Technology risk assessments

Residential Estate Security Handbook 2018 Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)

In all cases, whether formally or informally, the security operation is developed around understanding the risks in each situation we face. When an incident takes place, the risk becomes more defined and the security plan is adjusted accordingly.

Rob Anderson, Adamastor Consulting.
Rob Anderson, Adamastor Consulting.

It is unfortunate that this adjustment is mostly undertaken as an emotional and reactionary response rather than a calm analysis of facts and a follow-on solution. An example would be a first reaction to a burglar finding a weak link in the physical security of the estate. Those in charge would be embarrassed that it could have occurred at all, and a great deal of rushing around would take place to fix the problem. It is understandable, and it is human nature.

This is all to do with monitoring risk, associated with the barriers and physical security that you can see. We can all see a hole in the fence, but this is the age where so much of the security operation relies on electronics. The ‘holes’ are embedded in the electronic systems. The electronics reduces costs, and if correctly implemented, should introduce efficiencies into the system. However, how do we know when a ‘hole’ develops or a loophole in the electronics is found by one whose intentions are not good?

It is important to realise there is a risk associated with the electronic solution as well. This can only be detected by the technology team, but their focus and training is electronics and they are not necessarily security risk experts.

Physical and technology risks

This leads to the point that we should be undertaking security risk assessments that look not only at the physical elements, but the technical elements too. One of the very first examples, which criminals very soon took advantage of, was to move the obvious CCTV camera or place a hat over it. The evidence that the CCTV would have collected becomes unavailable. In response to this, many manufacturers added alarms to the signal stream from the camera. They were recorded as ‘Camera Moved’ or ‘No Video’, to alert the security personnel.

I am not sure if these alarms are still available. It remains a risk however, because in many cases a camera mounted in a lower position provides better surveillance. We are then back in the ‘easy to get to’ zone. This is perhaps a physical rather than an electronic risk, although it affects both solutions, but things have moved on from this start and criminals have become more sophisticated as technology progressed.

The question is now: How do we assess the risks in the technology solution? These risks can probably be divided into two types.

1. A system failure that was not expected and cannot have been predicted. There must be procedures in place to recognise this type of failure and have a planned response which can be speedily implemented.

2. A badly designed, installed or maintained system that is slowly or sometimes, quickly, heading for failure. These are usually more severe than the first one, as whole sections of the installation often need to be replaced.

The technology risk assessment

As an example, the technology risk assessment should be based on the evaluation of the following criteria:

1. What is the purpose of each component of the technology solution and is it performing the task required?

2. Has the system design covered all the eventualities?

3. Are all components of the electronic solution correctly installed, secure and being adequately maintained?

4. Is there any known method of by-passing the electronic system so that it is prevented from performing the task for with it was installed?

5. Are there documents available to assist technicians in fault finding and as an aid to understanding the functioning of the system?

6. Is there any information available from other estates where the same problem has arisen? This problem may have occurred before and a solution may be available.

It is clear, that assessing risk is important. The task is, however, of little benefit unless it is undertaken in a very structured manner. What would this be?

It is probably a good idea to start my making a check list for the full estate electronic security installation. The check list needs to address each of the systems and their component parts. In addition, it should look at the overall management of the technology solution. This would typically include reporting, maintenance, spares and system age. It could be that the electronics has reached to end-of-life stage. The list will grow as more assessments are done and it becomes clear that it would be beneficial to go into more detail. As the assessment takes place, each item will be categorised as follows:

1. All good

2. Problems detected

3. Have no idea

Clearly items 2 and 3 will require a decision to be made on the remedial measure and its implementation. If you have “no idea”, then an expert needs to be contacted to assist. This is often the case when you are considering items such as computer equipment, database management and protection against hacking threats to the system.

A structured approach

In following a structured approach and remedial treatment what sort of items should form part of the list? Some are listed as follows:

1. Does the control room check that all cameras are functioning and recording on every shift?

2. Is the backup of data taking place correctly every day?

3. Are all the backup power supplies healthy?

4. The after dark CCTV images should be checked. Are they good enough to be of value to the security operation?

5. Are the access control cameras all pointing in the right direction?

6. Are the cameras which have an analytics facility still operating as intended?

7. Is there still a voltage on the electric fence? If the energiser loses power does an alarm alert the control room?

8. Is the control room vulnerable to attack? This would include criminals easily taking over the control room. This becomes ever more important as criminals seem unafraid of using force.

