Resilience

 

 

https://sm.asisonline.org/Pages/Out-in-the-Open-Feature-.aspxOut in the Open: The Security Challenges of New Office SpacesGP0|#cd529cb2-129a-4422-a2d3-73680b0014d8;L0|#0cd529cb2-129a-4422-a2d3-73680b0014d8|Physical Security;GTSet|#8accba12-4830-47cd-9299-2b34a43444652019-02-01T05:00:00Zhttps://adminsm.asisonline.org/pages/holly-gilbert-stowell.aspx?_ga=2.206806619.913735308.1534771762-1627284918.1496762042, By Holly Gilbert Stowell<p>​Five people were killed in a shooting at the Capital Gazette newsroom in Annapolis, Maryland, on June 28, 2018. The gunman walked into the building and barricaded the rear exit of the newsroom before he began shooting. The newsroom’s design was open-concept, a popular design choice for news organizations.</p><p>“There are glass windows all around the room,” Terry Smith, a columnist for the Capital Gazette, told CNN in an article released shortly after the tragedy. “There is nothing except for a few half-walls at the editors’ offices on the left to impede a shooter.” </p><p>In addition to the open-concept layout, which left victims exposed, there was no receptionist or access control system the shooter had to bypass to enter the newsroom. </p><p>“They had no access control in the front of the building,” notes Pete Blair, executive director of the Advanced Law Enforcement Rapid Response Training Center at Texas State University. “And that was a decision they had made, saying, ‘Look, it’s a community newspaper and we want people from the community to be able to come in and find reporters to tell stories to,’ and that’s how they got a fair amount of their information.”</p><p>Blair spoke on a panel at GSX 2018 that addressed the security of newsrooms in light of the Capital Gazette shootings. He tells Security Management that since the shooting, the Annapolis newspaper said it would change the location of the newsroom. “Now they have made the decision that they are not going to allow easy access to places,” Blair says. “A lot of places were starting to talk about moving their newsrooms up off the first floor to the second floor, or something like that, to make it more difficult to find them and access them.” </p><p>The Annapolis shooting has raised questions about the challenges of open-concept designs in the event of an active assailant situation. While these sleek office interiors may be pleasing to the eye, experts note their design make it harder to seek cover or lock down in emergencies. And the challenges don’t stop at active assailant situations. Cybersecurity and information protection can also be an issue in open office environments.</p><p>Open-concept office spaces aren’t just popular with newsrooms—the design choice is on the rise. A 2017 survey by office staffing firm Robert Half shows that about one in five companies switched to an open-office configuration in the last five years. Forty-eight percent of respondents said they believed the open concept helped productivity; 32 percent said it was hindering to productivity; and 20 percent believed there was no impact. </p><p>Other studies show more negative feedback on open spaces. According to a survey of self-identified “high-performance employees” by software strategist William Belk, 58 percent of these individuals “need more private spaces for problem solving.” His findings were published in a March 2017 article on CNBC. In addition, 54 percent of these employees said they found their office environments distracting. </p><p>Office design isn’t just critical for productivity considerations—it’s key to providing a safe and secure environment for employees, says Herbert Ubbens, CPP, PSP, president of Paratus Consultants Group and member of the ASIS International Commercial Real Estate Council. </p><p>“There are a lot of challenges within those open spaces where there are a lot of cubicles,” he says. In the open-concept office, there are fewer walls and office doors to close, potentially hindering employees’ responses in the event of an emergency. “When you have a reduction in hard surfaces… there’s some concealment but very little cover out there when a shooting does occur,” he notes. </p><p>Blair echoes Ubbens’ sentiment about active assailant situations. “The new designs look pretty—but they are not well designed for safety,” he says. </p><h4>Active Assailant<br></h4><p>In the event of an active assailant, transparent designs—from conference rooms to office walls—don’t provide any type of concealment when fleeing an attacker. “The attacker would be able to see where everybody is, and be able to guide themselves that way, so that’s a problem,” Blair says. He recommends film that goes on the glass, even if it is simply to provide concealment. </p><p>“The films that you can put on windows that are affordable tend to be ones that are designed to maintain the integrity of the glass, but not to stop bullets.” While bulletproof film is available, most organizations find it cost-prohibitive.</p><p>When it comes to active shooter training methods, the Advanced Law Enforcement Rapid Response Training Center teaches a three-step approach. “We teach ‘Avoid, Deny, Defend,’ which means you should avoid the attacker if you can and get out of there,” Blair says. “If you can’t, deny access to your location—close, lock doors, barricade, that sort of thing—and as a last resort, defend yourself.” </p><p>In cases where those three steps are difficult to implement, the casualties tend to be higher, he notes, such as the Aurora, Colorado, movie theatre shooting that claimed 12 lives. </p><p>Shopping malls, on the other hand, are designed to allow traffic to flow freely. “So very quickly people can hear the gunshot, know something bad is going on, and there are plenty of ways to move away from that and get out of the location,” he says.