Technology risk assessments

August 2018 Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)

In all cases, whether formally or informally, the security operation is developed around understanding the risks in each situation we face. When an incident takes place, the risk becomes more defined and the security plan is adjusted accordingly.

Rob Anderson, Adamastor Consulting.
Rob Anderson, Adamastor Consulting.

It is unfortunate that this adjustment is mostly undertaken as an emotional and reactionary response rather than a calm analysis of facts and a follow-on solution. An example would be a first reaction to a burglar finding a weak link in the physical security of the estate. Those in charge would be embarrassed that it could have occurred at all, and a great deal of rushing around would take place to fix the problem. It is understandable, and it is human nature.

This is all to do with monitoring risk, associated with the barriers and physical security that you can see. We can all see a hole in the fence, but this is the age where so much of the security operation relies on electronics. The ‘holes’ are embedded in the electronic systems. The electronics reduces costs, and if correctly implemented, should introduce efficiencies into the system. However, how do we know when a ‘hole’ develops or a loophole in the electronics is found by one whose intentions are not good?

It is important to realise there is a risk associated with the electronic solution as well. This can only be detected by the technology team, but their focus and training is electronics and they are not necessarily security risk experts.

Physical and technology risks

This leads to the point that we should be undertaking security risk assessments that look not only at the physical elements, but the technical elements too. One of the very first examples, which criminals very soon took advantage of, was to move the obvious CCTV camera or place a hat over it. The evidence that the CCTV would have collected becomes unavailable. In response to this, many manufacturers added alarms to the signal stream from the camera. They were recorded as ‘Camera Moved’ or ‘No Video’, to alert the security personnel.

I am not sure if these alarms are still available. It remains a risk however, because in many cases a camera mounted in a lower position provides better surveillance. We are then back in the ‘easy to get to’ zone. This is perhaps a physical rather than an electronic risk, although it affects both solutions, but things have moved on from this start and criminals have become more sophisticated as technology progressed.

The question is now: How do we assess the risks in the technology solution? These risks can probably be divided into two types.

1. A system failure that was not expected and cannot have been predicted. There must be procedures in place to recognise this type of failure and have a planned response which can be speedily implemented.

2. A badly designed, installed or maintained system that is slowly or sometimes, quickly, heading for failure. These are usually more severe than the first one, as whole sections of the installation often need to be replaced.

The technology risk assessment

As an example, the technology risk assessment should be based on the evaluation of the following criteria:

1. What is the purpose of each component of the technology solution and is it performing the task required?

2. Has the system design covered all the eventualities?

3. Are all components of the electronic solution correctly installed, secure and being adequately maintained?

4. Is there any known method of by-passing the electronic system so that it is prevented from performing the task for with it was installed?

5. Are there documents available to assist technicians in fault finding and as an aid to understanding the functioning of the system?

6. Is there any information available from other estates where the same problem has arisen? This problem may have occurred before and a solution may be available.

It is clear, that assessing risk is important. The task is, however, of little benefit unless it is undertaken in a very structured manner. What would this be?

It is probably a good idea to start my making a check list for the full estate electronic security installation. The check list needs to address each of the systems and their component parts. In addition, it should look at the overall management of the technology solution. This would typically include reporting, maintenance, spares and system age. It could be that the electronics has reached to end-of-life stage. The list will grow as more assessments are done and it becomes clear that it would be beneficial to go into more detail. As the assessment takes place, each item will be categorised as follows:

1. All good

2. Problems detected

3. Have no idea

Clearly items 2 and 3 will require a decision to be made on the remedial measure and its implementation. If you have “no idea”, then an expert needs to be contacted to assist. This is often the case when you are considering items such as computer equipment, database management and protection against hacking threats to the system.

A structured approach

In following a structured approach and remedial treatment what sort of items should form part of the list? Some are listed as follows:

1. Does the control room check that all cameras are functioning and recording on every shift?

2. Is the backup of data taking place correctly every day?

3. Are all the backup power supplies healthy?

4. The after dark CCTV images should be checked. Are they good enough to be of value to the security operation?

5. Are the access control cameras all pointing in the right direction?

6. Are the cameras which have an analytics facility still operating as intended?

7. Is there still a voltage on the electric fence? If the energiser loses power does an alarm alert the control room?

8. Is the control room vulnerable to attack? This would include criminals easily taking over the control room. This becomes ever more important as criminals seem unafraid of using force.

9. Are all staff properly trained in the use of the electronic systems?

10. Undertake mock incidents and check if the systems function correctly, the staff respond correctly and the data can be interrogated to prepare a report.

The overall aim is to find out any possible reason for the technology system letting you down. As can be seen, this could be product failure, system design failure, lack of information available to maintain the system properly and lack of information to implement a recovery from a possible catastrophic failure.

The process must be ongoing, and the non-technical staff should become involved and take part. In this way they will become more valuable to the operation as they develop an understanding of the systems they are using.

Remember, you would not drive your car with tyres that are completely worn out. It is a terrible risk from all points of view. With this in mind, don’t run a security operation with all sorts of lurking risks.


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Putting secondary storage to work
September 2019 , IT infrastructure, Security Services & Risk Management
By 2022, more than 80% of enterprise data will be stored in scale-out storage systems in enterprise and cloud data centres, up from 40% in 2018.

ContinuitySA offers Complete Continuity Practitioner in October
September 2019, ContinuitySA , Training & Education, Security Services & Risk Management
ContinuitySA is offering its popular five-day Complete Continuity Practitioner Programme on 21-25 October 2019 at its offices in Midrand.

Constructive CCTV contributions to research
September 2019, Leaderware , Editor's Choice, CCTV, Surveillance & Remote Monitoring
Study leads to understanding that we need more recognition and reward for constructive participation in society.

Security workforce compliance tool
September 2019 , Security Services & Risk Management
To maintain service excellence across a security workforce is impossible without the help of information systems and technology.

Call back the past
September 2019, SCAN RF Projects , Security Services & Risk Management
Two-way radios are still very relevant in the security world and have gone through significant advances over the past few years to enable them to keep up with the expectations of people in today?s connected world.

Ensuring a seamless ultra-wideband ecosystem
September 2019 , Editor's Choice, IT infrastructure
FiRa consortium ensures an interoperable ultra-wideband technology ecosystem across chipset, device and service infrastructure through standards and certifications.

The hunt for the Carbanak group
September 2019 , Editor's Choice, Cyber Security, News
Tomorrow Unlocked has released a free four-part documentary that tells the story of the notorious Carbanak APT group and its $1 billion bank heist.

Genetec to integrate CylancePROTECT
September 2019, Genetec , Editor's Choice, CCTV, Surveillance & Remote Monitoring, News
Genetec has announced it is partnering with Cylance, a business unit of Blackberry, to bring AI-based antivirus protection to its appliance customers.

X-rays in 3D
September 2019, XPro Security Solutions , Editor's Choice, Security Services & Risk Management
Hi-Tech Security Solutions asked Greg Dixon, director of XPro, for some insights into X-ray scanning and its pros and cons in today?s volatile world.

Smart Inspection Unit developed by Roteck
September 2019 , Editor's Choice, Security Services & Risk Management
Roteck has announced a portable personnel and bag scanning unit that can easily be transported, set up and used in almost any location.