process to ensure the invalid cards are turned off in the system; cards must be turned in prior to an employee’s departure from the company, and the information for that particular employee contained in the automated access control database must be deleted in order to ensure that access cannot be granted to any individual no longer working for the company. These tasks require additional work to establish and maintain a tracking system to ensure employees who have departed, particularly if they do so under less than desirable circumstances, do not have continued access to the company and its facilities. This accountability can definitely be a challenging task if your company has a large turnover of employees or other authorized personnel who require access to your facilities (such as schools, universities, and public institutions).
The following matrix in Figure 6.8 provides a summary between the two options for access control: using security personnel or a receptionist and an automated access control system. This matrix lists the pros and cons of both options, based upon the advantages and disadvantages we have discussed.
6.6. Alarm Systems
Alarm systems are a standard item within any organization’s security system and are the primary method to provide notification, another of the nine security fundamentals. The basic operation of any good alarm system is to provide this needed notification of any unauthorized attempt to gain access to a building, room, or specific piece of equipment. This is normally accomplished by detecting changes in the environment around the object or by detecting a break in some type of pathway (e.g., electrical, infrared, etc.). We will look at the various considerations you should look at when determining when to use an alarm system and what type of system will work best in a particular application.
Most people are familiar with alarm systems; however, there are several things to consider before you decide to utilize one in your overall security program.
• What risk or vulnerability you are protecting against
• Past history of any burglary, unauthorized entry, or vandalism
• Are tamper resistance or tamper-indicating devices necessary in the particular application
• Who will be notified of an alarm and what is the response time to the location
• Cost-benefit analysis
Alarm systems are primarily used to protect critical resources or at least the areas surrounding these assets; however, like many other security measures, an alarm system is useless unless it is used in conjunction with other systems. For example, if an alarm sounds but does not provide any type of notification to a response force, the usefulness of the alarm is negated. This will typically make an alarm system more expensive than the initial installation cost due to ongoing costs to ensure notification, and these costs should be factored in as you consider whether alarm systems will be used.
One of the best alarm systems I saw during my career in the U.S. military was in the use of animals as part of an integrated security system. Most people are familiar with the use of sentry dogs in the military, and these are extremely effective. I participated in several exercises with U.S. Army Special Forces personnel who acted as aggressors in simulated war games. In these exercises, these highly-trained personnel attempted to attack and damage areas we were tasked to guard. At the conclusion of these exercises, these Special Forces professionals would state that the single greatest challenge to their ability to infiltrate and enter any secured areas were sentry dogs. Their sense of smell and ability to detect movement in all weather and at any time of day are a great deterrent to a potential intruder. In addition to sentry dogs, there are other animals that have been used as early warning alarm systems. One such animal that is not normally associated with security, but occasionally used, are geese. Brazil uses geese that act as their primary alarm system along prison boundaries, and several European nations also have geese to act as sentry alarms at military areas. The point here is that you may be able to utilize some unique solutions to provide an inexpensive but effective alarm system for your facility.
6.6.1. Alarm Sensors
The type of alarm sensor to be used can vary throughout your overall system, as each individual sensor depends upon the object it is meant to protect, the area or space, and the perimeter surrounding the object. Basic principles of the different types of alarm sensors include:
• Breaking an electrical current
• Interruption of a light beam
• Detection of sound or vibration
• Detecting a change in capacitance due to the penetration of an electrostatic field
• Detecting changes in imagery
With these principles in mind, you should make a quick analysis of the area that the alarm sensor will be operating in. For example, if there is a great deal of noise in the area, even during nonworking hours in places such as utility areas, where equipment or other machinery must be in continuous operation, an alarm system that detects noise would probably not be your best option. Another example is if the sensor will be operating outdoors and the area of the country your company is located in can experience severe weather on a fairly frequent basis, the use of an alarm system sensor that detects motion changes through the use of cameras would not be a good choice. Table 6.3 provides a list of some alarm sensors and where they are typically designed to operate.
Table 6.3
Alarm Sensors and Designed Operating Environment
6.6.2. Fire Alarm Systems
Although the main emphasis of this book is primarily meant to provide information on security systems, your fire alarm system cannot be neglected. This system must meet minimum building and fire codes for your area; however, there are many additional options that can be included in your system above and beyond most minimum requirements. The system that you select, along with the variety of options you choose to include, depend upon the impact to your business that a fire could cause (for example, a brick-making company may not see as much damage as a paper manufacturing business), what critical resources you plan on protecting, and the overall cost of the system options. For example, if your company deals primarily with information that is kept on computer servers outside your primary facility, you may only require a system that meets the minimum requirements. On the other hand, if your company manufactures hardware and has all your tools, equipment, and material stock in the same building as your administrative offices, you may require some additional options included in your fire alarm system.
