Risk UK "ASIS UK in the Spotlight" articles

ASIS UK “In the Spotlight” Articles, August 2014 – March 2017

In the Spotlight: ASIS International UK Chapter

Women in Security: ‘Creating a Community’ he mission of the ASIS International Women in Security Group is to provide support and assistance to females operational in the security arena, and to inspire those interested in entering the profession.

While this group’s benefits and programmes are necessarily tailored for women, we do encourage and welcome the participation of anyone dedicated to supporting females in the security world to take part.

One of my pro bono roles is to lead the ASIS UK Chapter’s Women in Security (WiS) Group and, on Thursday 10 July at Bank of America Merrill Lynch’s Canary Wharf offices in London, we held the first WiS Group event of 2014. The gathering was sponsored by CIS Security, whose representative Amanda McCloskey was a great support on the day.

Being the first event I’d organised as WiS Lead for the Chapter, there was an opportunity to try something a little bit different. While desiring the day to be aimed at women in the profession, we didn’t want it to be exclusive. A theme we shall be developing throughout our meetings is ‘Creating a Community’, wherein like-minded people can attend for support, advice or simply to talk through matters. Male security professionals would benefit from attending just as much as female colleagues.

There was also a good deal of feedback about what people want from these gatherings and what they think about other events. Many attendees suggested that security can be a bit of an ‘Old Boys Club’ and that, if you don’t ‘fit in’ or have what’s deemed to be the right background, networking at such events can sometimes become an uphill struggle.

T

Networking: it’s for everyone On that basis, we decided that we would focus this first session on networking and wanted people to come away from the meeting feeling a little bit more confident about the next networking event they would attend.

We contacted Vanessa King (director at The Fire Inside) who coaches people for public speaking and asked her to help us out with our event. It was a relatively small gathering (of 23 people) and Vanessa organised an interactive session, with lots of group activity under the theme of networking.

Everyone sat down in very respectablelooking, theatre-style seating, politely leaving the usual gaps in-between themselves and others they didn’t know with people looking to avoid the front rows, etc.

ASIS UK’s Women in Security Group recently held its first meeting of 2014. The subject matter? Networking. Dawn Holmes examines how to make new contacts, tackle ‘elevator pitches’ and converse with the most appropriate individuals for your security management spectrum After a brief introduction, though, the chairs were dotted around the room and we progressed to our first task. It was fun, broke the ice and pinpointed the value of networking.

After this, we then looked at how to approach a group, using body language as a guide to work out who’s the best person/group to approach so that we aren’t just hovering, trying to squeeze into conversations and looking awkward when we cannot gain access. Very importantly, we also learned how to ditch someone who’s boring. The secret as to how to do so? We’re not telling!

How to handle the ‘elevator pitch’ Our final group activity centred on tackling a 60-second ‘elevator pitch’. The trick here is to leave someone wanting to learn more. If you can interest your audience in a solution without going on too much about your product or service, people will be interested in learning more about what it is you do.

We also learned that no-one (no matter how well connected and confident) really likes being put on the spot with these pitches, but such tasks are something we can all improve upon.

Most people spoke to everyone around the room. We didn’t just stick to the couple of people that we knew. Indeed, the ASIS WiS Group has an unwritten rule that, after each event we run, attendees must speak to someone that they’ve never met before. It’s a great philosophy.

The event concluded with everyone networking like there was no tomorrow. All attendees offered really positive feedback and left the meeting in a happy frame of mind.

We’re now seeking to plan our next event, and would be happy to work with anyone who’d like to see us tackling a particular topic. We’re eager to complement the existing Women in Security Groups, too. There’s room for us all.

Indeed, my goal is that these groups flourish.

Dawn Holmes CPP MSyI: Vice-President and Operations Manager (EMEA) for Global Protective Services at Bank of America Merrill Lynch

“Many attendees suggested that security can be a bit of an ‘Old Boys Club’ and that, if you do not ‘fit in’, networking at such events can sometimes become an uphill struggle” 53 www.risk-uk.com

Supply Chain Risk Management: Focusing on Best Practices A

The ASIS/ANSI Supply Chain Risk Management Standard affords essential knowledge and guidance for security professionals such that they can implement ‘end-toend’ risk management procedures and policies across both physical and virtual supply chains.

Allison Wylde delves into the detail

52 www.risk-uk.com

s evidenced by recent events, many companies continue to focus on productivity and financial efficiencies rather than understand the potential risks in their supply chains (and, most essentially, the possible impacts of those risks).

The 2011 earthquake and resulting tsunami in Japan, for example, severely disrupted the global production of computer games and electronic components simply because Japan was a sole producer.

Brand and reputational damage – not to mention fiscal penalties – can result from such occurrences. In short, the consequences may be hugely detrimental for any given business caught in such a maelstrom.

That’s why the launch of the ASIS/ANSI Supply Chain Risk Management Standard is so timely. Published in July 2014, this document provides essential knowledge and guidance for security and risk professionals such that they can implement ‘end-to-end’ risk management procedures and policies across both their physical and virtual supply chains.

The Supply Chain Risk Management Standard provides a generic approach suitable for organisations of all sizes and types of setting, operation and risk. Importantly, it also offers examples of Best Practices and templates.

On that note, the publication’s strength is drawn from the expertise and input of more than 140 cross-disciplinary international security practitioners.

Speaking about the document, Bernard Greenawalt CPP – vicepresident of Securitas in the USA – stated: “The Supply Chain Risk Management Standard provides guidance on some current Best Practices that can be applied to any organisation and customised as necessary to meet unique security

requirements. An effective supply chain risk management programme is essential for virtually every organisation if they’re to prosper in today’s business environment.”

The Supply Chain Risk Management Standard was developed by ASIS International and is accredited by the American National Standards Institute (ANSI). It’s set out in seven chapters followed by eleven practical appendices, and commences by introducing the important role of leadership, the teams involved and the business case for supply chain risk management, highlighting all the while a requirement for change management.

Mapping the supply chain Processes of risk management are discussed.

These include risk communication, consultation and establishing the context for – and mapping – the supply chain. Emphasis is placed upon the importance of recognising that supply chain risk management is an essential decisionmaking tool ensuring that organisations identify risks, prioritise and manage them as part of an ongoing process.

Detailed ‘mapping’ in the Supply Chain Risk Management Standard involves identifying critical paths, value creation and value propositions across different tiers of the supply chain, while also reflecting on the overall organisational strategy when it comes to creating value and achieving defined objectives.

Step-by-step, mapping involves identifying supply chain partners, dependencies and interdependencies (including utilities and infrastructure), single source suppliers, upstream and downstream partners, logistics, storage and transportation, workforce suppliers, contractual and compliance requirements, image and visibility, sensitive internal information and high risk sites.

One example illustrates the supply chain risks involved in a typical food/beverage company supply chain. The processes are mapped from ‘end-to-end’ as ‘buy, make, move and sell’. The supply chain risks are shown in two categories: external and internal. External risks (for example public perception, country stability or regulatory actions) are considered as ‘out of our direct control but must be factored into business planning’. Internal risks, such as ingredient quality, product quality or

In the Spotlight: ASIS International UK Chapter

“Risk treatment through supply chain risk management involves protecting and securing the supply chain, responding to events and maintaining operational resilience post-incident” food security are ‘within our direct control and must be factored into business planning’.

The individual risk factors in the supply chain can then be assessed. Several may be common throughout the supply chain. Human error would be a classic example, while others might be present only at specific process functions.

Not all aspects of the supply chain will have risks attached for all processes or operations.

However, the mapping should identify risks in the value chain and the parties involved. Some elements may include planning, procurement, document preparation and reverse logistics.

Information flows should also be identified: top down, downstream, upstream and sideways. Responsibility for managing these flows ought to be established together with mechanisms for capturing any situational awareness which arises, perhaps through the appearance of an issue or abnormality (or correctness) which may then be managed or minimised as appropriate.

Organisations may decide to assess the risk in a supply chain to better understand their supply chain capability (and resilience). Many pre-existing analytical tools can be applied. A simple Pareto Analysis could identify the proportion of goods versus suppliers and/or organisational dependencies in terms of cost, production or failure. The output may allow the prioritisation of any changes to be estimated in order to resolve an issue.

Other approaches could include examining bottlenecks, strategic dependencies or risks.

More sophisticated approaches may also be applied, perhaps through a portfolio analysis of any criticalities, high value or scarce items (or entities) such that continuity risk is accounted for and assessed.

Another example includes the ASIS Security Metrics Project (ASIS Foundation, 20141) which assists security professionals in selfadministering products to develop, evaluate and improve security metrics.

Risk criteria and risk appetite The Supply Chain Risk Management Standard provides a recommended, dynamic and holistic risk assessment approach. The process involves recognising a given organisation’s risk criteria and risk appetite, as well as undertaking risk identification, risk analysis and risk evaluation ‘end-to-end’ through the supply chain.

Thales illustrates the importance and practical applications of supply chain risk

management. “Managing risk in the supply chain has become a prime concern for any global company,” explained Jason Brown CSyP FSyI RSecP ASM, national security director for the company in Australia and New Zealand.

“Thales has devoted a major effort in the business continuity space to mapping all critical elements, identifying risks and mitigating them. We rely on effective supply chain management to deliver the critical products and services behind many of the world’s most important business activities.”

The Supply Chain Risk Management Standard recommends that strategic partners be identified according to the ‘tier’ of their relationships (for example, as a hierarchy of Tier 1, Tier 2, etc), thus allowing organisations to map and identify a complete picture of relationships and dependencies. Supply chain risk management requires an ongoing and dynamic monitoring of the risk criteria, risk profile (as included) and risks which could prevent an organisation from achieving its objectives. The ASIS/ANSI document also stresses that the tangible and intangible costs should be considered.

Risk treatment through supply chain risk management involves protecting and securing the supply chain, responding to events and maintaining operational resilience postincident. Performance evaluation and continual monitoring are recommended through testing and adjusting the plan, tracking change and monitoring the risk management programme.

Specific guidance is given in supply chain risk management information and communication technologies, convergence, management practice and organisational resilience (ASIS/ANSI 20092).

