HOW SECURITY IS MADE
“Failure to plan is planning to fail” – Benjamin Franklin (attrib.)
One of my favorite quotes, and it serves the security world perfectly. Security without proper planning is mere wishful thinking. A hope in the wind. What gives security structure any real and formidable presence is planning.
This isn’t only true with classified information and nukes. It’s true universally. Soft targets, like schools, churches, nightclubs, malls, and hospitals, all require planning in order for security to do more than stand around looking “official,” or worse, creating liabilities.
So, what does proper planning look like? There’s no cookie-cutter description, truth be told. What works for a school won’t work for a hospital – at least, not completely. In fact, what works for one institution in a given field may not work for another in that same field. Security needs are highly specific and individualistic in this way. However, there are some overarching concepts that guide most consultants and security professionals when organizing their systems.
1. Evaluation
The first step in planning security operations is evaluation. One must know what they’re dealing with, their liabilities and assets, in order to properly allocate resources, distribute infrastructure, and assign staff.
When evaluating, we look for the physical, sure; however, we also need to understand some of the more out-of-sight-out-of-mind things in order to get a full picture of need. Things like local crime rates, proximity to emergency services, and neighborhood and whether it’s a rundown industrial area or an upscale housing development all play a role in determining risk.
The one thing most people who try to DIY their security miss in their evaluation phase, or maybe misinterpret, is their organization’s culture. This is sometimes the most difficult piece of the puzzle for a lot of people because they have their perception of what the culture is, but that perception is skewed by any number of factors, e.g., frontline staff misrepresenting satisfaction with operations to administration out of fear of reprisal.
Listing assets – X-number of cameras, lighting effectively eliminating dark areas, XYZ-amount of applicable tactical gear in stock, clear and effective policies in place, etc. – and evaluating culture are only parts of the proverbial elephant we’re trying to eat – the beginning bites crucial to your system’s success.
2. Planning
Now it’s time to plan and strategize. This is the workhorse of all effective security applications. This is the phase that largely determines whether your system succeeds or fails. It all hinges on this.
You’ve identified your weak points, as well as your strengths – now, what do you absolutely have to purchase? What can be put off for a month or six? What is your actual security personnel requirement? Is your training pipeline adequate? Etc., etc…
The questions go on and on ad nauseam, and to be perfectly honest, they should never stop. I’ll get into that in a minute, though.
Understanding how security affects the day-to-day, the effect of a uniform and/or badge and gun has on customers, patients, congregants, children, and parents for example, is all part of that culture we spoke of earlier. Sometimes it matters, and sometimes it just really doesn’t. Knowing the difference is what separates the professional from the pretender, in my opinion.
The brash, “tacti-cool” guy masquerading as a professional consultant will tell you that you need armed security for every theater – tac-vests, pepper spray, flex-cuffs, whisper-mics, ballistic vests, night-vision, thermals, lions and tigers and bears, oh my…
That stuff is fun, but necessary? Not usually in a soft-target environment. What benefits these organizations the most is investing in infrastructure adequate for the resources being protected (i.e., CCTV, alarms, comms, etc.) and training the personnel actually performing the job. That’s it in a nutshell. Simple from a 30,000-foot view, yet as complicated as your environment demands, as well.
And that brings us to our next phase…
3. Execution
No security plan exists in the real world without execution. Until infrastructure is actually in place and boots are on the ground, it’s just an idea.
Employing the appropriate technology is critical for the bottom line. Buying equipment that’s too advanced, too comprehensive, too “smart” for your organizational needs is a hyper-fast way to go broke. By all means, buy quality. This saves money in the long run almost every time. Just understand that your shopping mall isn’t Fort Knox.
Cameras should be able to record in HD (high definition). Rarely do they need true thermal imaging or night-vision capabilities, though. Most mid-range cameras today are equipped with low-light capabilities that are sufficient for most organizations.
There should be enough storage capacity to keep recordings for an appropriate amount of time. For your organization that could be weeks or months. There should also be a backup that’s completely separate from any network – a closed storage device. This preserves original recordings in case of tampering with a connected system.