The primary purpose of a fire alarm system is to provide early warning in the event of a fire so that building occupants are able to reach safety. Fire alarm systems can also perform several other functions, to include sending alert notifications to the fire department, making an initial notification to building maintenance staff prior to sounding the general alarm, automatically engaging fire suppression systems, and the implementation of building safety measures to minimize the spread of the fire (e.g., recall elevators, activate smoke exhaust systems to ventilate a fire and reduce heat buildup, and activate equipment to pressurize stairwells and shut down recirculating air systems). Again, you will need to evaluate the potential loss to your company in the event of a fire and conduct a cost-benefit analysis against the price of many of these options to determine the system that best fits your company’s needs.
6.6.3. Alarm Monitoring Systems
The purpose of an alarm is to provide notification of a possible intruder; however, without some type of response to check out the alarm, the overall system is useless. This is where an alarm monitoring system comes into place.
The alarm monitoring system alerts the proper authorities to stop a crime in progress or lead to the apprehension of the intruder. There are two general types of alarm monitoring systems: a Local Alarm System and a Central Alarm System. We will look at each of these in turn.
6.6.3.1. Local Alarm System
A local alarm system results in some type of visual alarm, such as a bell, horn, siren, or flashing light that only occurs at the facility experiencing the alarm. This notification provides security personnel within the area of an incident so that they can respond. Although this system provides deterrence to a possible intruder, it is useless if there are no personnel who can respond to the alarm. A good use of a local alarm is to provide warning of a fire or other type of safety incident, which requires action by the employees in the immediate area.
6.6.3.2. Central Alarm System
A Central Alarm System transmits the alarm signal to a central station, usually located outside the immediate business establishment. This central station should be monitored 24 h a day to supervise, record, and maintain any alarms. Upon receipt of an alarm, the central station notifies the proper authorities, such as fire or police, to respond to the incident.
6.7. Closed-Circuit Television
Closed-circuit television, more commonly known by its acronym CCTV, is another security measure that can augment any physical security system. Like many of the security measures we discuss, however, CCTV cannot be the only item or act as the only protection asset within your system. Additionally, if cameras cannot be kept under continuous observation—ideally by an individual or at a minimum by recording their output—other security measures should be considered instead of CCTV. I have come across many individuals throughout my career who believe that having a camera, even if it is not kept under observation, can provide a deterrent sufficient enough to alleviate all their other security needs. Although the deterrent value of a camera is valid, simply having a camera will not outweigh the actual cost of the installation and maintenance. For example, I have seen many organizations that have had cameras that are not under any observation, or in some cases, not even working. Although the deterrent effect may work for a short time, in the vast majority of these instances the personnel within the facility usually knew within a few days that the cameras were not working, and thus were not going to catch anyone. These cameras had a minimal deterrent value and as a result, these items did little to deter bad behavior or even criminal activity. If your organization plans to use security cameras solely as a deterrent, it is advisable to use fake cameras that provide the façade of CCTV but are not operational—these items are very inexpensive and you do not need to worry about observation; however, as we discussed earlier, the deterrent value will quickly go away as people realize these cameras are fake.
6.7.1. Types of Cameras
There are several types of CCTV cameras on the market. What type of security camera you choose should be based upon where the camera will be mounted, what you wish to observe in that particular location, and what conditions the camera will typically operate in (e.g., indoors, outdoors, low-light, long distances, etc.). We will look at the various types of cameras currently on the market.
• Bullet Camera. A bullet CCTV camera, shown in Figure 6.9, is a wall-mount or ceiling-mounted unit that is typically designed for indoor use, but can also be used to fulfill some outdoor applications. This type of camera does not possess any ability to change its viewpoint—typically called pan/tilt/zoom, or PTZ—but instead can only be fixed to observe one particular viewpoint.
• Dome Camera. These cameras get their name from the dome-shaped housing in which they sit. These housings are designed to make the cameras unobtrusive; however, they are not completely covert or hidden. These types of cameras serve a dual purpose: potential perpetrators will know that the facility is under observation, and employees will feel at ease knowing that the facility is being protected. Some dome cameras allow the camera to spin quickly within the housing to rotate their observation area to another location, and are often referred to as “speed domes.” A picture of a dome camera is in Figure 6.10.