9. Are all staff properly trained in the use of the electronic systems?

10. Undertake mock incidents and check if the systems function correctly, the staff respond correctly and the data can be interrogated to prepare a report.

The overall aim is to find out any possible reason for the technology system letting you down. As can be seen, this could be product failure, system design failure, lack of information available to maintain the system properly and lack of information to implement a recovery from a possible catastrophic failure.

The process must be ongoing, and the non-technical staff should become involved and take part. In this way they will become more valuable to the operation as they develop an understanding of the systems they are using.

Remember, you would not drive your car with tyres that are completely worn out. It is a terrible risk from all points of view. With this in mind, don’t run a security operation with all sorts of lurking risks.



Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Surveillance on the perimeter
Axis Communications SA Hikvision South Africa Technews Publishing Editor's Choice Perimeter Security, Alarms & Intruder Detection
Cameras have long been a feature in perimeter security, with varying reports of success and failure, often dependent on the cameras’ planning, installation and configuration, as well as their integration with other perimeter solutions and centralised management platforms.

Read more...
Onyyx wireless alarm
Technews Publishing Editor's Choice Smart Home Automation
IDS has introduced Onyyx, a wireless alarm system engineered to provide complete system control via the Onyyx app or keyring, as well as seamless installation.

Read more...
Visual verification raises the security game
Videofied SA Technews Publishing Editor's Choice Perimeter Security, Alarms & Intruder Detection
Incorporating alarm signals with live surveillance footage, visual verification enables a human observer in a control room (onsite or offsite) to gain a clear understanding of the situation, thereby facilitating informed decision-making.

Read more...
The AX Hybrid PRO Series offers reliable wired and wireless protection
Hikvision South Africa Editor's Choice Perimeter Security, Alarms & Intruder Detection Products & Solutions
Hikvision has announced the launch of a new AX Hybrid PRO alarm system with innovative Hikvision ‘Speed-X’ transmission technology. This system offers reliable wired protection while delivering expanded flexibility with seamless wireless integration.

Read more...
A critical component of perimeter security
Nemtek Electric Fencing Products Gallagher Technews Publishing Stafix Editor's Choice Perimeter Security, Alarms & Intruder Detection Integrated Solutions
Electric fences are standard in South Africa, but today, they also need to be able to integrate with other technologies and become part of a broader perimeter security solution.

Read more...
SMARTpod talks to The Risk Management Forum
SMART Security Solutions Editor's Choice News & Events Security Services & Risk Management Videos Training & Education
SMART Security Solutions recently released its first SMARTpod podcast, discussing the upcoming Risk Management Forum Conference 2024, which will be held on 26 September 2024 at the Indaba Conference Centre in Fourways, Johannesburg.

Read more...
There is a SaaS for everything, but at what cost, especially to SMEs?
Editor's Choice Information Security Security Services & Risk Management
Relying on SaaS platforms presents significant cybersecurity risks as the number of providers in your landscape increases, expanding your attack surface. It is important to assess the strength of the SaaS providers in your chain.

Read more...
New State of Physical Access Control Report from HID
HID Global Editor's Choice Access Control & Identity Management News & Events
HID released the 2024 State of Physical Access Control Report, identifying five key trends shaping access control's future and painting a picture of an industry that has been undergoing considerable transformation.

Read more...
Addressing today’s mining challenges: cyber risks beyond IT
Editor's Choice Information Security Mining (Industry)
Despite the mining industry’s operational technology systems being vulnerable to cyberattacks, many decision-makers still see these threats as purely an IT issue, even though a breach could potentially disrupt mining operations.

Read more...
Workforce Consortium to reskill 95 million people
Editor's Choice News & Events AI & Data Analytics
ICT Workforce Consortium of global leaders has come together, committing to train and upskill 95 million people over the next 10 years, as 92% of jobs analysed are expected to undergo either high or moderate transformation due to advancements in AI.

Read more...