The Supply Chain Risk Management Standard also provides examples and templates of risks by category, generic elements that should be considered in supply chain agreements, a selfawareness questionnaire, a sample site crisis plan, a regulatory impact assessment and a maturity model for supply chain risk leadership.

Illustrations of simplified interpretations are provided and will assist newcomers to the discipline. More complex conceptual methods are aimed at experienced practitioners. By way of example, the illustration above of the possible internal and external risks for a food/beverage company compared with the analysis provided by the ‘Bow-tie method’ (see ISO31010:20093, p24).

*The Supply Chain Risk Management Standard is available for download by ASIS International members or for purchase by non-members. Visit: www.asisonline.org for further information **Allison Wylde FRGS DIC (Imperial), Bernard Greenawalt CPP and Jason Brown CSyP FSyI RSecP ASM are members of the ASIS International Commission on Standards and Guidelines

Allison Wylde FRGS DIC (Imperial): Visiting Lecturer in the Faculty of Business and Management at Regent’s University, London

References 1‘Persuading Senior Management with Security Metrics: Effective Evaluated Metrics’, ASIS Foundation 2014 [Available online at: https://cso.asisonline.org/Lists/ AsisImageRotation/View%20Re port.pdf ] 2‘Organisational Resilience: Security, Preparedness and Continuity Management Systems - Requirements with Guidance for Use’, ASIS International (ASIS/ANSI, 2009) 3‘ISO31010:2009: Risk Management - Risk Assessment Techniques’, ISO (Copyright office: Geneva)

53 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

Corporate Security: Reviewing ‘The Risk Landscape’ n today’s world, Corporate Security and Risk Management Departments face myriad challenges as they attempt to mitigate risks and threats on behalf of their organisations. For one, they’re confronted by specific security risks that can impact the business environment (for example terrorism, financial instability or acts of fraud). It must be said that there are also risks arising from the manner in which the discipline of risk management itself is both exercised and perceived.

Ultimately, one of the greatest challenges faced by all security and risk management professionals is the risk of new or unfamiliar threats remaining undetected. In this instance, let’s refer to ‘Social Media’ and ‘Cyber Crime’.

It also remains the case that it’s a highly complex – not to mention near impossible – task for any risk management strategy to wholly eliminate internal malpractice, and most notably where that malpractice occurs at a senior level.

Broadly speaking, the practical security risks facing modern businesses may be placed into two categories: external and internal.

External risks include events such as natural disasters, industrial accidents, IT failures, climate change, supply chain disruptions, theft and geo-political/socio-political events (ie terrorism, military conflict or revolution).

Internal risks include factors such as employee fraud or sabotage, or perhaps employee errors involving IT/security functions.

Placing all of these risks into a rigid or prescriptive hierarchy is, in itself, a problematical exercise and arguably dependent on the type of business in which a particular company finds itself engaged. Indeed, the very perception of risk varies from person to person and within corporate organisations who have varying degrees of ‘risk tolerance’ depending on their position within the global marketplace.

In my experience, it does seem that there’s one factor at play across multiple sectors of the economy. That factor is globalisation in tandem with the various risks contingent upon it. It’s often argued that corporations involved in the global business environment expose themselves to risks reliant on extended value chains and country/economic stabilisation.

I

Spotlight on enterprise-related risks Enterprise-related risk can take many forms, such as that for carbon emissions credit trading (via London-based LCH, ICE Futures Europe or Nasdaq OMX Commodities Europe). Trading

What exactly are the challenges affecting Corporate Security Departments attempting to manage and mitigate enterprise risk on behalf of the organisations they serve? Dr Peter Speight examines the current state of play

offers companies a means of securing their business by achieving emissions targets.

However, in 2011 alone, cyber theft resulted in the loss of carbon offsetting credits valued at 30 million Euros1.

In some instances, risk may simply be the outcome of the firm’s core activities and revolve around failing to maintain management of company policy, strategy, structure and principles in parallel with the demands of an evolving and changing environment.

Meanwhile, lobbying organisations like the UK’s Carbon Trust argue that adverse events around climate change will eventually drive consumers towards rejecting brands linked to those occurrences. Also, supporters of the Corporate Social Responsibility agenda would argue that companies successfully managing such risks will effectively secure competitive advantage by developing and maintaining appropriate corporate governance strategies.

In my opinion, other security risks such as IT failures and acts of cyber criminality are inevitable. In practical terms, we need to try and eliminate them – as far as possible – through Best Practice that’s driven and underpinned by policy and regulation.

Dr Peter Speight CSyP DBA MSc MIRM: Education Lead for ASIS International’s UK Chapter and Director of Risk and Consultancy at Securitas Security Services

51 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

References 1Chaffin J (2011): ‘Carbon trade cyber theft hits E30 million’, Financial Times, 20 January 2011 [Available online: http://www.ft.com/cms/s/0/c db788e8-24df-11e0-895d00144feab49a.html#axzz25Uj 7ePwt] 2Fragniere E and Sullivan G (2007): ‘Risk Management: Safeguarding Company Assets’, Boston: Thomson 3Smith D and Irwin A (2006): ‘Complexity, Risk and Emergence: Elements of a “Management” Dilemma’, Risk Management, 8(4), pp221-226 4Sadgrove K (2005): ‘The Complete Guide to Business Risk Management’ (Second Edition), Aldershot: Gower 5Madura J (2010): ‘Financial Markets and Institutions’ (Ninth Edition), Mason OH: Cengage

Across the past few years, the development of ISO 27001 specifically referencing Information Security Management has certainly provided guidance and structure for addressing the mind-blowing complications around dealing with the physical, technical and procedural minefield that may be present in some organisations. However, it could be argued that, in time, all companies will be subject to these types of incursion and criminality. On that basis, we need to look at – and plan for – recovery and damage limitation.

Again, ISO 27001 does offer some really good mitigation advice. If you want to consider other standards, try ISO 22301 (Business Continuity Management Systems), ISO 31000 (Risk Management), PD 200:2011 (Crisis Management) and PD 25222 (Continuity Supply Chain Management). All offer useful guidance which will help organisations’ risk management teams to develop effective strategies.

Such strategies only work, though, when driven downwards from the Boardroom whereby company executives take responsibility and assume accountability for the risk appetite within their organisation. This means creating an effective culture that supports and implements measures designed to mitigate and manage corporate governance.

In some cases, it seems to me that executives and Chief Operating Officers blame everybody else but themselves when things do go wrong.

Having said that, I’m a realist and companies have to ensure that they balance the benefits of Enterprise Risk Management with the costs and implementation of all mitigation strategies. We all have to balance ROI, but it’s the cost of doing nothing which really worries me.

Security and risk management professionals do face challenges arising from the very nature of their discipline. Also, the work they carry out is sometimes perceived – and notably so by other management professionals – as a drain on resources. Until such time that there’s a problem, of course.

Although Enterprise Risk Management is now generally accepted in the corporate environment, risk management is a fairly new aspect of the overall management structure.

New legislation, activist shareholders and rising insurance costs are now converging and, in turn, rendering integrated risk management a far more important proposition.

“Successful security management eliminates problems before they impact upon performance. This means that the corporate community cannot easily appreciate the value of the exercise” 52 www.risk-uk.com

According to a 2007 article penned by Fragniere and Sullivan2: “Natural, geopolitical and financial disasters in the first few years of the 21st Century created a new awareness of risk among the public, businesses and lawmakers. This has spurred the development of several risk management methods in both financial and non-financial sectors. Risk managers responsible for creating the ‘riskenabled company’ have to balance and resource multiple mitigation strategies.”

Risk management professionals also face specific problems around achieving recognition of their contribution to profitability and justification for their investment. Successful security management eliminates problems before they impact upon performance. This means that the corporate community cannot easily appreciate the value of the exercise.

Seen in this light, it’s a sad truism that an effective security manager may well become the victim of his or her own success.

Establishment of new frameworks Last but not least, risk management professionals must face challenges arising from their own practice and the possibility that they will fail to identify new or non-anticipated risks.

As Smith and Irwin3 have written, managers themselves make the decisions that contribute to ‘the precursors of failure’ and ‘determine the acceptability of residual risk as well as the appropriateness of mitigation strategies’.

Many risk management frameworks have now been established to meet this challenge by informing consistent Best Practice4. For example, AS/NZS 4360:1995 in Australia, CAN/CSA-Q850-97 in Canada and JSI Q 2001:2001 in Japan. Meanwhile, after the 9/11 attacks in the USA, the UK’s Institute of Risk Management created PAS 56 which was subsequently replaced by BS 25999.

These are largely qualitative and generic frameworks. The degree to which they could assist in identifying specific new threats is debatable. For instance, it could be argued that such frameworks encourage a normative view of security risk and thus actively discourage the identification of new or unfamiliar challenges.

Furthermore, frameworks and policies are no guarantors of Best Practice. On the high profile stage, the Enron Corporation reportedly harboured an excellent ethics policy prior to its much-publicised demise5.

Somehow, risk management professionals have to convince the corporate community that investment in mitigation strategies is necessary and beneficial, even for those instances where the apparent benefits are difficult to measure.

In the Spotlight: ASIS International UK Chapter

Physical Access Governance: Assuring Compliance, Reducing Risk, Saving Costs anks, financial institutions and companies (such as utility providers) managing our Critical National Infrastructure – including nuclear power plants and data centres – are mandated to ensure compliance against Government and/or industry regulations for several areas of their operation. Importantly, risks associated with any failure around that compliance are often related to the financial and/or reputational profile of a given organisation and, that being the case, must be taken seriously at all levels.

On that basis, companies will implement rigorous processes and procedures alongside internal checks and balances to ensure they’re able to measure the level of their compliance and, in turn, identify any areas of concern.

For its part, physical access governance within an organisation relates to: • ensuring that the right individual has (physical) access to the right places and at the right times • making certain that the required vetting and validation of any individual provided with such access has been carried out in accordance with the host organisation’s security policy • the necessary approvals being received before physical access is provisioned for a particular area (for instance critical/high security data centres) for a specific individual • the required training and certification (eg in relation to Health and Safety) being in place in accordance with the security policy governing any specific area • physical access being revoked or suspended as per the defined and stated security policy In order to measure and assure compliance around these various aspects, organisations have to collect, manage, analyse and report on often large amounts of data and processes during the ‘lifecycle’ of any individual who sets foot on the premises. This necessarily involves collaboration between several departments concerned with physical security, IT and data security, general business risk and continuity.