• Covert/Desktop Cameras. These tiny cameras are well suited for desktop use when using Skype and other low-resolution teleconference applications. Many personnel use these types of cameras in conjunction with their computer in order to conduct video conferencing.
• Discreet Cameras. These types of cameras are disguised as other items, such as a clock, smoke detector, or motion sensor as shown in Figure 6.11. These cameras can be placed in locations that would not normally be available to standard cameras due to their size, and because they are not readily identifiable as an observation device.
• Outdoor Cameras. These types of cameras are normally no different from many of the other cameras we discuss—the main key to outdoor cameras is the housing itself, which must be impenetrable to moisture, insects, dust, and other elements. A photo of an outdoor camera and its housing is shown in Figure 6.12.
• Day/Night Cameras. Day/night cameras compensate for varying light conditions to allow the camera to capture images. These are primarily used in outdoor applications where the security camera is positioned onto an outdoor parking lot, for example. In many cases, units are advertised to have a wide dynamic range so that they can function in a variety of conditions to include glare, direct sunlight, reflections, and strong backlight, which enable these types of cameras for 24-h-a-day use.
• Varifocal Cameras. Also known as a zoom camera, these items are equipped with a varifocal lens that allows the operator to zoom in or out, although still maintaining focus on the image.
• Network/IP Camera. These cameras, both hardwired and wireless, transmit images over the Internet, often compressing the bandwidth of the information so as not to overwhelm the system. IP cameras, shown in Figure 6.13, are easier to install than analog cameras because they do not require a separate cable run or power boost to send images over a longer distance.
• Wireless Camera. Not all wireless cameras are IP-based. Some wireless cameras can use alternative modes of wireless transmission, but no matter what transmission method is utilized, the primary benefit with these types of cameras is still the same: extreme flexibility in installation.
• PTZ/Speed Domes. Pan/tilt/zoom cameras give the surveillance operator the ability to move the camera left or right (pan), up and down (tilt), and to zoom the lens closer or farther from the area under observation. These types of cameras, shown in Figure 6.14, are normally used in surveillance situations where there is an actual security guard or surveillance specialist who can monitor and control the images; however, PTZ cameras can also be used in applications where the specific camera is automated so that the pan/tilt/zoom functionality allows the camera to be moved to observe specified locations on a timed basis. These types of cameras can also be used to cover a wide area with only one camera, or to avoid poor lighting conditions such as a setting sun.
• High-Definition Cameras. Ultra high-definition cameras are often relegated to niche markets, such as casinos, due to their expense. These cameras give operators the ability to zoom in with extreme clarity (to look at gamblers who may be suspected of cheating). In the past, these cameras were tube-based analog cameras, but today’s digital technology has replaced these older units so that many of these types of cameras now transmit their images by using HD closed-circuit television.
6.7.2. Monitoring Options for Closed-Circuit Television Systems
There are three primary options you can choose to utilize when considering how your organization will monitor the installed security camera system:
• Monitoring all cameras at one location by an individual
• Monitoring cameras through the internet
We will look at each of these options separately and discuss the advantages and disadvantages of each.
6.7.2.1. Monitoring by Dedicated Security Personnel
This option provides the most complete solution; however, it is also the most expensive method to monitor a CCTV system. Monitoring of the cameras is accomplished on a continual basis by either security guards working for your company or by outsourcing this service to a private security firm. Either solution provides the single most important advantage to this option—it ensures the most complete monitoring of the security camera system and is the most likely solution to observe any attempts of criminal activity at the moment they are occurring. The major disadvantage is the large price tag, due to several costs associated with this option. One cost is the initial installation fee that must be paid—even if your organization already has an operational CCTV system, the service provider will likely need to accomplish some type of equipment installation in order to monitor the cameras from their own monitoring location. Furthermore, if the service is to be outsourced to a security service provider, this cost could be very significant based upon the distance between your company and the security firm, depending upon the method that will be used to monitor the camera system. The second cost for this option is the ongoing periodic fees—typically paid on a monthly basis—for monitoring the system, either paid to an outside agency or for the salaries of any internal employee who will monitor the cameras.
Although there are several disadvantages to this solution, this option may work well if your organization is large. Within a large organization, there will be a need to hire personnel to exclusively work safety and security issues, if you do not already have a dedicated security department or guard force. Additionally, larger companies will likely have a significant number of areas under observation, and thus a large number of security cameras that will need monitoring—this task cannot be effectively accomplished if this task is given to an employee as an additional duty. Again, if your organization is large, having a dedicated section of security personnel will not only provide the most complete monitoring capability but will also ensure that other safety and security aspects are maintained.