</p><p>For companies opting for the open-concept spaces, Hubbens recommends a saferoom for emergencies, a concealed and secure room not offered by many open-concept designs. “One thing we’re seeing is the use of saferooms, essentially secure areas that would be used for a tornado shelter, as well as an area for everybody to go into and lock,” he notes. “It would be located somewhere toward the core of the building.” </p><p>For example, one client he works with has a nine-floor building and decided to install a saferoom on every floor. “They wanted to make sure that all of their people have somewhere they can evacuate to, or a safe haven for a hurricane or other environmental incidents,” Ubbens notes. </p><p>While saferooms seem like a viable option at first glance, Blair points out there are considerations for security staff and management. “It could be that, depending on where the attack starts, the safe room is in a position that is totally wrong for you to get to,” he notes. “It’s just not reasonable for you to try, and yet if you’ve trained people to go to the saferoom they may try it anyway.” </p><p>Secondly, employees may have to keep others locked out of the saferoom, a difficult decision and scenario for anyone to be faced with. “Having a saferoom means getting your head around the idea that you could have coworkers outside the door banging trying to get in, and you’re not going to let them in,” Blair explains, “because you can’t be sure that it’s not the attacker pretending to be somebody, and if you open the door and the attacker’s right behind the person, then the attacker gets into the saferoom.” </p><p>Blair recommends designing an office layout that has clear escape routes and training employees on various points of egress in the event of an emergency. He says that all too often, in an emergency people get caught up on the idea of exiting the same way they entered a location. </p><p>“One of the examples we use a lot in our trainings is from the Station nightclub fire,” he says, referring to the deadly blaze in Rhode Island in 2003 that left 100 people dead. Many of those victims died at the front entrance to the club where they came in, trying to use that same route to escape. </p><p>“Why did everybody go to that exit? Well, when you get placed under stress you’re going to go where you know. So, people turned and they went to that place they came in from,” Blair notes. “And yet if you are in your calm state, your rational mind, you know that fire code says there have to be other exits here.” </p><p>With any open-concept office space, access control on the front-end is essential. “You might have an open office design in the back of your workplace, but in the front end you have an entry vestibule where people come in and they are screened there,” he says.</p><p>Newer technologies like weapon and gunshot detection systems are also valuable, according to Mike Neugebauer, CPP, a security and business development consultant for Johnson Controls. These are especially useful in environments with public spaces like courtyards or restaurants attached to the building.</p><p>“The beauty of the newer systems is they take a lot of the human interaction or response out of the equation and set in motion responses,” he notes. “The more steps that we can extract and make automated, the smoother that event is going to run.”</p><p>The “See Something, Say Something” mantra is also more difficult in any larger corporate environment without permanent workspaces, where workers cannot be acquainted with everyone else. “Now with this open space, where you may travel 20 floors to go to a conference room that’s been deemed a public conference room, you don’t know who’s supposed to be there and when,” Neugebauer notes. “And when you work at a building with two or three thousand employees you can’t possibly know every one of them. So, it makes that situational awareness even more valuable to a company.” </p><h4>​Information Security</h4><p>The financial sector has faced new security challenges as it modernizes branch offices, says Neugebauer. “With the picnic bench design, so-to-speak, where you sit in a different spot every day, you may be sitting next to someone who is working on a sensitive project on his or her laptop, and you have no need to see it,” he explains. “Banks used to be very mindful about separating employees that have customer information versus ones that have no access and no need for customer information, and those folks kind of mingle today so it really presents a lot of other security issues.” </p><p>Neugebauer, who spent several years as the security director for a large regional bank, explains that the security culture of the organization must be instilled and reinforced in employees, from where they store their computers to where they choose to have confidential conversations. “They don’t want to stand in a social area and have that confidential conversation, because in a large company you may not know everybody, and you may not know the person sitting three seats away from you, not knowing that person sitting there is just collecting data and information.” </p><p>Companies opting for open-concept designs should take clean-desk policies into consideration to keep information as well as business and personal assets, safe, according to Neugebauer. “The organization has to make sure it has lockers or somewhere in that space to put purses or briefcases, or your laptop if you’re not taking it home,” he says. “You don’t want to leave it out.” </p><p>If organizations have the chance to design the open-concept spaces from the ground up, Neugebauer says physical security teams should collaborate with IT to consider the holistic security picture. </p><p>“We’re moving from a hardwired environment, where you have a hardwired computer, to the laptop, so now you have open Internet available and more people—especially if you’re in a multitenant building,” he notes. “Someone may be able to pick up that signal and hack your network more easily, so that situational awareness has to be turned up a notch or two.” </p><p>To foster security awareness throughout a company, all departments—from human resources to legal to IT and beyond—must be involved. “It’s almost like a three-legged stool—you take one of the legs away and the whole thing collapses,” he says. “And the employee has to become more responsible for the holistic security of their environment.”</p><p>Regardless of design, Blair points out that there is a balancing act when it comes to any security plan. Providing an environment that makes employees comfortable can be just as critical as keeping them safe. </p><p>“We could have massive screening up front…then another screening to get into actual building, and make things very secure,” Blair explains. “But it would be very uncomfortable. So, there’s always that issue of finding the right balance.”  ​</p>

Resilience

 

 

https://sm.asisonline.org/Pages/Out-in-the-Open-Feature-.aspx2019-02-01T05:00:00ZOut in the Open: The Security Challenges of New Office Spaces
https://sm.asisonline.org/Pages/Seek-Joy.aspx2019-01-01T05:00:00ZSeek Joy
https://sm.asisonline.org/Pages/A-Shock-to-the-System.aspx2018-12-01T05:00:00ZA Shock to the System
https://sm.asisonline.org/Pages/Dancing-With-Yourself.aspx2018-12-01T05:00:00ZDancing With Yourself
https://sm.asisonline.org/Pages/SM-Online-November-2018.aspx2018-11-01T04:00:00ZSM Online November 2018
https://sm.asisonline.org/Pages/Book-Review-What’s-Your-Plan.aspx2018-11-01T04:00:00ZBook Review: What’s Your Plan?