However, in the main the ownership of – and liabilities around – such aspects rest with the Physical Security Department. Hence the reason that, in a 2012 survey conducted jointly by the CSO magazine and the IDG Research Services Group, 63% of serving directors responsible for the physical security remit at medium/large-scale organisations who were

B

How might organisations ensure compliance around physical access in today’s business environment? Further, what challenges confront them when attempting to do so?

Dr Vibhor Gupta examines Physical Identity and Access Management solutions and their ability to reduce both risk and operational costs questioned classified compliance around access governance as either ‘Critical’ or ‘High Priority’. That figure increases to 92% when all participants in the survey are included.

Compliance around physical access How, then, do organisations ensure compliance around physical access in today’s business environment? Further, what challenges confront them when attempting to do so?

Until now, there has been heavy reliance on the use of various solutions/devices such as physical access control systems to help measure those metrics previously outlined and, in turn, assure compliance. In addition to the collection of data from such systems, measuring overall compliance involves a good deal of administrative effort and cost due to the lack of any easily identifiable audit trail for all processes leading to the data generation.

This spend is further enhanced when there are disparate sources of information/systems deployed within a business. That statement is true for most global enterprises that have grown – either organically or by dint of mergers/acquisitions – and inherited a legacy infrastructure of disparate systems focused on different areas, sites or indeed regions.

Of late, many organisations have spent millions on standardising their systems – physical access control solutions among them – to one model or type with the intention of reducing risk and the administrative

51 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

“A Physical Identity and Access Management solution allows physical security administrators a single self-service user interface from which they can view and report on processes” spend involved in measuring and ensuring compliance. In truth, such investments haven’t helped them that significantly.

Introduction of PIAM solutions

Dr Vibhor Gupta BSc (Hons) PhD: Technology Lead for the ASIS International UK Chapter Committee

52 www.risk-uk.com

In light of decreasing budgets around physical security in tandem with increasing operational costs, it becomes hugely important to identify a way in which all processes and data might be captured, audited, reported and analysed in the most cost and time-efficient manner. To meet that desire, a new class of enterprise software – designated Physical Identity and Access Management (PIAM) – has been introduced.

A PIAM solution allows physical security administrators a single self-service user interface from which they can view, control, audit and report on data and processes relating to employees, contractors or visitors and their physical access to a building or site.

A key component of PIAM solutions is a rulebased engine which allows the administrators to define all workflows along with the necessary checks and balances required when provisioning physical access for a given individual. This permits physical security administrators to automate and audit the implementation of these processes through one single user interface. In turn, that means the elimination of any need to extract, normalise and stitch together data from multiple source systems. The end result is significant savings on both cost and effort.

The important thing to remember here is that PIAM solutions are not a replacement for physical access control systems or, indeed, Physical Security Information Management (PSIM) systems. Rather, they’re intended as a complementary fit within an organisation’s overall security infrastructure.

PIAM solutions integrate with existing physical access control solutions to source/provision required data as per the workflows defined in their rule engine. In addition, PIAM solutions allow physical security administrators to schedule and create reports/audits that measure the host organisation’s level of compliance.

Examples of some typical end user questions for which a PIAM solution will help provide the answers are as follows: • Are all those individuals with physical access to a particular area security cleared?

• Are there any people with physical access to a particular area who don’t meet the necessary training or certification requirements that are mandatory for this area? If so, has their physical access been terminated/suspended?

• Have all individuals with access to a particular area been approved for access by the respective area owner/authoriser?

• Has an area owner/authoriser validated all individuals who have access to their area?

• Have the results of any change in security policy or compliance regulations been implemented across all concerned areas and for all concerned individuals (ie employees, contractors or visitors)?

• What’s the actual scale of the impact for any such changes (ie how many people and areas are impacted)?

• How compliant is the host organisation in relation to various parameters defined as part of industry regulation (such as Sarbanes-Oxley, SAS16, Basel III, SAS70, NERC and FERC)?

• Has the organisation taken necessary action across areas where it’s currently failing in relation to compliance? Does this require any internal process re-engineering?

Reducing risk, assuring compliance Time and cost savings which may be achieved through a PIAM solution are subject to the industry sector in which the host organisation operates, compliance mandates, processes and existing infrastructures.

Various Case Studies and examples have shown that, on average, such solutions can help reduce overall operational costs by as much as 60%. Most importantly, the ability to proactively audit and manage processes provides a great opportunity for any business to significantly reduce its risks.

A typical return on investment for PIAM solutions is realised within eight-to-ten months from the date of implementation. That being so, a PIAM solution can help add value to an existing security infrastructure by providing opportunities to ensure compliance, reduce overall risk and render savings on the business’ operational costs.

Finally, it’s important to consider the ease of implementing a PIAM solution. As stated, the primary objectives of implementation are to reduce risk and cost while maintaining full business continuity. It’s highly recommended that end users consider a commercial off-theshelf (or COTS) PIAM solution rather than those which are customised or otherwise bespoke versions of existing solutions.

When Diligence Is Due Whether your company is looking to carry out background checks on prospective business partners or potential future employees, there are certain rules, regulations, standards and procedures in place that must be strictly observed. Chris Brogan plots a course through what can be a legal minefield ue diligence may be defined as: ‘The diligence reasonably expected from, and ordinarily exercised by, a person who seeks to satisfy a legal requirement or to discharge an obligation’ (also termed ‘Reasonable diligence’). In terms of Corporations and Securities, we might say: ‘A prospective buyer’s (or broker’s) investigation and analysis of a target company’.

If you wanted a legal definition of the term then look no further than that which resides in Black’s Law Dictionary (Seventh Edition): ‘A failure to exercise due diligence may sometimes result in liability, as when a broker recommends a security without first investigating it adequately.’

Why a legal definition? The definitions that I’ve recounted all reference checks to be made before entering into a contract. They also reference Duty of Care and, as a contract involves civil law, it’s not too great a step to consider a Legal Duty of Care. If there’s a breach of this Legal Duty of Care involving negligence or recklessness then the individuals involved could find themselves in the criminal domain. Hence the requirement for a legal definition.

In criminal law, due diligence can be a defence in strict liability cases where the prosecution only has to prove the ‘Actus Reus’ (Guilty Act) and not the ‘Mens Rea’ (Guilty Mind).

If the accused can demonstrate that they took all reasonable steps to prevent criminal

D

48 www.risk-uk.com

activity then this is considered to be a defence in law. The reasonable steps are not necessarily the standard of care of a particular industry, but I would suggest that standards promoted by the security industry – such as those devised by the British Standards Institution and the Centre for the Protection of National Infrastructure (CPNI) – may go some way towards convincing the Judge that reasonable steps were taken.

In civil law there’s a responsibility on both parties towards an action that reasonable enquiries have been made to establish the facts that may be subject to dispute.

Running the rule over a business If dealing with a business, it seems sensible to check that it exists, resides at the address(es) provided and that you have the correct name.

If you’re about to do business with ABC you should clearly establish if it is ABC Limited, ABC (London) Limited or ABC (Manchester) Limited.

They are separate legal entities and not necessarily legally responsible for one another.

You may want to know how long the business has been in existence and its financial details (if available). If the business is a registered company then such information can be obtained directly from Companies House (www.companieshouse.gov.uk).

The process of conducting such checks is rendered a little more difficult if the target business isn’t a company. However, there are numerous commercial databases available which can provide you with information on businesses. Equifax (www.equifax.co.uk) and Experian (www.experian.co.uk) are but two of them. They can also offer details of any litigation against a given company.

Other good sources for litigation are the Registry Trust (www.trustonline.org.uk) and the Ministry of Justice (www.justice.gov.uk). The British and Irish Legal Information Institute (www.bailli.org) is an excellent source for court cases considered to be ‘in the public interest’ and which may have set legal precedents.

LexisNexis (www.lexisnexis.co.uk) not only provides access to legal cases but also newspaper articles from sources that often cannot be found on the Internet. These databases are fee paying but your company is likely to already have accounts with them.

Unless you have the correct legal company name before you, you could well be performing your due diligence on the wrong concern which could result in erroneous conclusions. You’ll garner the correct name from Companies House and the legal databases mentioned.

In the Spotlight: ASIS International UK Chapter

Remember... When it comes to information sourced from the Internet and/or newspaper articles, you cannot be absolutely sure that the name has been accurately recorded.

Checks you may not have considered Are you aware that businesses providing an investigation service for you are required by the Information Commissioner, Christopher Graham, to notify his office that they’re providing such a service?

If they don’t notify then they’re likely to be committing a criminal offence under Section 17 of the Data Protection Act 1998. This rule would also apply to that former colleague of yours to whom you may wish to sub-contract the occasional investigation. Checking is an easy procedure. Simply visit www.ico.gov.uk and click on the Notification Register.

If you sub-contract any work that involves the processing of personal data it’s your organisation’s responsibility to ensure that the sub-contractor is appropriately qualified and trained to do so. This requirement is contained within Principle 7 of the Data Protection Act. Make no mistake here. You are liable for any breaches committed by your sub-contractor.

Your defence could be that you did carry out sufficient due diligence. Make sure that you include this procedure as a requirement in your contract in line with the seventh principle of the Data Protection Act. In May 2011, the Organisation for Economic Co-operation and Development (OECD) issued guidelines to the EU’s Member States that corporations in those countries should investigate any partners with whom they do business to ensure that they don’t abuse people’s Human Rights. Those guidelines may be found at: www.oecd.org/datacoed/43/29/ 48004323.pdf Guidelines for this type of due diligence checking may be obtained from the Business and Human Rights Resource Centre (www.business-humanrights.org).

It’s suggested that if you’ve not conducted such checks then you may be jointly liable for any breaches that might occur.

Pre-employment screening The sources listed can also be used for preemployment screening of potential employees.