6.7.2.2. Monitoring at Single Location
Many organizations choose this option since it is usually the least expensive option—particularly if your organization is not large enough to provide for a dedicated security section. In this option, all cameras are tied together so that they can be monitored at one single location within the facility (normally this location is in a central area such as reception, or at the primary administration focal point’s desk within the organization). Again, the primary advantage of this solution is the relatively low costs due to the shorter distances between the cameras and monitoring station. The primary disadvantage of this option is that it is extremely unlikely that the cameras will capture an actual act or incident as it is occurring. This is because the monitoring station is either at the desk of an individual who has other primary duties, or the monitors are located in a central area and under no direct or continuous observation by any employee. Another disadvantage to this option is that since there is only one location where the monitoring equipment is located, it can be easy to sabotage the equipment if it is not under direct control or observation of one individual.
Based upon the lower costs, this option works well if your organization has limited funds or is not large enough to justify a dedicated security section. A key point that must be made regarding this option is that since it’s extremely unlikely an act or incident would be observed as it occurs, the best result you can hope to achieve is to ensure the system captures and records the incident, which can be used in the investigation.
6.7.2.3. Internet Monitoring
This solution provides an alternative for smaller organizations, rather than having only one location with monitoring capability. In this option, security cameras are able to be monitored over the internet through the use of particular security cameras, which send their output to an IP address. This IP address will typically be password-protected so that any authorized individual within your organization can observe the cameras in real-time or previously recorded segments. The advantages for this monitoring option are the flexibility of the system and the difficulty to sabotage or delete the recordings. The disadvantage is that this option is more expensive than tying your cameras into one central monitoring station (but still considerably less than having a dedicated security section continuously monitor the CCTV system). The higher costs are due to the higher expense for cameras that have IP capability when compared with hardwired CCTV cameras, and the potential for periodic monthly costs required for the upkeep and maintenance of the website where the camera output is located.
This option provides a good alternative—especially for smaller organizations—to the central monitoring station option. As with the central monitoring station option, however, it is unlikely that an incident would be observed as it occurs. However, due to the greater flexibility of the system, the ability to have multiple employees with the capability to observe cameras will better help them to manage their areas and provide a greater deterrence against any unwanted activity.
6.8. Security Integration Systems
Depending upon the complexity of your organization’s security system, you may consider using a security integration system. This type of system is not a necessity; but if an overall security systems includes several complex subsystems to include lighting, access control, alarms, and CCTV, your organization may wish to consider an overall security integration system.
A security integration system provides one overall computerized system to monitor and control several different portions of your physical security system. For example, such a system can control all exterior and interior lights, it can provide notification and information on alarms, provide information on an organization’s automated access control system, and monitor all security cameras within a CCTV system. The advantages should be fairly obvious—consistency within all your various security systems that would result in ease of use of these varied systems, along with more flexibility and control of the overall security system. Unfortunately, there are also significant disadvantages—the primary one being cost. Integrating all these aspects of your physical security system into one overall system can be extremely difficult; particularly if these various systems were installed at different times, with different levels of technology, and by different manufacturers. This disadvantage, due to possible compatibility problems between these various pieces of hardware, can make the integration of all your security equipment into one easy-to-use computerized system very expensive, if possible at all.
A good rule of thumb is if you have a large amount of equipment from several different manufacturers and installers for your organization’s security lighting, alarms, access control system, and CCTV cameras, it may not be possible or practical to attempt to integrate these into one integrated security system. If, however, you have little or no current security measures in place and are starting from scratch, it may be advisable to work with one vendor in order to obtain one integrated security system for all these various physical security measures.
6.9. Safes and Vaults
Valuable assets belonging to your company need to be placed in some type of high-security storage area, such as a safe or vault. The primary difference between the two is size—a vault is a larger storage area that is normally a separate room, and that is part of the building’s structure but with significantly stronger with thicker walls, floors, ceilings, and doors. Vault doors should be made of a minimum of 6 in of steel, and the walls, floors, and ceiling should be reinforced concrete at least 12 in thick—normally twice the thickness of the door. Vaults must usually be located at or below ground level because of their structural strength and significant weight. A primary disadvantage of vaults is the expense in construction. If you have an existing facility that does not have a vault, the required construction may be cost prohibitive; however, if you are currently constructing your facility or accomplishing a major renovation, it may be advisable to consider the addition of a vault.