https://sm.asisonline.org/Pages/Book-Review-Disaster-Recovery.aspx2018-10-01T04:00:00ZBook Review: Disaster Recovery
https://sm.asisonline.org/Pages/Book-Review-Gun-Violence.aspx2018-10-01T04:00:00ZBook Review: Gun Violence
https://sm.asisonline.org/Pages/Smarter-Structures,-Safer-Spaces.aspx2018-10-01T04:00:00ZSmarter Structures, Safer Spaces
https://sm.asisonline.org/Pages/Rising-Seas.aspx2018-10-01T04:00:00ZRising Seas
https://sm.asisonline.org/Pages/A-Failure-to-Plan.aspx2018-09-01T04:00:00ZA Failure to Plan
https://sm.asisonline.org/Pages/A-World-of-Risk.aspx2018-09-01T04:00:00ZA World of Risk
https://sm.asisonline.org/Pages/Book-Review-Adaptive-Business-Continuity.aspx2018-09-01T04:00:00ZBook Review: Adaptive Business Continuity
https://sm.asisonline.org/Pages/Survey-to-Explore-Use-of-Mobile-Forensics-Technology.aspx2018-08-24T04:00:00ZSurvey to Explore Use of Mobile Forensics Technology
https://sm.asisonline.org/Pages/Book-Review--Business-Continuity.aspx2018-08-01T04:00:00ZBook Review: Business Continuity
https://sm.asisonline.org/Pages/The-Future-CSO.aspx2018-07-01T04:00:00ZQ&A: The Future CSO
https://sm.asisonline.org/Pages/Book-Review---Rebuilding-Resilience.aspx2018-07-01T04:00:00ZBook Review: Rebuilding Resilience
https://sm.asisonline.org/Pages/A-Safety-Strategy-on-Campus.aspx2018-06-01T04:00:00ZA Safety Strategy on Campus
https://sm.asisonline.org/Pages/Space-Jam.aspx2018-05-01T04:00:00ZSpace Jam
https://sm.asisonline.org/Pages/Risk-Rising.aspx2018-05-01T04:00:00ZRisk Rising

 You May Also Like...