However, where individuals are concerned you will be processing personal data so compliance with ‘The Privacy Laws’ (‘The Security Industry and The Privacy Laws’, Risk UK, September 2014, pp26-27) is of paramount importance.

Although useful, BS 7858 2012 and the CPNI guidelines on pre-employment screening don’t

carry the same weight in an employment tribunal or a Court of Law as the free guidelines provided by the Information Commissioner’s Office entitled: ‘Use of Personnel’s Personal Data’. If you sub-contract this process you must ensure that your sub-contractor has more than a passing acquaintance with ‘The Privacy Laws’.

Again, you’re going to be held responsible for any breaches that might occur.

Consider what’s required on a normal job application form… ‘Please list any CCJs or bankruptcy events that you’ve had in the past five years’. Now what’s the relevance of that information for my application as a security officer with your company? Is it an integrity check? I can find no evidence – either legal or academic in nature – indicating that a County Court Judgement or bankruptcy event places into question a given person’s integrity.

As relevance is a major factor in ‘The Privacy Laws’ (reference Article 8 of the Human Rights Act and the third principle of the Data Protection Act 1998), unless you can demonstrate the relevance of that question and any question in your application form to the position applied for you could be in breach of the law and so face the subsequent penalties.

Be aware that ‘consent’ of the individual concerned is not going to be your ‘Get Out of Jail’ card. Consent is a most unreliable condition upon which to rely. This matter will become particularly relevant when the future Data Protection Regulations are passed in Europe. 2015 is the proposed date (‘Preparing to meet the EU’s Data Privacy Act’, Risk UK, September 2014, pp28-29).

Chris Brogan MA LLM MIBA FSyI: Partner at B&G Associates

Thoughts around relevance Let me outline some thoughts around relevance. Assume that I apply for a new job in your Finance Department. You want to know my financial history because you consider that if I’m experiencing personal financial problems then I may find your organisation’s financial issues simply too complex to deal with them.

It’s worth noting that just because you want to know that certain something about me this doesn’t necessarily mean you’re entitled to know that certain something about me. The fact is your current or future employees’ rights do not suddenly stop when they enter the factory gates in the morning or push open the front door of the corporate headquarters.

Make sure you don’t breach those employees’ rights because, as many companies have found to their cost, it can be an extremely expensive mistake to make – and that’s before taking into due consideration any corporate governance implications.

49 www.risk-uk.com

(Cyber) Security: Where does it fit within ‘The Value Chain’?

Infrastructure Related

INFRASTRUCTURE

IN RG MA

Support Activities

Security community professionals often refer to their specialist discipline as a horizontal process that cuts across most business areas, but does anyone else recognise this supporting activity as being critical to success? Alan Jenkins reviews ‘Security’ in relation to Professor Michael Porter’s stated philosophies

HUMAN RESOURCE MANAGEMENT TECHNOLOGY DEVELOPMENT

MARKETING AND SALES

OUTBOUND LOGISTICS

SERVICE

OPERATIONS

Product Related

M A RG IN

INBOUND LOGISTICS

PROCUREMENT

Market Related

Primary Activities

ne of the biggest challenges facing members of the security community at present – be they practitioner, vendor or service provider – is how to convince business leaders of the value of any investment that might be made in relation to security efforts designed to protect infrastructure, people or – even more topically, perhaps – information and, in particular, intellectual capital (such as R&D outputs upon which future business revenue may well depend).

The apparent lack of a quantifiable ‘value add’ from security outputs has frequently led to physical security being seen as a secondary activity of Facilities Management. In parallel, Human Resources Departments are prone to resist any suggestion that they should ‘own’ the background checking of staff despite obvious overlaps with the on-boarding process.

For its part, IT is often outsourced with alltoo-little regard for security provisions.

This lack of perceived value to be derived from ‘Security’ flies in the face of the discipline

O

Alan Jenkins: Committee Member (Security Convergence) of ASIS International’s UK Chapter and Managing Director at Cyber Security Pilotage

48 www.risk-uk.com

having been identified as one of the ‘Principles of War’1 by such luminaries as Sun Tzu, von Clausewitz and Liddell-Hart.

More recently, the 2011 edition of the British Defence Doctrine2 categorises ‘Security’ as: “…balancing the likelihood of loss against achieving objectives. It demands managing risk, protecting high value assets and resilience.

Security does not imply undue caution or avoiding all risks for bold action is essential to success. Neither does it demand overcommitting our resources to guard against every threat or possibility, thereby diminishing relative fighting power.”

In the same document, cyber space is defined as: “…the interdependent network of Information Technology infrastructures – including the Internet, telecommunications networks and computer systems as well as embedded processors and controllers – and the data therein within the information environment. Defence is increasingly dependent upon cyber space and can expect adversaries to exploit this dependence. The UK Government assesses the cyber threats to its interests and mitigates them through resilience measures, awareness and trusted partnerships.

Activities in cyber space are an essential element of routine business and fundamental to planning and conducting operations.”

Whether your enterprise lives in the business-to-business space or business-toconsumer arena, it’s likely that both the Internet and Intranet play a large part in dayday operations. Any disruption emanating from an internal or external source is likely to have a negative impact on business outputs with an attendant cost and, often, reputational damage.

Increasingly, it’s the latter that’s grabbing the attentions of Board members as well as other stakeholders – among them shareholders, market analysts and partners up and down the supply chain – not to mention national Governments, legislatures and regulators.

However,much of this attention is concentrated on reducing risk rather than adding value. Security is a secondary driver for businesses wherein the primary driver is that of continual growth and, where applicable, adding shareholder value.

Recognising security’s value Where, then, does security fit into our business models and respective commercial strategies?

It could easily be argued that, all-too-often, security is an afterthought for business, a

In the Spotlight: ASIS International UK Chapter

reluctant spend and almost invariably a cost centre draining the bottom line with little or no visible contribution to the top line.

Given that it’s almost universally acknowledged ‘Security’ must use the language of business when seeking to make the case for further investment, who can we cite in support of our pitch ‘in the elevator’ or the Boardroom?

Alas, the list of potential backers isn’t long.

Therein, perhaps, rests our greatest weakness. The true value of ‘Security’ is neither recognised nor appreciated by the host organisation until, perhaps, it’s too late.

In his celebrated 1985 publication: ‘Competitive Advantage: Creating and Sustaining Superior Performance’3, Michael Porter – Bishop William Lawrence University Professor at Harvard Business School’s Institute for Strategy and Competitiveness – introduced ‘The Value Chain’4 as a tool for developing competitive advantage.

Porter considers the implications for offensive and defensive competitive strategy, including how to identify vulnerabilities and initiate an attack on the industry leader – something which should be of particular interest to ‘Security’. At this juncture you’re invited to view the diagram of Michael Porter’s generic Value Chain (reproduced opposite).

The goal of Porter’s ‘Primary Activities’ is to create value that exceeds the cost of providing the product or service, thus generating a profit margin. Any or all of these ‘Primary Activities’ may be vital in developing a competitive advantage, but it should be remembered that they likely vary by industry sector and are best considered at the business unit level.

Porter also identifies four generic categories of ‘Support Activities’, the details of which are industry-specific and frequently conducted at the corporate rather than business unit level: • Procurement: the function of purchasing the raw materials and other inputs used in the value-creating activities • Technology Development: including R&D, process automation and other technology used to support the value chain activities • Human Resource Management: all activities associated with recruiting, developing and compensating employees • Business Infrastructure: including activities such as finance, legal and quality management, etc

These ‘Support Activities’ are often viewed as ‘overhead’ but some businesses have successfully used them to orchestrate a competitive advantage.

At this point, your attention is drawn to the absence of any mention of ‘Security’ as either a ‘Primary Activity’ or ‘Support Activity’.

Therein lies the rub. We, the security community, frequently talk about ‘Security’ as a horizontal process cutting across pretty much all business areas, but does anyone else actually recognise this supporting activity as being critical to success?

Gaining traction for convergence Despite its merits, to date the idea of security convergence has struggled to gain widespread traction perhaps because its ‘value add’ has been less than clear.

It falls upon ourselves, then, to better argue the case for increased ‘value add’ recognition if we’re to genuinely support business growth.

We need to analyse the myriad ways in which ‘Security’ at least supports, if not enables the business to succeed.

What we’re talking about here is a ‘Value Chain Analysis’ with a total focus on security.

In order to better understand those activities leading to a competitive advantage and, hence, ‘value add’, Professor Porter begins with the generic value chain and then proceeds to identify the relevant business-specific activities. Process flows are mapped and used to isolate individual value-creating activities.

When discrete activities are defined, linkages between activities should be identified.

A linkage exists if the performance or cost of one activity affects that of another. Competitive advantage is obtained by optimising and coordinating linked activities to maximise both efficiencies and effectiveness.

The business’ value chain should link to the value chains of upstream suppliers and downstream buyers. The result is a larger stream of activities known as ‘The Value System’. The development of a competitive advantage depends not only on the businessspecific value chain but also upon the value system of which the business is a part. This also links to current enterprise security thinking as more than one primary supplier has been compromised by upstream contributors in respective supply chains.

References 1http://en.wikipedia.org/ wiki/Principles_of_War 2JDP 01 (Edition 5): UK Defence Doctrine 3Porter, Michael E (1985): ‘Competitive Advantage’, Free Press, ISBN 0-684-84146-0 4http://www.quickmba.com/ strategy/value-chain/

“We, the security community, frequently talk about ‘Security’ as a horizontal process cutting across pretty much all business areas, but does anyone else actually recognise this supporting activity as being critical to success?”

49 www.risk-uk.com

Modern Slavery: Fighting an ‘Invisible’ Risk

ITV’s programme entitled: ‘Exposure: Britain’s Secret Slaves’, broadcast on Monday 19 January, may well have shocked members of the viewing public but, in truth, revealed only the tip of the iceberg of what is a very contemporary phenomenon which many ignore – or choose to ignore.

Dr Alexandros Paraskevas addresses the ‘invisible’ risk of modern slavery

48 www.risk-uk.com

ontrary to popular belief, slavery was not abolished in the 19th Century, and neither does it solely exist in a group of underdeveloped countries with violent authoritarian regimes somewhere far away.