A key item of consideration for safes and vaults is what you wish to protect against—burglary or fire—since these compose the two separate categories of protection for safes and vaults. Although most secure safes and vaults provide protection against both to some degree, you should ensure any device you are considering meets Underwriters Laboratory, or UL, minimum ratings against your primary concern for your specific company assets. Many burglar-resistant containers may not provide against fire and conversely, many fire-resistant containers may only provide a minimal deterrent against theft. Typically, the higher the rating in either category, the more expensive and more secure the safe or vault.
6.10. Summary
Central to providing a viable physical security program is the need to employ security measures in layers around your critical resource, or to provide what is commonly termed by security professionals as defense in depth. In the manner of concentric circles moving inward, it is important to work from the perimeter of your property and facility and incrementally strengthen the security measures as you work your way in, until eventually the strongest security measures protect your organization’s designated critical resources.
Perimeter security measures provide a barrier not only to distinguish the property boundary or facility, but also to attempt to limit access onto the property. These perimeter measures can employ natural or manmade barriers. Natural barriers include the use of terrain, vegetation, obstacles (such as rocks, stones, walls, etc.), and water features to delineate your company’s perimeter boundaries. Although natural barriers are more pleasing to the eye and can provide a more subtle method for perimeter security, these security measures can be much more expensive. Manmade barriers typically include fences and walls, and although they are less expensive than natural perimeter security measures, they may look less welcoming to visitors and potential customers.
Security measures along the inner barrier to your facility must take the doors and windows into account, as these items are the most susceptible to damage and break in. In addition to ensuring that your organization always locks and secures these openings, it is also important to strengthen these areas with robust frames, solid construction doors, and strengthened windows.
Lighting is another important physical security measure. Exterior lighting is meant to assist with observation in and around your facility for security personnel, cameras, or both, whereas interior lighting should provide additional lighting to critical resources and meet any emergency lighting requirements.
Access control is a critical piece of your physical security system—probably the most critical piece. This aspect of the physical security program ensures that only authorized personnel enter or exit the facility. Access control also controls entry into sensitive areas, it detects and prevents contraband materials, and it alerts security personnel of any issues. Some easy methods to improve access control for any organization include limiting the number of entry points into the facility, providing a process that identifies employees, and providing personnel who are responsible to monitor entry and exit for the facility.
The next aspect within most physical security systems is an alarm system. This is meant to provide notification of unauthorized entry to the grounds, building, or your organization’s critical resources. Alarm systems can also identify employees; however, it is more acceptable to have the alarm system make notifications directly to security personnel or law enforcement.
Another aspect that was discussed was the use of closed-circuit televisions and their use within a physical security system. As part of this discussion, we looked at different types of cameras and options to monitor the video output of these cameras.
We also looked at the security integration system, which is the overall system that ties many of the various physical security measures, such as access control, alarms, and CCTV, into one coherent system that can be easily accessed and analyzed.
The last area within the physical security area that we reviewed was safes and vaults. These items are typically used to store items that your organization has determined as critical.
In order to ensure an adequate number of layers within your organization’s physical security program, it is important that you employ equipment and procedures that cover most—if not all—of these areas. This not only provides multiple problems for a potential intruder, but it also offers some redundant systems to increase your organization’s security posture.
6.11. Physical Security Checklist
| Yes | No | |
| If size allows, do you store and lock your critical resources in a safe or vault? | ||
| Does your company limit the number of access points into your facility? | ||
| Does your company utilize identification cards and do you require continuous wear while in the facility? | ||
| Does your company have a program to monitor entry by all employees and visitors (e.g., entry guards, sign-in/sign-out logs, automated access control system, etc.)? | ||
| Do all door and window locks on your facility meet minimum acceptable UL ratings? | ||
| Do all windows on your facility have additional security protection (e.g., glazing, wire-mesh, burglar-resistant, etc.)? | ||
| Are all exterior doors and frames of sufficient strength and reinforced as necessary? | ||
| Does your facility have an intrusion alarm system? Does this system notify local police and fire (as applicable)? | ||
| Does your company’s facility have perimeter security measures (e.g., fencing or natural barriers) located along the property limits? | ||
| Does your facility have exterior lights located along the perimeter and at primary access points? | ||
| Does your company have signage to identify your property boundaries? | ||
| Does your facility have emergency lighting? | ||
| Does your facility utilize CCTV cameras to observe critical resources, primary access points, and areas vulnerable to potential criminal activity? |
Note: All items are listed in priority order, so you should ensure that each answer is “Yes” prior to expending funds or effort on the next question. This ensures that an executive with minimal security expertise can easily move down the list in order to implement an adequate security program.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.