Personnel should be universally trained in several mandatory skills. In my opinion these include, but aren’t limited to:
Communication and de-escalation
CPR/AED
First Aid/Stop the Bleed
Some form of stress inoculation
Communication and de-escalation training is arguably the most important training a security officer can get. It lowers the occurrence of physical altercations, thereby also lowering liability by a huge degree. Again, my opinion here, but this simply cannot be omitted from any security training curriculum that calls itself “complete,” or even “basic.” It’s that essential.
The next two deal with things like heart attacks, natural disasters, and God forbid, active shooters. More than that, though, this is helpful for the kid who falls and scrapes his knee, or the cook who accidentally cuts herself while “choppin’ broccoli” (Dana Carvey). Again, absolutely essential.
That brings us to stress inoculation. This shouldn’t be undervalued. People never know what their response to critical stress will be until they experience it. Veterans have told stories emphasizing this concept since the beginning of wars, I think. All of us who’ve worked on military, law enforcement, or security teams have seen this phenomenon, too – some new “tough-guy” shows up on your team, talking like he can single-handedly handle anything, but freezes the second the rubber meets the road. Some people seem born for the crucible, while others shatter at the first sign of stress. Better to find out early which one you’ve hired for your team because the latter could literally cost lives if under-trained.
Now, if your organization is something like an Amazon data center, the likelihood of experiencing extreme stress like what we’ve been discussing falls considerably, admittedly. However, I maintain that this type of training is still crucial, if for nothing else just dealing with the uncertainties of the job – the anomalous “I’ve never seen that before” occurrences that every career encounters at some point. Does the 19-year-old you hired have the life experience to handle it? Maybe… maybe not. Give them tools.
This section isn’t about training, though it likely seems that way and I obviously have some deep-seated opinions on the matter. However, training has to be discussed here because without it, your security staff simply can’t be expected to do the job, not even poorly. And doing the job is the execution phase. So, ongoing and effective training is also in the execution phase because it’s part of the job, not adjacent to it.
These are only examples of the execution phase. Properly installed and effectively utilized infrastructure and properly trained and deployed staff are the categories, but there’s a myriad of ways to implement them.
Bottom line: don’t shortchange your staff. Don’t set them up for failure. Your organization and its reputation depend on security incidents being handled professionally, calmly, and with as little collateral damage as possible. That can only be reliably done through adequate and frequent training.
4. Maintenance
This is where I want to go back and cover the continual questioning of your overall security apparatus. Nothing exists in a vacuum, especially security. Threats evolve over time, sometimes changing completely seemingly overnight. If you’re not re-evaluating your system regularly, you’re likely defending against a threat that’s been dead for six months or more when you should be defending against the live threats of today. A truly effective system sees trends as they happen and shifts in real time to match the relevant risk environment.
This requires relationships. Local law enforcement, hospitals, fire departments, professional clubs and associations, the Chamber of Commerce, and of course your trusted security advisor are all examples of relationships that should be fostered continually. These are your best sources of intelligence gathering and advice on how to best apply that intel.
As security consultants, we try to maintain connection with clients in a few ways. One of which is through retainer. Not unlike putting a lawyer on retainer, this gives your organization priority access to your consultant when you need them. Use them. That’s what they’re there for. That’s what you’re paying them for. Call or email them with security events you have questions about. Schedule a “lessons learned” session for your team after a particularly taxing security event. Let them know about a new security consideration you’ve learned about from your local sheriff so they can advise you on mitigation steps. Call them and let them know about threats you’ve received, after reporting them to the police, obviously. This is one of the most cost-effective ways to stay up to date on your protocols. Instead of guessing where to allocate funds and potentially wasting thousands of dollars on unnecessary line items, you’ll know exactly where to invest and where to hold off.
Continual training is the other one. “Here we go again. What is it with this guy and training?” I know it might seem like I’m beating a dead horse here, but lack of training and poor-quality training amplify liability more than almost anything else. In a lawsuit, one of the first things a decent attorney will ask for is training records. Remember, industry standards are minimums, not goals. Get your people trained and keep them that way. Skills go stale without constant use. That’s why, even though CPR/AED is good for two years, I was often required to recert annually.
So, there it is. Other consultants might have a different way of explaining this, but this is the basic way security systems are not only built but maintained. Hope this was helpful and brought a little more clarity to a topic many find a bit nebulous. If you’re interested in learning more, please don’t hesitate to schedule a free 15-minute consultation by clicking the link below. Thanks for your time.
Comments