Rather, it’s a very contemporary reality. Indeed, we may all involuntarily partake in modern slavery simply because of its ‘invisible’ nature.

ITV’s recent documentary: ‘Exposure: Britain’s Secret Slaves’ focused on domestic servitude (which represents only a fraction of modern slavery), a criminal activity considered to be high profit-low risk and, in 2012, worth – according to the UN Office on Drugs and Crime – $32 billion. Other forms of modern slavery (also known as human trafficking or trafficking in human beings) include trafficking for sexual exploitation, forced labour, child trafficking and organ harvesting. A number of legal businesses in a variety of sectors are ‘exposed’ – to use the ITV programme’s title preface – to the risk of being complicit with such activities.

A recent International Labour Organisation study suggests that 21 million people are the victims of modern slavery for the purposes of labour and sexual exploitation. Of these, 4.5 million (22%) are victims of forced sexual exploitation while 14.2 million (68%) are the victims of forced labour exploitation in economic activities (such as agriculture, construction, domestic work or manufacturing).

The highest rate of trafficking victims – at 4.2 per 1,000 inhabitants – is found in central and South Eastern Europe and the CIS, in turn underscoring the magnitude of the problem at a

C

European level. Here in the UK, the third annual Strategic Assessment of the Nature and Scale of Human Trafficking study produced by the National Crime Agency reported a total of 2,744 potential victims of trafficking for exploitation in 2013, among them 602 children. This is an increase of 22% on the 2012 statistics.

The Human Trafficking Foundation estimates that there are 20,000 slaves in the UK. Modern slavery has long been a concern for the EU which has undertaken a number of initiatives in an attempt to combat such criminality. For example, the EU Directive 2011/36 sets out provisions for trafficking prevention, victims’ protection and traffickers’ prosecution while the EU document entitled ‘Strategy Towards the Eradication of Trafficking in Human Beings: 2012-2016’ lays down a series of victim-centred anti-slavery measures.

Although these actions establish a solid framework within which Member States can undertake action against modern slavery, they’re not often helpful for individual businesses. Moreover, some Member States haven’t yet adopted the EU Directive and neither are they bound by it (as stated in point 36 of the preamble).

The UK developed its own legal framework (the UK Modern Slavery Bill) which is now approaching its final stages in Parliament and is likely to pass into UK law by April 2015.

Even if not headquartered in the UK, the EU law will affect most major businesses since new transparency provisions will require them to report on their specific efforts designed to prevent human trafficking and forced labour across their own supply chains.

Focus on the hospitality sector The nature and necessities of modern slavery – namely the requirement for continuous movement, temporary accommodation and the supply of low cost products and services – have placed hospitality businesses (hotels, restaurants and catering companies, etc) at a high level of exposure and, at the same time, in a unique position to both identify and combat this form of criminal activity.

These businesses are often accused of ‘turning a blind eye’ to human traffickers by outsourcing their cleaning and catering services to dubious sub-contractors, allowing sexual trafficking on their premises, employing migrant workers without appropriate due diligence, buying products produced by forced or bonded labour, labour exploitation (or the

In the Spotlight: ASIS International UK Chapter

violation of labour rights) or simply ‘not noticing’ what’s going on.

It’s a common ‘secret’ that traffickers merely take advantage of the privacy and anonymity offered by these businesses and are able to operate through them at low risk.

There are a multitude of NGOs, initiatives and protocols offering guidance for businesses against human trafficking, the most notable being the Dhaka Principles for Migration with Dignity, the Athens Ethical Principles and the UN Luxor Protocol. In the hospitality and wider travel and tourism sector, similar initiatives against human trafficking have often focused on raising awareness around specific types of modern slavery rather than offering a comprehensive action plan. The UN World Tourism Organisation’s campaign focused on combating child labour, sexual exploitation and trafficking of children is a good example here.

Arguably the most notable effort towards addressing human trafficking in the sector on a more holistic basis was undertaken by the International Tourism Partnership which, in collaboration with its members (mostly international hotel companies operating in the UK), has created a website hosting information to raise awareness of human trafficking as an industry problem while offering Best Practice advice to the sector on how to address it.

EC-funded development project Taking a more risk-based approach, a consortium led by Oxford Brookes University – with the collaboration of the London School of Hospitality and Tourism at the University of West London, the Ratiu Foundation for Democracy in Romania and Finland’s Lapland University of Applied Sciences – is being funded by the EC to develop a training toolkit specifically to assist the hospitality and wider tourism sector combat human trafficking.

The consortium is supported by an Advisory Board consisting of personalities nationally and internationally renowned for their expertise and ongoing activities to combat human trafficking.

This two-year development project – named The COMBAT Project – began last October and, broadly based on the ‘Three Lines of Defence’ principle, aims to forge a toolkit that will provide training and guidance at three different levels: operational (in the field), tactical (management support) and strategic (Boardlevel policies and practices). The training will not only be about awareness and detecting the signals of human trafficking but also about action that will take into consideration the business perspective as much as the law enforcement and victims’ perspectives.

“The nature and necessities of modern slavery have placed hospitality businesses (hotels, restaurants and catering companies, etc) at a high level of exposure” At the operational level, say in a hotel, it will move from detection to verification with the help of experts and reporting (through management structures and anonymous disclosure lines), evidence collection and/or preservation for effective prosecution by law enforcement and immediate – as well as possible long-term – victim treatment before the police and social workers arrive.

In terms of the tactical level, the training will include proposals on developing company-wide policies and procedures as well as support mechanisms (eg anonymous disclosure from units as there’s a possibility that individual managers or even owners are involved in trafficking) that go beyond everyday operations across the supply chain (for instance vetting agents providing outsourced cleaning crews, key suppliers of linen or fresh food products, etc) and on to victims’ rehabilitation.

Finally, at the Board strategic level, training will focus on policy statements, advocacy and participation across global networks, third party certification and systems auditing, etc.

The project will begin with an understanding of the human trafficking ‘risk universe’ for the hospitality sector and the development of a European ‘heat map’ depicting levels of human trafficking in each country and the main routes used by traffickers to move their victims.

A risk assessment methodology will also be developed, mapping the potential journeys of trafficked victims through the business – whether in the supply chain or in the business premises. The purpose here is to identify ‘critical control points’ where the host business can identify potential traffickers and raise barriers to minimise exposure to them.

The policies, standards, risk treatment and auditing strategies in each critical control point will be informed by extensive research.

The toolkit is scheduled to include an AntiTrafficking Programme Maturity Matrix (ATPMM) which can be used to benchmark antitrafficking practices among hospitality businesses. The ATPMM is to be complemented by meaningful metrics in the form of leading and lagging Key Risk Indicators and Key Performance Indicators. The metrics will then form a business ‘scorecard’ reflecting the maturity level of a given host organisation’s anti-trafficking policies and practices.

The toolkit will be made available to hospitality companies for free in 2016.

Alexandros Paraskevas PhD: Professor of Strategic Risk Management at the University of West London and Principal Investigator for The COMBAT Project

49 www.risk-uk.com

“Heads I Win, Tails You Lose” Ethical Considerations in Approaching Risk

Every day of our lives we must check and balance risks – from choosing whether or not to drive to work to how much alcohol it would be safe to drink with our evening meal. Given its centrality and importance in our existence, then, does it make sense to talk about risk in tandem with ethics? Dr Kevin Macnish answers in the affirmative risk of fire in the structure (ie the risk is the probability of the outcome) or that the risk is damage to 80% of the building (ie the risk is the expected outcome).

Clearly, the way in which we use the term ‘risk’ is somewhat far from being straightforward.

Probability, severity, objectivity

aking risks is fundamental to the safe and continuous operation of businesses. In essence, members of today’s breed of corporate sector managers need to understand risk in order to determine which business decisions to take, where to invest their hardearned capital and where they might best focus their immediate attentions.

Just because security and risk managers engage in their specific professional activities on a regular basis doesn’t mean that ethical implications are not involved and that they necessarily understand those implications.

They might simply have gone through life never really thinking about these implications, possibly because they’ve not seen a need to do so. However, in recent times the work of several philosophers has highlighted the ethical challenges faced in dealing with risk, a number of which will be raised here.

First of all, though, what do we mean by the term ‘risk’? I’ve used the term several times already and, one imagines, you’ve continued reading my words without questioning what I mean by it. Certainly, we use the term ‘risk’ in relation to unwanted outcomes, but are we talking about risk as a quantity or a quality? Are we discussing it as a cause or an effect?

We might say that there’s a risk of fire in an old building (ie the event – fire – is the risk) or that the building carries a risk of fire (ie the cause of the event – the building – is the risk).

Then again, we might say that there’s a 40%

T

Dr Kevin Macnish: Teaching Fellow and Consultant in Applied Ethics at the University of Leeds

46 www.risk-uk.com

Generally speaking, in business circles risk is viewed as a combination of probability and severity of outcome. This affords an objective and almost mathematical air to the subject.

That viewpoint also suggests that we’re able to weigh the possibilities and outcomes and arrive at a reassuringly scientific number that has meaning.

However, we know that it doesn’t work quite like that. For example, we could say that if you install Intrusion Detection System X in your company’s offices, there’s a 70% chance of preventing break-ins. Armed with that information, what decision should you take?

The answer actually depends on a number of things, in particular whether you trust the individual who’s making the prediction and whether or not you think that break-ins are a price worth paying for not installing a better security system.

Of course, those are both very subjective considerations that will differ from person to person. Other factors may include the reversibility of the outcome (ie is your business such that it could go under if there’s a break-in, or would this just be a nuisance from which you could recover?), the duration of the outcome (ie would recovery from a break-in take a matter of days or weeks?) and the lapse of time between the act and the consequence (in other words, while the impact of a physical break-in is pretty instantaneous, a Trojan left behind after a targeted cyber attack may not be activated for months or perhaps even years thereafter).