 

 

https://sm.asisonline.org/Pages/A-Failure-to-Plan.aspxA Failure to Plan<p></p><p>A rare meteorological event occurred in 2017 when three Category 4 hurricanes were simultaneously ongoing in the Pacific Ocean. At the same time, wildfires swept across the western United States in California, Montana, and North and South Dakota.<br></p><p>Harvard climate expert James McCarthy indicated that "economic losses from extreme weather-related events are rapidly escalating," in an article for The Universal Ecological Fund.</p><p>Supporting McCarthy's finding, Swiss Re said in a report to its shareholders that "total economic losses from natural catastrophes and man-made disasters amounted to USD $175 billion in 2016, almost twice the USD $94 billion seen in 2015."</p><p>Global insured losses from disasters also totaled $54 billion in 2016, up from $38 billion in 2015, according to Swiss Re, a leading reinsurance company.</p><p>Yet many organizations continue to struggle with their emergency and crisis management plans. This article includes some case studies that provide insights into common challenges during an emergency and recommendations on how organizations can respond and recover, quicker.​</p><h4>Lessons Learned</h4><p>Recently, one of the authors was conducting a threat, vulnerability, and risk assessment for a large corporation on the East Coast of the United States. While at the corporation, the author met with the company's business continuity and emergency management director.</p><p>When asked about the company's emergency management program and response, the director produced a four-inch binder with a cover titled Emergency Operation Plan (EOP). </p><p>The director said the plan was developed by a consultant, who assisted in creating the National Incident Management System (NIMS) and the Incident Command System (ICS) framework, an operational protocol hierarchy that integrates public, private, and government resources to address domestic incidents across all phases of an emergency.</p><p>The EOP defined the scope of preparedness and incident management activities necessary for the organization. It described its organizational structure, roles and responsibilities, policies, and protocols for providing emergency support.</p><p>The plan was robust and capable of handling any type of emergency. The robustness of the plan, however, provided unfounded trust in the efficacy of response and presented some cognitive biases that were apparent when interviewing others beyond the director.</p><p>For instance, everyone interviewed knew of the EOP, but no one knew their role or how to activate the plan should an emergency occur. They relied on the director to provide that direction. </p><p>When the plan was tested, one of the authors introduced a wildcard element by removing the director from the response process. This drastically increased the response time of the organization and taught a lesson that the plan did not account for: staff redundancy. </p><p>The organization needed a more granular version of its response so employees and key members of the crisis management team would know how to activate it should the director be unable to do so.</p><p><strong>Communication. </strong>On August 23, 2011, in New York City shortly after 1:00 p.m. the high-rise building one of the authors was in began to sway. There was no communication about what was happening from building or security personnel.</p><p> A woman yelled out "it's happening again!" in a reference to 9/11, and people began to run to the stairwells to evacuate the building.</p><p>With the evacuation in full swing, an announcement was made: "A vibration has been felt in the building. Please stay at your location. More information will be provided."</p><p>Most people, however, had already begun to evacuate. They were determined to get out of the building and disregarded the message. The author on site remained in the building until another announcement was made over the public-address system that a 5.8 earthquake had occurred in Virginia and everyone should evacuate the building.</p><p>The author evacuated the building, stepped outside, and began to look for a mustering point. But the streets were flooded with people, making emergency vehicle access impossible and presenting a dangerous situation with the thousands of pounds of glass from the building above.</p><p>This incident demonstrates that if there is not clear communication during an event, people will act—and will encourage others to do so—possibly putting themselves in an even more dangerous position.</p><p><strong>Leadership. </strong>One of the authors had the opportunity to tour a critical infrastructure situational awareness room recently. The large facility was tiered like a movie theater, supporting floor-to-ceiling monitors that were concave to allow sightlines from within the room.</p><p>During a review of emergency operations, the author was assured that the response program was sophisticated and included redundancies in staffing technology. </p><p>"Has the building ever lost power?" the author asked, after which the room went dark. Emergency lights activated and everyone in the room began to look to others to take charge of the response.</p><p>Once time had elapsed, people gathered their thoughts, regained their composure, and transferred the critical systems to an off-site backup. The incident showcased the lesson that there will be a lapse in response time while people reference their crisis manual to find out who's in charge—creating overall recovery delays.</p><p><strong>Changes.</strong> For every emergency plan the authors have tested, one of the key lessons is that an emergency action and crisis plan is a continual work in progress. As threats change, the plan must continue to adapt.</p><p>One example of this lesson in action occurred at a California hospital five years ago. The hospital decided to conduct an active shooter drill with the help of its patients. However, it announced that it was conducting the drill by issuing a "code silver" over the public-address system.</p><p>The emergency department staff began to respond, but patients and visitors were confused because they did not understand what a code silver meant. To include participation in the drill, the hospital needed to more clearly communicate what was happening so patients and visitors could effectively respond.​</p><h4>Effective Response</h4><p>Based on the lessons learned from the authors' experiences of testing emergency response plans, they recommend organizations conduct fidelity testing of their incident management planning and training. This will help organizations apply the right level of scrutiny to their plans and actions.