Physical Security Strategy and Process Playbook

John Kingsley-Hefty

• Publisher: Elsevier
• Year: 2013
• ISBN:
  9780124172371
• Topic: Sciences sociales
• Subtopic: Criminologie

The Physical Security Strategy and Process Playbook is a concise yet comprehensive treatment of physical security management in the business context. It can be used as an educational tool, help a security manager define security requirements, and serve as a reference for future planning.

This book is organized into six component parts around the central theme that physical security is part of sound business management. These components include an introduction to and explanation of basic physical security concepts; a description of the probable security risks for more than 40 functional areas in business; security performance guidelines along with a variety of supporting mitigation strategies; performance specifications for each of the recommended mitigation strategies; guidance on selecting, implementing, and evaluating a security system; and lists of available physical security resources.

The Physical Security Strategy and Process Playbook is an essential resource for anyone who makes security-related decisions within an organization, and can be used as an instructional guide for corporate training or in the classroom.

The Physical Security Strategy and Process Playbook is a part of Elsevier's Security Executive Council Risk Management Portfolio, a collection of real world solutions and "how-to" guidelines that equip executives, practitioners, and educators with proven information for successful security and risk management programs.

• Chapters are categorized by issues and cover the fundamental concepts of physical security up to high-level program procedures
• Emphasizes performance guidelines (rather than standards) that describe the basic levels of performance to be achieved
• Discusses the typical security risks that occur in more than 40 functional areas of an organization, along with security performance guidelines and specifications for each
• Covers the selection, implementation, and evaluation of a robust security system

Chapter 1

Physical Security Concepts

In Chapter 1: Physical Security Concepts, we are introduced to three fundamental concepts of physical security, which include assessing the security risks to your business; zones of protection; and the components of a security system: barriers, technology, procedures, and people. An overall assessment of the security issues relating to your business operations—your people, information, property, product, and the corporation’s reputation—is necessary to identify the security needs of your business. When conducting this assessment, the author explains that the three elements of security should be applied: probability, criticality, and vulnerability. With these concepts in mind, the chapter continues with instructions on how to conduct the security assessment and arrive at a determination of your organization’s security risks. It also discusses the components of a security system and the way to integrate the system with existing business processes.

Keywords

Security goals; security assessment; zones of protection; probability; criticality; vulnerability; risk; access control; performance guidelines; physical barriers; system planning; system implementation

1.1 Before you Begin

Before you implement any physical security measures, you should understand the fundamental concepts in three areas. These areas are:

1. Assessing the security risks to your business.

2. Zones of protection.

3. Components of a security system: barriers, technology, procedures, and people.

As you work through the concepts in each of these areas, you will be able to answer the basic physical security questions: What is the goal of my current system? Is my system accomplishing its objectives? Why or why not? What, if anything, do I need to change? Are there other ways I can meet my goals?

1.1.1 What are your Security Goals?

Before you begin assessment of your security system, you need to know your security goals. All of your security activities should support these goals. If you don’t have a clear understanding of your goals, you will not be able to implement a cost effective system that meets your needs.

A clear statement of your security goals is usually built on answers to questions like the following:

• Do I want to correct a problem or reduce a potential risk?

• Do my proposed solutions address the needs that I have identified?

• Are my solutions consistent with the business culture?

• Will the solutions hinder business operations?

• Will the solutions enhance security performance guidelines for the business?

• Is new technology part of the solution?

• Is the new technology consistent with the long range plans of the business?

1.2 Assessing the Needs of your Business

Physical security must make sense within the context of your business operations. In order to build a security system that works for any business, the needs of that business must first be assessed.

At the core of this assessment are the following operational issues:

• What is the general level of risk for this business?

• What are the critical events that will stop this business?

• What are the products, information, and assets at this site? What specific risks are associated with each of them?

• How do people and materials enter and leave?

• What are the work schedules?

We often recommend a security assessment as the first step in assessing the needs of your business. This helps you arrive at an overall assessment of the security issues relating to your business operations—your people, information, property, product, and the corporation’s reputation.

In order to use a security assessment properly, you first need to understand the three fundamental elements of security: probability, criticality, and vulnerability. The next section describes how an effective security assessment is based on these three concepts.

1.2.1 Elements of Security

An effective security assessment applies an understanding of the fundamental elements of security to a particular location or area within the business. As you look at each area, you must consider the following questions:

• What is the probability of a security-related incident occurring in this area?

• How critical might the incident be to my business operations?

• How vulnerable is the area to a security incident?

Answers to these questions help you to arrive at an assessment of the level of security risk associated with a particular area of your business.

1.2.1.1 Element 1: Probability

Probability is the likelihood that a security incident will occur, independent of any effort you may make to avoid the incident. Probability is affected by factors such as your location and environment, your product, the personnel at your site, and other factors that are essentially beyond your control.

For example, if your facility is located in a high-density area of a large city, the probability of parking lot incidents and vandalism is much greater than if your facility is located in a small rural town. Or, if you use a proprietary process or have proprietary information that has a high market value, you are more likely to have theft attempts than if you don’t use such a process or possess such information.

As you perform a security assessment, keep in mind that each area of your business must be evaluated in terms of the probability that security incidents will occur there. As you assess each area of your business, make a list of the most frequent incidents that have occurred in your building, at your location, and in the surrounding area or neighborhood.

1.2.1.2 Element 2: Criticality

The criticality of a security incident is the degree to which it affects your ability to do business. An incident with high criticality is one that:

• Interrupts your business operations;

• Has significant operational or legal ramifications;

• Impacts or reduces sales;

• Erodes the quality of your products or services;

• Gives the competition a significant advantage;

• Causes the loss of substantial revenue; and/or

• Damages the corporation’s reputation.

As you assess each area of your business, make a list of the security incidents that could have a high degree of criticality.

1.2.1.3 Element 3: Vulnerability

Vulnerability is a measure of your ability to prevent a security incident. Your current security system and procedures represent the active steps you’ve taken to decrease your vulnerability.

Vulnerability is a dynamic concept. It changes whenever your environment, operations, personnel, business and/or systems change. Each time a substantive security-related change occurs in an area of your business, you need to reconsider your vulnerability in that area.

As you assess your business, keep track of the things that make it easier to reduce the likelihood that an incident will occur, as well as the ones that make it more difficult.

1.2.2 Combining the Three Elements of Security to Arrive at an Assessment of Risk

The most cost-e...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright
• Executive Summary
• Introduction
• Chapter 1. Physical Security Concepts
• Chapter 2. Functional Areas and Security Risks
• Chapter 3. Security Performance Guidelines and Options
• Chapter 4. Performance Specifications
• Chapter 5. Systems Implementation and Evaluation
• Chapter 6. Physical Security Resources
• About the Contributing Editor
• About Elsevier’s Security Executive Council Risk Management Portfolio