It’s partly out of a consideration of these aspects of how we think about risk that medical

In the Spotlight: ASIS International UK Chapter

practice has moved on from a ‘Doctor knows best’-style approach to one based around patient choice. While the doctor may be expert in knowing the efficacy of different procedures, he or she will not always know the patient’s values. Even given the high risk of mortality involved, perhaps a given patient would prefer not to undergo chemotherapy in order to maximise the benefit of the time they have left on the planet? This is a decision that only the patient can make.

That last consideration raises the fact that there are as many as three different parties involved in deciding on whether to take a risk.

First, there’s the decision-maker themselves: the individual who makes the call on whether to engage in a risky action. Second, there’s the beneficiary – the individual who’ll benefit from the action. Third, there is the cost-payer. The latter’s the person who’ll lose from the action.

Taking account of these three defined parties, the philosopher Jonathon Wolff has pointed towards a number of different scenarios that could play out. These are shown in the table below: Scenario

Decision-Maker

Beneficiary

Cost-Payer

1

A

A

A

2

A

B

B

3

A

B

A

4

A

A

B

5

A

B

C

Working through the table, Scenario 1 is often seen as the least ethically problematic.

Think of a situation in which someone might take their money to a casino and gamble with it. If they win then they gain. If they lose, they lose. Presuming that the individual concerned has no dependents and ignoring the fact that they could have donated the money to a very worthy charity, they decide what to do in such a way that the only person to win or lose from their decision is themselves.

The second scenario is more akin to the ‘Doctor knows best’-style approach in which a decision is made on behalf of another. If a surgeon decides on a dicey procedure to cure someone of a long-standing ailment and doesn’t consult that patient on the matter at hand then he or she is making the decision but it’s the individual who will benefit if all goes well and, conversely, lose out if the procedure doesn’t proceed to plan.

The third scenario depicts a situation in which the decision-maker will lose from the risk occurring but a second party will benefit if the risk pays off. The ‘I lose, you win’ situation isn’t very compelling and, because of this, a

“Generally speaking, in business circles risk is viewed as a combination of probability and severity of outcome. This affords an objective and almost mathematical air to the subject” decision-maker in that particular scenario is likely to be risk averse. That’s not to say that no-one will take these decisions. Acts of courage and self-sacrifice look very much like this, and we rightly celebrate those who overcome the rational aversion to risk in such instances in order to help others.

If the third scenario is one of: ‘I lose, you win’ then the fourth is the opposite: ‘I win, you lose’. As the third scenario leaves the decisionmaker in the position of being risk averse, the fourth scenario witnesses the decision-maker being risk prone. He or she is likely to take the risk as they can only benefit while someone else will pay any costs.

Finally, Scenario 5 is that of many decisions taken by politicians in which the decisionmaker has to decide between competing interests, none of which affect the decisionmaker in a direct sense.

Think here of decisions taken about where to locate a nuclear power station or a landfill sight when the decision-maker doesn’t actually live in any of the areas under consideration.

Appreciating the ethics of risk Understanding this table is extremely useful when it comes to appreciating the ethics of risk taken in the business world.

It’s all-too-easy to attempt to objectify risk and reduce it to a matter of numbers. However, in doing so we can fail to appreciate that we, the decision-makers, are imposing risk on other people who may not want – or even be prepared – to accept it.

Worse still, they may not want the risk and not be in a position to complain or challenge

47 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

the decision (if, for instance, they feel they’re insecure in their current role).

If the people to reap the rewards of making certain decisions are those sitting at the top of an organisation while those who will pay the costs are at the bottom, the beneficiaries will not carry much credibility in terms of being the best judges as to whether the benefits outweigh the costs.

Using the table to better understand some of the ethical issues involved in corporate security and risk management, it’s helpful to ask who’s represented by each of the three parties. The decision-makers will usually be senior management, particularly if the planned investment requires a significant financial outlay. Senior management might consult the workforce depending on the size of the company and its particular corporate philosophy, but often they will not do so.

On the surface, the beneficiary is the company. Security systems will help to prevent losses of varying degrees of severity. That being so, there’s an extent to which we can say everyone in the company is the beneficiary.

Jobs are protected and vital funds which might otherwise be spent on disaster recovery are instead channelled towards growth.

However, senior management also hold jobs in the company and, usually, significant financial interests in the business’ success in the form of shares. If the company suffers, it’s possible that while everyone suffers the senior management team suffers more. By installing thorough security measures it’s senior management who benefit proportionately more than the majority of the workforce.

Beneficiary may appear different The beneficiary may appear different, then, depending on where you’re standing. Workers may see the beneficiary as senior management while senior management might see the beneficiary as ‘everyone in the company’. This difference of perspective is significant.

If senior management is the decision-maker and – or at least is seen to be – the major beneficiary, who’s the cost-payer? Again, as members of the company, senior management will bear part of the burden in terms of financial outlay and some inconvenience.

“If the people to reap the rewards of making certain decisions are those at the top of an organisation while those who will pay the costs are at the bottom, the beneficiaries will not carry much credibility in terms of being the best judges as to whether the benefits outweigh the costs” 48 www.risk-uk.com

However, when it comes to many forms of security, senior management will not be personally affected. They already work long hours and are held to be trustworthy so no-one sees the need to enforce time cards or foist CCTV in the workplace upon them.

By contrast, the majority of the workforce’s cohort will be the ones who experience ‘tracking’, potentially feel ‘spied upon’ and believe themselves to be generally distrusted by the upper echelons.

Resistance from the workforce I’ve phrased this application of the table to security in terms of ‘usually’ and ‘typically’.

Clearly, this is not the case with every organisation nor, indeed, with every security application. However, it does raise the issue that, where the dynamic works between the parties as I’ve suggested, it looks as if – from the perspective of the workforce, at least – the implementation of security systems meets the criteria for Scenario 4 (the ‘I win, you lose’ outcome) in the table.

Ironically, owing to the difference in perspective previously mentioned, the same situation will likely appear to senior management as Scenario 2 (the ‘Doctor knows best’ situation). In fact, taking these sorts of decisions on behalf of others might be exactly what senior management believe is their purpose in the grand scheme of things.

Therefore, the implementation of dedicated security systems may lead to resistance among the workers of some organisations. This might seem confusing to members of the senior management team and the security professional, who sees his or her key task as protecting the interests of those workers.

Potential non-compliance scenario Despite the security professional’s best intentions, though, it may soon become clear that the workers resent the imposition of security measures, perhaps viewing them as tools by which senior management can spy on them at given opportunities.

In turn, that may lead to further complications such as non-compliance with – or even attempts to subvert – those systems.

One possible solution here would be to ensure full engagement across the workforce and energise widescale support for the decisions being made prior to implementation.

While this task may not be one listed in the security professional’s job description, it’s at least one way of overcoming the ethical challenges of imposing – or being seen to impose – risk upon others.

Flying your staff out of a kinetic environment

icture the scene. A key member of staff is overseas on business and, unfortunately, loses their passport. In such a scenario there can be a multitude of reasons why the corporate organisation for whom they work finds itself unable to provide the optimum support for that employee.

Those reasons can include the company only having an old copy of the passport data page to hand. The passport may have expired or been replaced, or perhaps the individual’s surname has changed and, as such, the details therein are now outdated.

Unbeknown to the organisation, the employee may harbour dual nationality and be making good use of their other passport.

While the team at Head Office frantically searches online to ascertain whether or not there’s an Embassy in country or if the location in question is being covered by another Embassy, someone within the business erroneously sends the individual concerned a copy of an outdated data page such that they can then attempt to obtain an emergency travel document. Will this work, though?

A further question then arises. Does the local Embassy/Consulate require a passport picture?

After double-checking to confirm they didn’t bring any spare passport pictures or gloss paper with them on their trip, the stranded employee may soon begin to realise there’s a dearth of photo kiosks in the country as a whole, let alone at the airport. Realisation around all of those training quotes about ‘Being prepared’ swiftly starts to resurface.

P

Stephen Ackroyd MSc CSyP FSyl: Aviation Sector Lead for ASIS International’s UK Chapter

50 www.risk-uk.com

Corporate travel plays a vital part in many business professionals’ lives but, as plenty will testify, overseas visits don’t always work out as planned. On the basis that a good example is often worth more than good advice, Stephen Ackroyd relates the tale of mishaps experienced by a fictional corporate traveller and assesses whether they might have been fixable with some sound organisational support As the corporate organisation tactfully fills in part of its internal form with the comment ‘Pending’, the next question springs to mind.

Does the company elect to fly the employee direct to a specific country or transit them via an intermediate nation? On examining the company’s contingency plans, those questions concerning the accuracy of information on visas and transiting procedures duly open themselves up for scrutiny.

This activity will entail additional time being allocated on the re-checking of passport and visa regulations before a ticket can eventually be booked and the decision is made to confirm that the individual doesn’t have anyone else travelling with them.

Placing reliance on mobile devices The ticket reference number is eventually received by our intrepid employee who then has another revelation visited upon them to brighten their day still further. The new mobile device provided for them by their employer may well have restrictions placed on it when it comes to downloading apps.

The difficulties this could pose begin to emerge. It’s likely something to be reviewed when back on home soil, but it wouldn’t be a surprise if our lone business traveller reflected there and then on the potential benefits of having downloaded the airline’s apps before the journey started.

As the employee stares meaningfully at their mobile device, he attempts to recall the wording of the company’s Wi-Fi security notice policy. Was there a special exemption to the policy or specific guidance for privacy settings?

With a forlorn expression, the employee accepts that the Wi-Fi policy is noted within the e-mail that cannot be accessed as he isn’t allowed data roaming overseas. The attachment remains unopened but secure.

In the Spotlight: ASIS International UK Chapter

The employee then begins to seek a business centre at the airport and wonders what rules may be broken if he duly accesses the company e-mail account from this centre such that he can then use the printer. The search for the printer may be fruitful, though, as our notional passenger remembers there are airports that do require a printed travel document for entry.

As the day slowly but surely progresses, there’s an increasing awareness of the need for knowledge on what’s going on and why some fellow business passengers seem to be more knowledgeable than others as they stand next to an advertisement for the airport’s app.

As he rests by the advertisement, our employee ponders the benefits of social media and muses as to whether or not the relevant information might have been posted on a social media platform such as Twitter (which the airline and airports are now increasingly using in order to communicate their important messages to passengers).

