Strategic Security

Forward Thinking for Successful Executives

Jean Perois

• Publisher: CRC Press
• Year: 2019
• ISBN:
  9781351123440
• Edition: 1
• Topic: Negocios y empresa
• Subtopic: Gestión

Strategic Security will help security managers, and those aspiring to the position, to think strategically about their job, the culture of their workplace, and the nature of security planning and implementation. Security professionals tend to focus on the immediate (the urgent) rather than the important and essential—too often serving as "firefighters" rather than strategists. This book will help professionals consider their roles, and structure their tasks through a strategic approach without neglecting their career objectives.

Few security management books for professionals in the field focus on corporate or industrial security from a strategic perspective. Books on the market normally provide "recipes, " methods or guidelines to develop, plans, policies or procedures. However, many do so without taking into account the personal element that is supposed to apply these methods. In this book, the authors helps readers to consider their own career development in parallel with establishing their organisation security programme. This is fundamental to becoming, and serving as, a quality, effective manager. The element of considering career objectives as part-and-parcel to this is both unique to only this book and vital for long-term career success.

The author delineates what makes strategic thinking different in a corporate and security environment. While strategy is crucial in the running of a company, the traditional attitude towards security is that it has to fix issues quickly and at low cost. This is an attitude that no other department would tolerate, but because of its image, security departments sometimes have major issues with buy-in and from top-management. The book covers the necessary level of strategic thinking to put their ideas into practice. Once this is achieved, the strategic process is explained, including the need to build the different steps into this process—and into the overarching business goals of the organisation—will be demonstrated. The book provides numerous hand-on examples of how to formulate and execute the strategic master plan for the organization. The authors draws on his extensive experience and successes to serve as a valuable resource to all security professionals looking to advance their careers in the field.

1

Thinking Strategically in a Corporate Environment

In ancient Greece, strategoi were army generals cum politicians, whose task was to run the internal and external politics of the myriad of city-states dispersed in the Peloponnesian Sea. The famous Pericles (495–429 BC) and also the great historian Thucydides (460–395 BC) were among strategoi who marked the history of the Ancient Greek world. The word means “army leaders,” and these army leaders played a major role in the political life of the Greek cities in times of peace and of war. Their role was military as well as political, and it should therefore come as no surprise that the word led to the word strategy, first defined as the art of planning and directing military operations and then in a business context as a plan of action or policy designed to achieve a major aim.

In the security industry, as in any other branch of business, strategic thinking can be defined as the ability “to plan long-term while maximizing performance for the short term” (Bruce 2000: 5).

In this chapter, I am going to discuss the basic components of strategic thinking when applied to security:

• Understanding what strategy is;

• Analyzing your position;

• Planning a strategy;

• Implementing a security program.

UNDERSTANDING STRATEGY

A strategy is a declaration of intent, a statement of where you want to be in the medium to long term (traditionally the 5-year horizon is the minimum target). A strategy is important because it enables you to make sure that “day-to-day activities fit in within the long-term program of your organization” (Bruce 2000: 6). A strategy encourages everyone to work together to achieve common aims. Most companies have a strategic plan, but they often fail to communicate it to the lower echelons, where you are now sitting as head of security or security manager. As a newly appointed security manager, your first task will be to become acquainted with the strategic plan of your company.

Defining a strategy is an important first step. It has been said time and again that a security strategy must be in line with the organization’s corporate strategy. However, if you have been given the opportunity to see a corporate strategy document, you know that it is extremely difficult to develop a security strategy from a business program! Security is traditionally conspicuously absent from business strategy documents and you are therefore left on your own to devise something that should not antagonize the projects and growth anticipated by the finance people at corporate level.

Strategy concerns itself with what will happen in the medium to long term. Five years is traditionally considered as the minimum target of a strategy, but really this decision remains your call. Day-to-day activities tend to take precedence over long-term planning, and this is fine, provided the long-term strategy does not take a back seat. Strategy needs to be communicated to all who need to know, both internally (the security department) and externally (the rest of the organization).

THE STRATEGIC PROCESS

There are three distinct phases to developing a new strategy: analysis, planning, and implementation. The importance of the first two cannot be emphasized enough, as I have noticed in my career that security managers are not often given second chances: you must strike right the first time. In order to do this, you must get the first two stages absolutely right (Figures 1.1 and 1.2).

Let us begin with the analysis of the current situation.

Figure 1.1 The strategy development process.

Figure 1.2 Stage 1: Analysis.

Stage 1. Analysis

Data Collection

To analyze data, you need to collect them first. It is important during this phase to collect as much information as possible regarding your organization and the current state of the security that is supposed to protect its assets (policies, plans, procedures, nature and number of tangible and intangible assets, etc.). Before you change anything in the security master plan, you need to understand what role security plays in the protection of your organization’s assets (people, processes, assets, and information) and to understand what management’s expectations regarding your department’s performance are. You may want to know:

• What characterizes the existing security in your organization? Think first about the impression it projects to employees and to external observers. Is it discreet, overwhelming, sophisticated, with a lot of technology involved, friendly? What does it look like? What corporate image do security officers project: robust, friendly, well groomed, or could do better? Does the security in general (personnel, procedures, and technology) provide reasonable deterrence? How does it compare with security departments you have observed elsewhere or worked for in the past?