</p><p>Applying fidelity testing to incident response training and execution can incorporate simple, but effective, gap analyses of critical program and process design qualities. This testing will help stakeholders understand their level of preparedness and response orchestration.</p><p><strong>Validity. </strong>Check the validity of the original incident management plan. A review is the first step because the plan sets the framework for incident management and articulates all actions before, during, and after an incident—including training. </p><p>The plan should be based on a proven model, such as NIMS, and incorporate actionable, strategic, and tactical direction for each designated participant.</p><p>The organization should also look for gaps and assumptions made in the plan. For example, a specific role in the plan may be assigned to a functional leader but lack substantive direction for execution. Or, the designated leader may not have the right level of composure to execute his or her tasks under pressure.</p><p>If the plan needs to be updated to address these issues, the organization should make those changes before carrying out the full fidelity test. This is because the test will only work if the plan is comprehensive and actionable in terms of preparation, execution, and training requirements.</p><p><strong>Vigilance. </strong>Check the current level of responders' vigilant behavior. A qualitative method for determining an organization's level of preparedness is to observe how quickly designated responders can switch their mental processes and physical actions from a state of normalcy to a state of active response.</p><p>A simple way to test this is through a surprise, scenario-based activation of each responder who is then timed from initiation to completion of the test. These tests should be conducted at least quarterly, and organizations should determine whether the desired outcomes were achieved based on the presented scenario.</p><p>In turn, this will help each responder retain information about the test results and make improvements in smaller, more manageable increments.</p><p>After re-testing, organizations should report on implemented improvements and their scale as part of established metrics, such as overall achievement of desired outcomes, reduction of time for task and process completion, and retention of information.</p><p><strong>Training. </strong>Organizations should assess their current training by assessing the design, frequency, and knowledge retention of that training. It's important to determine whether existing training is actionable and produces desired outcomes from each participant with a minimum number of assumption gaps. </p><p>Good training programs will include a blend of interactive and practical content designed to be emotionally compelling for participants; interactive and practical exercises with the element of surprise; well-researched, relevant, and comprehensive training scenarios; and strict time parameters for completion of individual and team tasks.</p><p>Additionally, training programs should have metrics tied to gaps between demonstrated execution and desired outcomes, such as time to complete tasks and processes, as well as quality of task completion relative to desired outcomes.</p><p>Along with these characteristics, training programs should also include immediate post-exercise documented feedback with follow-up actions, and continuous improvement demonstrated through metrics.</p><p><strong>Simplify. </strong>Each responder should have defined parameters of their responsibility during incidents. A well-designed fidelity test will identify these parameters—dubbed sandboxing—to assess how each responder executes the plan in relation to them. </p><p>To assist with this process, it's useful to create flowcharts of each responder's assigned process. This will help determine three findings: whether assigned tasks of each responder are simple enough to execute and connect well with processes of other responders; the abilities of each responder in executing certain tasks; and what skill gaps responders can close on their own with help from others.</p><p><strong>Recognition. </strong>Skill gaps are like assumptions. When unknown or ignored, they often serve as the root cause of incident management failures. This is why it's important to identify skill gaps as part of a fidelity testing exercise.</p><p>This exercise will make it easier to uncover skill gaps. It is difficult for individual incident responders to objectively identify skill gaps on their own because of inherent psychological biases, such as confirmation bias, overconfidence, or timidity.</p><p>According to multiple psychological studies, humans learn better from the mistakes of others or when their mistakes are noted by friends and colleagues.</p><p>Identifying and mitigating skill gaps helps the entire incident management program and demonstrates the organization's commitment to improvement and resilience. When expressed statistically, the mitigation of skill gaps can help demonstrate the overall program's value.</p><p><strong>Technology.</strong> Another benefit of well-designed and executed fidelity testing is the identification and mitigation of gaps in technologies used for incident management.</p><p>One of the most trivial—but often overlooked—issues is secure and interoperable radio communication. There have been numerous incidents, including 9/11, during which radio communication failed because of physical and electronic interference or other factors. Because radios were not interoperable, no one knew what others were doing.</p><p>In addition to radios, various other technological tools can be analyzed to understand their individual and collective benefits and shortcomings. It is always a good idea to demonstrate gap reductions or eliminations, both qualitatively and quantitatively, because this is most directly relatable to senior leadership.</p><p>Re-test. It is a natural process to re-test incident management programs. The key is to build habits for continual improvement because the main objective is to achieve optimal orchestration of human and technological performance during training and real incidents with minimal assumptions and skill gaps.</p><p>Real orchestration occurs when these components are present: a validated, justifiable, and actionable plan; scenario-driven, relevant, and frequently administered training that's timed and entails emotionally compelling interactive and practical content; continual program improvement; and meaningful metrics related to desired outcomes.</p><p>Incident management is best achieved through orchestration of individual components and responders and technology. Today, many organizations continue to struggle with achieving orchestration because of unaddressed skill gaps and assumptions in their planning. But this can be addressed and prevented in the future through fidelity testing. </p><p>"If you fail to plan, you are planning to fail," said Benjamin Franklin, and emergency and crisis management plans are no exception. </p><p>A well maintained and trained emergency management plan can provide significant dividends in recovery. Given the natural—and man-made—challenges ahead of us, emergency planning should be a staple in every organization.   </p><h4>​Sidebar: Reasons for Failure<br></h4><p>​There are many reasons that emergency response plans fail. Below are some examples of problem statements that can contribute to failure.</p><p><strong>It won't happen to me.</strong> People often fail to recognize that a crisis can happen to them, and organizations are no different. People and organizations tend to be concerned with large ever-changing threats, while forgetting more closely related operational issues.             </p><p>L<strong>oose plans without governance, leadership, or skills. </strong>Many emergency plans are check marks for organizational certifications or accreditations. They are handed down by the board or C-suite without a complete understanding of organizational resources and the total economic impact of creating a well-orchestrated and functional plan. ​When a formal security organization does not exist, the edict and direction of the plan will fall to an existing employee or department, who may hire a consultant or conduct an online search to cut and paste a plan that is not relevant or applicable to the organization.</p><p><strong>Too much information.</strong> Emergency plans are not simple. And for large organizations, they can be lengthy and create information overload that increases the time it takes to respond to an incident.</p><p><strong>Lack of training.</strong> Live action drills can be costly and create productivity challenges. Organizations have taken to Web-based learning, which exacerbates the problem because employees rush to get through the training, often retaining little of what they have learned. However, the organization obtains a mark for conveying the information and considers itself prepared.</p><p><br></p><p><em>Ilya Umanskiy, PSP, RAMCAP, MA, is founder and principal at Sphere State, Inc. Sean A. Ahrens, MA CPP, CSC, FSyl, is security market group leader for AEI/Affiliated Engineers, Inc., and specializes in threat assessment, crisis management, and security systems design. He can be reached at sahrens@aeieng.com.</em></p>GP0|#28ae3eb9-d865-484b-ac9f-3dfacb4ce997;L0|#028ae3eb9-d865-484b-ac9f-3dfacb4ce997|Strategic Security;GTSet|#8accba12-4830-47cd-9299-2b34a4344465
https://sm.asisonline.org/Pages/A-Shift-in-Global-Risk.aspxESRM: A Shift in Global Risk<p>​The quest to better understand the sources of global risk, and the effect those sources of risk may have on security, is of continuing importance to many practitioners of enterprise security risk management (ESRM). </p><p>And now, global risk has entered into a new era, with people around the world facing more political instability, more economic challenges, and the prospect that more national policy decision making will be driven by emotion rather than reason, a new study finds. </p><p>The study, The Global Risks Report 2017, is the 12th edition of one of the flagship reports issued annually by the World Economic Forum. The report postulates that the new era of risk began last year, a watershed time for instability when increasing economic populism and political polarization came to a head in unexpected election results and the disquieting rise of former fringe nationalist parties. </p><p>“The year 2016 saw profound shifts in the way we view global risks. Societal polarization, income inequality, and the inward orientation of countries are spilling over into real-world politics,” reads the study, which was conducted with the help of academic advisors from the University of Oxford, the National University of Singapore, and the Wharton Risk Management and Decision Processes Center at the University of Pennsylvania. </p><p>The report argues that five “gravity centers” will shape global risks moving forward, and it sketches out the challenges that will result from each of them.  First, continued slow economic growth, in tandem with high debt and demographic changes, will create an environment conducive to financial crises and growing inequality. Second, corruption and unequal distribution of the benefits of growth will convince a growing number of people that the current economic model is not working for them.</p><p>Third, the transition towards a more multipolar world order will put a greater strain on global cooperation. Fourth, the fourth industrial revolution—Internet-connected technologies—will continue to transform societies, their economies, and their ways of doing business. Fifth, more people will seek to reassert identities that have been blurred by globalization, so decision making and election choices will be increasingly influenced by emotions rather than reason.</p><p>There is no one silver bullet solution to these challenges. But the report argues that the problems “create the opportunity to address global risks and the trends that drive them.” In that spirit, the study sets out several actions that leaders should take to push forward in creating a more secure and stable world. </p><p>The report argues that political leaders need a deeper commitment to fostering inclusive development and equitable growth, on both a national and global scale, instead of allowing increasing economic inequality to further destabilize societies. And while the report praises innovation, it also argues for better management of technological change, so the growth of new uses for technology causes less disruption and leaves fewer behind. </p><p>Finally, at a time when multinational institutions like the European Union and NATO are under unprecedented attack, the report calls on leaders to redouble efforts to protect and strengthen systems of global collaboration. Destabilizing international events—which range from migration flows created by the Syrian war to major weather events that impact several countries to a potential global water crisis—all warrant more cooperation between countries.  </p><p>“It is ever clearer,” the report argues, “how important global cooperation is on the interconnections that shape the risk landscape.”</p>GP0|#28ae3eb9-d865-484b-ac9f-3dfacb4ce997;L0|#028ae3eb9-d865-484b-ac9f-3dfacb4ce997|Strategic Security;GTSet|#8accba12-4830-47cd-9299-2b34a4344465