It’s possible that social media platforms are also being used by the Embassy/Consulate and the employee’s mind wanders. Could they access Twitter and follow the site of the airport to which they’re aiming to travel?

That neat idea is intruded upon by the realisation of the need to search for these organisations on social media. This wasn’t part of the overseas brief.

Since the individual doesn’t possess any social media apps that particular brainwave was merely an academic exercise.

Advance warning of disruption Undeterred, the employee happens across a discarded newspaper someone has left behind on a nearby chair. A ripped page holds a reference to the individual’s destination airport and news of a disruption. Thoughts of weather restrictions and potential industrial action swiftly begin to loom large, along with the stark realisation that advance warning of any possible disruptions caused by such events could have eased both travel and subsequent business arrangements.

Not that this is playing heavily on our businessman’s mind, you understand, as the developing scenario is hopefully being watched over by others back home within the organisation for whom he diligently works.

The questions to be asked by our employee of the next airport fluctuate between which mobile network to connect to and will their mobile phone actually work once in situ?

Solace is then taken in seeing another passenger with an excessive amount of baggage. What will be the cost of that excess?

“A key member of staff is overseas on business and loses their passport. There can be many reasons why the corporate for whom they work is unable to provide the optimum support” As this particular scenario pans out, it’s clear from the other passenger’s antics that they’ve decided they either will not or simply cannot cover the additional cost involved.

While loudly blaming their company for not advising them of the rules, a decision to checkin all but one bag and leave that excess bag at the airport has unintended consequences. So begins a security alert and a new cordon for an unattended bag. Great!

Our businessman then proceeds out of the airport under the guidance of airport security and passes the only ATM on site. A dejected and somewhat disappointed passenger is just leaving said cashpoint. Our business traveller asks them what’s wrong. The passenger reports that the ATM is empty.

Suddenly, the question as to whether the new company mobile phone is ‘Pay as You Go’ or ‘Contract’ becomes very pertinent. If the mobile is on contract, has the limit been exceeded as everyone back at Head Office – from the CEO to HR to line management – has phoned to check on progress being made?

This may be a question to ask of the next caller from Head Office but our employee will need to be quick as the phone’s battery is now running low and they cannot remember seeing power socket charger points in the airport (or even recall where the charger and adapter might be ‘hiding’ just now).

Examining different options While waiting outside the airport, another passenger asks our businessman about different flight options for leaving the country.

To be helpful, a search is then initiated for the printed Annex 1 of the contingency plan which had flight options within it.

Myriad questions spring to mind. Is this the winter schedule or the summer schedule? Is this covering charter flights or just regular flights? Isn’t that one a code share? Are these phone numbers local or international? These are but some of the questions being asked in fairly short order.

Then, while deciding which question to answer first on behalf of their inquisitive fellow passenger, our employee happens to glance towards that passenger’s luggage trolley and notices the flicker of a tail emanating from a small metal cage. “Have I asked the right questions at all?” he ponders…

51 www.risk-uk.com

Tactical Interviewing: Interrogation or Conversation with a Purpose?

When focusing on corporate investigative interviewing procedures, are today’s organisations perhaps somewhat guilty of over-complicating the basic skills underpinning successful two-way communication? Corin Dennison examines the correct procedures that ought to be invoked wherein information sharing is every bit as vital as the omission of negative terminology

et’s play a game of word association. For each of the following words or phrases think of one word that springs readily to mind: Interrogation/Confession/Liar/Suspect/ Good Cop, Bad Cop. How many of your answers were positive or negative? Here are some suggestions I thought of in response: Torture/ Duress/Confrontational/Police/Trickery.

While I’m not suggesting that, in our corporate worlds, we adopt or apply such methods within our interviews or corporate investigations, I would ask you how many times you’ve heard these words or phrases used in your own environment. Do these words facilitate conversation or act as a barrier?

How do we face up to the challenges of applying consistent and ethical interview standards across a global estate?

For many sector professionals investigative interviewing is seen as something of an art that, while taught, must be practised and developed over time if the procedure is to become effective and efficient.

The world of interviewing is well serviced by a variety of applications and training models – Wicklander-Zulawski, REID, PEACE and Polygraph are obvious examples – but which one is right for you? This doesn’t include the self-trained expert. The type of person that has been heavily influenced by the ‘CSI effect’ having watched complete box sets of that enduringly popular crime drama.

From my own perspective, I’m fortunate enough to have trained in all of these models

L

48 www.risk-uk.com

which are credible and well adopted in our environments, but I often question whether we may have over-complicated the basic skills of communication. In attempting to answer that question, perhaps we should begin by asking another one... What, exactly, is an interview?

An interview is a conversation with a purpose. Whether applied in a compliance environment or the HR arena, unless we’re merely exchanging ‘chit chat’ it’s fair to suggest that most of our conversations have a purpose.

For example, conversations involving the negotiation of a new salary, applying for a new role or quizzing an employee over an alleged compliance violation. All have a purpose.

How do we determine success?

What, then, determines the ‘success’ of such a conversation? The answer is effective planning.

Using a simple model you may have seen before, we can work through the particulars.

Why? and What?

Why are we seeking this conversation and what is the objective? You would be surprised how many times people come out of an interview failing to have achieved the objective(s) or even having asked the relevant questions.

As part of an investigative process, an interview is often seen as an opportunity to exchange information, establish facts and secure an account. More importantly, though, it should be used as an opportunity to listen.

Who? Who is going to conduct the interview or conversation? Do we give sufficient

In the Spotlight: ASIS International UK Chapter

consideration to competence, qualification and, more importantly, confidence? An effective interviewer should be an effective communicator, possibly a subject matter expert but definitely someone who’s familiar with the facts and the objectives.

How many times in an interview environment is the interviewer more anxious than the subject being interviewed? Confidence can be a challenge and, equally so, can over-confidence.

Where?

Where will the conversation take place? Is a glass office a suitable location for a compliance interview, or maybe a coffee shop? You may smile but I’ve experienced both scenarios. The selection of a suitable venue can be tactical, but we also have to consider the practicalities of our own working environment at all times.

When?

Timing, they say, is everything. We should consider how this can impact on the success of our interview. Is a Friday just ahead of the weekend really appropriate? Or maybe just before lunchtime? Is your subject actually in the office or even available?

How? In my opinion, the most important factor in interview engagement is the application. How are you going to achieve your objective(s) and purpose(s)? What’s the most effective method for a particular subject, and are you confident of being able to execute that method? What’s your definition of success?

With the ‘How’, I always like to consider potential barriers. What might be a barrier to the interview or conversation taking place or being effective? For a global business, it’s fair to say that language is always a challenge, not only in terms of conversing directly but in the interpretation of what’s being said. It’s absolutely essential here to quality assess and confirm understanding.

Another barrier is effective listening and actually hearing what the other person is saying, even if you don’t agree with what’s being said or the account doesn’t fit with your purpose. Work to the 80/20 model. In other words, 80% listening and 20% talking.

When it comes to bias or pre-determined opinion, again we should revisit the objective.

Why enter into a conversation or interview if you’ve already decided the outcome or made a decision? While bias is a natural human instinct, it’s one that’s often ‘detected’ by the other party during a conversation and will not facilitate easy communication.

Similar to language, tone is also hugely important. When you talk you want to be heard and, at the very least, acknowledged. Linked to listening skills, engagement is absolutely critical to effective communication.

Tell, Explain… and Show “Tell me something new.” In point of fact there’s nothing new here except to say that we’ve returned to the basics. A simple threestep process: ‘Tell, Explain... and Show’.

Apply each to a conversation and to your ‘questioning technique’.

Tell This is often referred to as the ‘free recall’ or account. “I will tell you the purpose or objective of the interview or conversation, imparting or disclosing some information that will facilitate the process. You tell me what you know or what you need to answer my question.”

The question often asked by a subject in a compliance interview is: ‘What’s this about?’

Why avoid or deflect this question which would be an obvious barrier to achieving an answer?

Explain Having entered into a conversation you may wish to add information or explain the context.

Alternatively, you may ask the question: “Explain what you’ve just told me”. Again, this is a simple application of the questioning process to establish the necessary facts.

Show As a demonstration of sharing information you may wish to show or share with the other party something relevant to the conversation, or otherwise ask them to show you. This is often referred to as a ‘challenge phase’.

Some of you may now be questioning the application of such a simple model, particularly when applied to complex interviews or investigations, but let’s revisit the word association exercise and the barriers we face.

Negative terminology is often used to apply pressure on a subject whether tactically or inadvertently, but this will impact on the success of an interview. The objective in most compliance interviews is securing a confession as opposed to an account. Any personal investment in that goal can cloud both the interviewer’s judgement and focus.

Corin Dennison CPP: Director of Profit Protection and CoE Investigations at the adidas Group

“When it comes to bias or pre-determined opinion, again we should revisit the objective. Why enter into a conversation or interview if you’ve already decided the outcome?”

49 www.risk-uk.com

The Pharmaceutical Industry: Assessing The Security Risks The global pharmaceuticals market is currently worth US$300 billion per annum, with the ten largest drugs companies controlling over one third of the market. What does the threat landscape look like right now, and how can organisations guard against acts of criminality?

Rowena Fell has the overview companies – that may seek to target pharmaceuticals’ intangible assets, particularly when considering the perceived immaturity of the pharmaceutical market in nations outside of North America and Europe?

What is The Threat Landscape? ooking at the Top Ten drug-producing companies on the worldwide stage, several generate sales revenues in excess of US$10 billion every year, with six being located in the United States and four in Europe. The North American market has remained the largest with a 41% share, while Europe has achieved a 26% market share.

It’s predicted that North and South America, Europe and Japan will continue to account for a full 85% of the global pharmaceuticals market well into the 21st Century.

When considering the European Union’s (EU) trade environment in 2012, the majority of EU exports were to Russia, with the least amount of imports being from Israel. Furthermore, 21 countries were identified as having an emerging pharmaceutical sector and, collectively, will add US$187 billion in annual sales by 2017. This equates to two thirds of global pharma growth and will increase the ‘pharmerging markets’ global share from 23% in 2012 to 33% in 2017, with Brazil, Russia, India and China in the Top Ten by sales value.