• How do employees perceive it? This is of course linked to the previous questions. And you generally cannot perceive quickly what employees feel about security. After all, you are their chief, and they will not want to be the ones who told you how unloved security people are in the company. The shoot-the-messenger syndrome is very much present in many organizations. It will be your job to observe—particularly during the 30 minutes during which employees and cars arrive at the company and reach their offices in the morning—to get a feel for the relationship between employees and security personnel. You can also sit in the lobby and observe the morning arrivals. This is always very instructive. Are people trying to avoid using their badges, are they friendly with the guards and receptionists? Can you observe piggybacking¹ or tailgating, or if you have been spotted, embarrassed behaviors?² What happens to the offenders, if caught? How do the security guards react, if they do? How do the caught-in-the-act offenders react? These small incidents always tell you a lot about the perception of security and the discipline of both the workforce and your staff.

• What do you think the management expects from security? This is indeed a very important question. It often happens that the new security manager does not meet the top people who know what they want from security. Apart from a quick, informal discussion with the chief executive officer (CEO) or the general manager (GM), the security manager is often entering her office on Monday morning with not much clue about what is expected of her. There are several possible situations. One, it could be that you are the first security manager hired by the management. Ask yourself: Why is that so? What may have triggered this sudden need for more than a few guards managed by the facilities department? There may have been incidents; a merger with a more security-conscious organization may have taken place, there may have been a change in hierarchy or in priorities, etc. You need to get an answer to that question. Speak with colleagues at human resources (HR), health safety and environment (HSE) to get answers. It is important to understand whether you are here to satisfy an administrative requirement, or because recent events have created some anxiety in the organization’s leadership. This happened to me when I was hired as the first director of security of the then biggest gas project in the Middle East in 2004. The project phase had been ongoing for 2 years, the construction of the gas plant was well advanced, and the pipelines were already buried underground or laid at the bottom of the sea when I was appointed. It took me quite some time to understand the numerous and complex reasons that motivated my nomination. Some were political, a few were technical, and most had to do with the complex relationship between stakeholders in the project and the relative and always changing balance of their power. And, as you most likely have already guessed, these stakeholders pursued different security agendas. All converged toward an end result in which the assets composing the gas project were to be secured, but each stakeholder had a very specific idea about what constituted assets, and the way they should be protected. Anyway, if you are the first security director in a project, sit back, observe, think, and brace yourself for a complicated future. There must be some serious thinking from your side about who you are going to serve—one cannot serve several masters well—and what is expected of you. This does not mean that you will do different things as far as your asset protection plan is concerned, after all, industrial and corporate security is a simple art, but internal politics will definitely impact the way you will implement company security policies, as well as how they will be prioritized and above all perceived. More importantly, you will have to think very seriously about the cultural aspects of security, and the perception of it by people coming from cultural backgrounds radically different from yours and those who often see security not as a bonus, but rather as a personal hindrance. You do not have too much time for this reflection. Do not forget that to establish yourself, you will have to implement some visible and tangible security measures quickly. Think that your appointment might have been a complicated issue, that some top managers may have had their own favorites, and that many people in your organization are far from convinced that a security department is a business necessity. To this end, I know that some of you will tell me that part of your brief, as security executive, is to educate management about what security entails, to help them differentiate between what is important and what is necessary, and I appreciate this commitment, but the reality is that management is usually very ignorant of what security is and that you will have to gain credibility before you have a chance to educate your hierarchy. And let’s face it: Most of the time, they are not interested.

• How do other competitors operate in comparable environments? There are two ways to embrace this. (1) Your first possible approach is based on your experience. During the course of your career you may have worked in different environments and in different capacities. You have learned lessons and observed good setups and not so good ones. You have an intuitive feeling about what good security should look like and you can measure what you see according to what you saw elsewhere, that worked. (2) The second approach consists of measuring security by benchmarking what you see with what others do in the same industry. Doing this is sometimes easy, particularly when your facility is located in an industrial city, where neighbors operate very similar type of facilities in a shared environment. Chances are quite high that security meetings for security departments from the entire city are already organized to discuss threats, recent incidents, new trends and possible collegial solutions. Of course, it is a bit more difficult if you are new to the industry or if your facility is geographically isolated. For example, when I moved to my first assignment in the oil and gas industry, I had no previous knowledge of how security works in such environment. But the fact is that security, if it is never exactly the same, is based on the same premises, making env...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Table of Contents
• Preface
• About the Author
• 1 Thinking Strategically in a Corporate Environment
• 2 Selling Your Security Program to the C-Suite
• 3 Building and Implementing the Security Program
• 4 Measuring the Security Program
• 5 Maintaining the Security Program: Awareness, Training, and Audits
• 6 Personal Strategy: A Crash Course in Self Development
• 7 Creative Thinking and Security
• 8 Summary
• Index