https://sm.asisonline.org/Pages/How-to-Build-a-Culture-of-Security.aspxHow to Build a Culture of Security<p>​<span style="line-height:1.5em;">“</span><span style="line-height:1.5em;">Security is everyone’s business” may be a popular truism in the industry, but how many security managers can honestly say this philosophy is practiced by their companies? Some organizations have regular incidents in which employees simply disregard security rules and regulations. Sometimes, even the leaders of a company will disobey security and safety rules out of a sense of entitlement—these rules are for employees, not executives.</span></p><p>These lapses can be costly. It is only when everyone associated with the company adheres to and executes security rules and practices on a daily basis that a firm can credibly claim that it maintains a true culture of security.    </p><p>To determine whether a company encourages an effective security culture, company leaders should start by determining whether it adheres to the appropriate best practices. The security department should develop and communicate security rules, practices, and procedures to employees, contractors, visitors, and vendors. Executives must lead by example and follow all security practices and procedures. Employees must take care of their security responsibilities at work, such as locking their work spaces and computers or asking to see a badge of a person in a secure work area instead of simply holding open an outer perimeter door for a stranger to be polite.   </p><p>If an organization follows most of these procedures, it maintains a robust culture of security. If not, the best practice advice and solutions stated below can be used by security leaders to strengthen security awareness in their companies and develop a culture of security. ​</p><h4>The Assessment</h4><p>A culture of security can only be built on a solid foundation. And that foundation is an effective security program. </p><p>However, if the security program is perceived as inconsistent or unprofessional, an initiative to build a culture of security around it will be doomed from the start. Thus, it is imperative to conduct an initial assessment of the security program to evaluate past security practices and present security operations. </p><p>The assessment must include, but should not be limited to, the following methodology:</p><ul><li><span style="line-height:1.5em;">Conduct interviews with security staff to determine past practices and to engage them in the assessment process.</span><br></li><li><span style="line-height:1.5em;">Review and evaluate existing documents regarding past security missions.</span><br></li><li><span style="line-height:1.5em;">Review and evaluate security staff job descriptions.</span><br></li><li><span style="line-height:1.5em;">Review and evaluate security current procedures, processes, and guidelines. </span><br></li><li><span style="line-height:1.5em;">Review and evaluate the security budget to ensure that it is in line with the mission, and that funded programs are not obsolete.</span><br></li><li><span style="line-height:1.5em;">Spend time working directly with all security staff to obtain first-hand knowledge regarding daily duties. Get to know your people.</span><br></li><li><span style="line-height:1.5em;">Review and evaluate any compliance tasks that have been assigned to security.</span><br></li><li><span style="line-height:1.5em;">Review, evaluate, and coordinate security requirements with heads of departments with security cross-functionality. Conduct collaborative meetings with other department heads and staff on their opinions of security.</span><br></li><li><span style="line-height:1.5em;">Obtain input from executive management on its vision of security.</span><br></li><li><span style="line-height:1.5em;">Define and document your company-specific security missions.</span><br></li><li><span style="line-height:1.5em;">Review the security requirements within these missions and analyze them for potential mission creep.<br></span><span style="line-height:1.5em;"> </span></li></ul><h4>The Blueprint</h4><p>Once past and present security operations have been assessed, organization leaders can plan for the future by improving and refining, based upon the factual analysis that has already been completed.</p><p>The first part of the blueprint process is to develop missions and objectives. This includes enlisting management for direction and involvement and establishing security goals and engaging security team members in ways to accomplish them. This part of the process also includes documenting security mission statements and assigning a leader to each one. These leaders must be capable and willing.</p><p>The second part of the blueprint pro­cess is to standardize operations and document these procedures in a manual of operations. This manual will serve as a central repository of security standard operating procedures and processes that cover core duties and responsibilities throughout the company. </p><p>Once the assessment is completed and the blueprint is in place, security managers must ensure that key attributes of the program are successfully maintained. These attributes include consistent pro­fessionalism, first-rate training and com­munications, a commitment to the program from upper management, and procedures designed to address violations.​</p><h4>Professionalism</h4><p>Professionalism is a crucial component of a strong security culture. The professional security staff and security officers should be a model for the organization’s general population. High standards of conduct should be set; staff and officers should be evaluated; and problems should be weeded out. Most important, security department leaders should live those high standards to set an example for others to follow. </p><p>Specific best practices can ensure that staff members and officers consistently project a strong level of professionalism to other company personnel. One of these is presence. Uniforms, if worn, should be consistent. Officers should engage all persons entering the facility with eye contact. Officers should not be texting or talking on their cell phones, or congregating in an area to smoke and joke.             </p><p>Security leaders must also be careful to prevent “mission creep,” or assigning nonsecurity duties to security personnel. This may distract security staffers from their core duties, to the detriment of the organization’s security culture.  </p><p>For example, one company used the security department to conduct security training as well as training in legal issues, compliance, and ethics. Security’s training duties also included tracking of annual requirements for all of the compliance-based training, for both employees and nonemployees. The two training avenues, employee and nonemployee, were not standardized between departments. Because of the lack of standardization, there were two completely different methods of administering, developing, and tracking training.   </p><p>In this case, the solution was to clearly define the security and human resources missions at the company. Once defined, human resources assumed control of the entire company training program and standardized the administration of training. Security was responsible only for content of any security-related training.​</p><h4>Training</h4><p>A strong security culture requires an effective training program for both existing and future security personnel. In addition, the process should ensure that security personnel are cross-trained in security position responsibilities and missions, to eliminate the potential for gaps in coverage should a critical team member be unavailable. </p><p>For example, if a company’s security missions are asset protection, compliance, and physical access control, the manual of operations would contain a section of step-by-step procedures and guidelines for each. This would allow the asset protection specialist to cover for the physical access control specialist for certain tasks, such as issuing badges, instead of waiting for the access control specialist to return. </p><p>In addition, companies should pay close attention to the processes and standards for granting and tracking access that are documented in the manual of operations. This can be an issue if companies have manual, cumbersome, or archaic methods for granting access. At many companies, this is an area that needs to be addressed. The granting of physical access should be automated to an electronic format.​</p><h4>Communication</h4><p>Communication is one of the critical keys to success in any security program, and it will be part of every component of the program. From the initial assessment of the program to the final phases of the implementation of blueprint plans, all affected parties should be kept informed and aware of the security program and how it will impact their operations at work.  </p><p>One company initiated a report that was sent twice a month via e-mail with the facts of any security incidents, so executives could track important issues. This communication also allowed security to remain within the scope of the executives while maintaining a successful program. As security expanded and implemented new initiatives, these were included in the bimonthly report. </p><p>For their part, the executives of the firm should be involved and engaged early on in the communications effort. Security should offer concise presentations, such as a PowerPoint presentation, that explain how the company benefits from the security program, be it through incident prevention or the preparedness to react and minimize negative impact to the company’s operations. Security goals, objectives, operations, procedures, and mission statements should be effectively communicated across the corporate footprint. Executives should understand the security role in their company and communicate their support for security programs to all company employees.  </p><p>Within the chain of command, the security leader must develop a system of communication to keep executives aware of the challenges faced by the security department and of the programs currently being used to protect the company’s physical assets. For example, at one company I worked at, security mandated monthly luncheon meetings with staff.</p><p>Company executives were also invited to these meetings, which they attended periodically. I documented each of these meetings in formal memoranda, including progress made on issues from the prior month, issues resolved, and problems currently being addressed. These memos were sent up the chain of command for executive review.  </p><p>Annual security awareness training is another effective communications tool. By delivering accurate, updated, and simple instructions regarding security rules, policies, and procedures, the company can effectively ensure that its workforce has been periodically exposed to security standards and the roles and responsibilities in daily operations. Security awareness posters that are updated quarterly can also help in communication efforts.   </p><p> Finally, do not underestimate the power of word of mouth. For any company, there is no stronger security tool than having a workforce that is security- minded and well informed of current security policies, procedures, and daily practices. ​</p><h4>Violations</h4><p>Even with a well-established culture of security, violations of an organization’s security policies will occur.   </p><p>There are slips and breaches even in the most secure environments—some caused by intentional acts; some unintentionally, through malaise or misfortune. And while the people who work for an organization are its greatest asset, they also can be its greatest vulnerability if they decide to inflict harm. They know how the organization operates, and they can circumvent the most sophisticated security systems.  </p><p>For private industry, the enforcement of security program policies requires a company to be fair, firm, and consistent. Take, for example, a company that has a clear security rule that all visitors must be escorted by the company representative who is responsible for the visitor while on premises. If a visitor is found roaming around by himself in a secure area, the employee who brought the visitor to the property should be disciplined.  </p><p>And the discipline should be consistent, whether the employee is the CEO or the janitor. The enforcement should be documented and tracked, to monitor patterns of behavior. If the violation is severe enough that it results in a loss of property or affects employee safety, the matter should be referred to the violator’s manager for evaluation and possible further action. </p><p>Consistent and fair enforcement of the rules across the entire organization will further solidify a culture of security. It will demonstrate that security matters to the organization, and that it plans to ensure that the rules are followed. To expand on an earlier example, if the CEO forgets his or her access badge and either goes home and gets it or signs for a temporary one, the standard is set at the highest level of the company.  </p><p>In the end, success in developing a culture of security at your company will mean the organization has established a robust, comprehensively assessed, and documented security program across the enterprise. Executive leaders are meaningfully engaged, and everyone is educated in the program’s components and follows them. </p><p>--<br></p><p><em><strong>Thomas Trier</strong> served for 25 years as a special agent of the FBI, where he attained the rank of assistant special agent in charge in the intelligence branch of the FBI’s Washington Field Office. Trier has also served as the leader of corporate security for a Midwestern electrical transmission-only utility company. He now provides advisory services through Security Intelligence Consulting L.L.C.</em></p>GP0|#28ae3eb9-d865-484b-ac9f-3dfacb4ce997;L0|#028ae3eb9-d865-484b-ac9f-3dfacb4ce997|Strategic Security;GTSet|#8accba12-4830-47cd-9299-2b34a4344465