The European Federation of Pharmaceutical Industries and Associations notes: ‘The research-based pharmaceutical industry is a key asset of Europe’s economy. It’s one of the top performing high technology sectors.’

Having scanned the figures mentioned, what would you consider to be the countries – or

L

60 www.risk-uk.com

The industry is comprised of companies who make, patent and sell drugs that have therapeutic effect. The market is highly competitive and entry is difficult due to a combination of strict regulations and the need for extensive research and development involving time-consuming clinical trials.

In addition, high research and development costs, expiring patents and difficulty in gaining product approval from the appropriate regulatory bodies combine to mean that companies must produce ‘blockbuster’ drugs (and continue to do so in order to remain in good standing).

Other challenges facing the industry include pressure from purchasers, such as hospital managers who negotiate discounts with wholesalers or manufacturers when buying in bulk, in turn increasing pressure on pharmaceutical companies to produce costeffective drugs that will remain competitive.

There’s also the necessary requirement to gain approval for new drugs.

According to the Centre for Drug Evaluation and Research, on average there have been less than 23 approvals on an annual basis over the past decade.

Although patents protect the intellectual property rights of specific drugs, usually for a period of around two decades, the timing of the patent application is crucial. Too early and the product isn’t protected for a sufficient time

In the Spotlight: ASIS International UK Chapter

period when it reaches the market (affecting profitability due to patent expiration). Too late and the research is exposed for too long and open to compromise and copying.

Furthermore, pharmaceutical companies face increasing pressures related to generics. These are drugs comprised of the same ingredients as patented drugs, but sold under a drug’s chemical name rather than the pharmaceutical brand name. Medical professionals can prescribe drugs under their chemical name without specifying a brand.

Terminology: Trade Secrets Trade secrets relate to information that’s not generally known and which companies, researchers, inventors and creators treat as confidential in order to gain or otherwise preserve a competitive advantage. They are not exclusive Intellectual Property Rights.

For an asset to be considered a trade secret it must have value, either real or potential. It must only be known to the company and be seen to be protected. Trade secrets can range from the chemical composition of drug products through to manufacturing methodologies and software algorithms. Virtually anything that has economic value derived from not being generally known – and that’s adequately protected – can be a trade secret.

With no expiry date, trade secrets may be valuable and perpetual assets for a company.

Additionally, no registration is required.

The term ‘trade secret’ is an important one.

Risk UK’s readers may be following developments at the European Parliament and European Commission (EC) on the protection of undisclosed know-how and business information against their unlawful acquisition, use and disclosure, more commonly referred to as the Trade Secrets Directive. This document is currently in the consultation phase and aims to ensure fair and honest competition, providing innovators with a means of defence against attacks on their knowledge assets.

It may surprise you to learn that there’s currently no standardised civil or criminal law applicable in the EU to protect trade secrets. EU Member States’ legal enforcement of trade secrets varies by country. Some Member States don’t have legislation on misappropriation, relying instead on general laws as interpreted by the Judiciary. In some Member States, trade secrets are only protected against misappropriation by competitors.

Not all appropriate remedies are present in all Member States, and the courts don’t always have mechanisms in place to ensure confidentiality of trade secrets during and after

litigation. Often, recourse designed to address misappropriation is through employment law.

The legislative landscape to protect trade secrets is fragmented, then, and that’s exactly why the very best line of defence is to prevent the trade secret from leaving the enterprise in the first instance.

Acts of Misappropriation The Trade Secrets Directive resulted from a study on Trade Secrets in the Internal Market conducted in April 2013 and prepared for the EC. In the study, respondents confirmed that they had suffered from attempts at acts of misappropriation of trade secrets across the last decade, both within and outside the EU. Out of the 537 interviewees, 20% had suffered at least one attempt of misappropriation within EU countries. The majority of companies experiencing such acts were found to be in the chemical, motor vehicle and pharmaceutical sectors. Larger organisations report a higher frequency of attempts at (or actual) acts of misappropriation than SMEs both inside and outside the EU. The parties identified as being primarily responsible for attempts or acts of misappropriation are competitors, former employees and customers. Current employees are deemed to have been responsible for misappropriation in 18% of cases. It’s worth noting here that the loss or compromise of trade secrets is one of the most under-reported business statistics so we can infer that these numbers are likely to be somewhat higher.

Adverse consequences in view A 2012 survey conducted by The Ponemon Institute and involving a substantial 3,317 respondents noted several interesting statistics. Companies reported substantial adverse consequences, both reputational and financial, as a result of attempts of acts of misappropriation of trade secrets.

Survey respondents indicated they had suffered a loss of sales, clients and contracts (56% of affirmative responses), costs attributed to internal investigation (44%) and increased expenditure for protection (35%), costs around negotiating settlements (34%) and also for prosecuting and litigation measures (31%).

Companies must mitigate the human threat while also taking care of the technical aspect.

Rowena Fell MA CPP FSyI: Associate Director of the Intellectual Property and Trade Secrets Protection Programme (EMEA) for Merck Sharp & Dome’s Global Security Group

“For an asset to be considered a trade secret it must have value, either real or potential. It must only be known to the company and be seen to be protected” 61 www.risk-uk.com

Converged Security: A Brave New World by this IP migration, but only a handful.

Security directors can find those vendors by specifying that their products must be secured from an IT-side attack. Some vendors do indeed provide inherently secure products, or at the very least offer the software applications and hardware that you can use to secure the products under your own initiative.

End users must also require vendors to provide a plan for configuring the security software and operating systems, server hardware and the protection systems for those tools. If the configuration solution is weak, hackers and criminals will find ways to access the equipment. From there, they can break into your building and your firm’s IT system.

Deleting the default data

As security risks and vulnerabilities change, it’s very much the case that Security Departments develop new ameliorating strategies and tactics.

With security threats and vulnerabilities now converged, they’ve created a host of new opportunities for internal and external hackers to find – and take advantage of – weaknesses. How might security managers respond?

Dave Tyson outlines the way forward

50 www.risk-uk.com

oday, a criminal gang thousands of miles away from your company’s offices can travel over the Internet, break into your building, steal intellectual property, turn off your surveillance cameras and unlock doors protected by an access control system.

When you discover the plundered databases and the unlocked doors, you might think the thief broke in by defeating your physical security systems and waste your time in trying to strengthen them when instead you ought to be bolstering your IT security systems.

Of course, that scenario also works the other way. Criminals can break into your building and IT Department and carry away a couple of servers housing the personal information of thousands of your customers.

T

Threats and vulnerabilities The point is that security threats and vulnerabilities have converged. Weaknesses in physical security technology place your IT data at risk just like weaknesses in IT security place your company’s physical assets in jeopardy.

How, though, has this situation occurred?

Advancing technology has improved cameras, access control systems, intruder alarms and other physical security technology immensely thanks to a plethora of new inclusions and capabilities, including IP features that enable you to plug these devices into an IP network – an IP network which, it must be said, is vulnerable to hacker exploitations.

A handful of physical security equipment vendors have focused on the problems created

Take the time to set and maintain robust user IDs and passwords in your video cameras.

Equally important, don’t forget to delete the default user IDs and passwords set in the factory by the manufacturer. There are only a handful of factory settings and attackers know them all. If you don’t delete the default data, an attacker will be able to break into the cameras.

In addition, physical security devices contain programmed sets of rules that actively direct their operation. For example, when an employee presents an access control card to a reader, the system is programmed to search the current end user database for that employee’s name and door permissions. If the employee’s name is in the database along with permission to access this door, the system will unlock it.

No permission, no entry.

You have to protect the rules programmed into your devices by encrypting them. Attackers can access and re-write unsecured rules. There are several types of encryption used to protect rules. Whatever type you use, you must then secure the encryption itself against tampering.

The IT Department’s security people can help to protect the logical components of physical security technology. They will want to help as they harbour an abiding interest in protecting physical security pathways towards the company network. After installing and configuring physical security software, it’s a good idea to have a qualified technician test the strength of the lock by trying to break in. If the tech can break in then so can a skilled hacker. Physical and IT security consultants can also assist with this task.

Just as the IT security personnel will help secure physical security devices to protect their

In the Spotlight: ASIS International UK Chapter

network and data from attackers, so too the physical security staff will help protect the IT system from becoming a path towards keycritical physical security systems and devices.

One way in which physical security can help directly is to monitor for rogue hotspots while on patrol. Can security officers do that? Yes. With some training from IT, those officers may carry inexpensive sensors that will detect hotspots passed during normal patrols. The IT security staff will know which locations are legitimate and which are not.

In the IT Department itself, new and better tools can detect and mitigate attacks on the network. Some attacks may even be stopped before serious damage is allowed to occur.

A physical fence protects the perimeter of a company’s location while firewall technology will do the same at the edge of the IT network.

In fact, multiple layers of firewalls protect departments. Today’s advanced firewalls and other security tools also enable administrators to watch network traffic and spot threats as they arise, whether they emanate from a hacker or an unwitting user being compromised.

Purchasing managers ought to focus on vendors that provide security for the devices they sell: computers, servers and monitors. In fact, any device that connects to the network.

As noted earlier, physical security devices must have inherent security as well.

For the larger networks at risk from debilitating Denial of Service attacks, current defensive software applications can spot intrusions almost as they occur and talk to filtering applications located at ISP sites. The filters can block the bad data and pass the good data through, thereby maintaining the normal flow of business.

“Physical and logical security professionals have always tried to provide the least amount of security necessary. After all, too much security can slow down the pace of business” Not long ago, for instance, a system operator in a large multinational company came up with an astoundingly anti-secure idea. He outsourced his job to an individual working in another country known for providing outsourcing services. The sysop surfed to a website offering outsourcing services and hired someone to do his work for a small percentage of his salary. He provided this individual with his user name and password – a major security breach – and trained him to do his job.

Next, the employee installed a webcam and created a Virtual Private Network (VPN). He secured the VPN with a VPN token and started a pornography business. He collected pornography from online sites and sold it to customers that he rounded up. This has happened on a number of occasions in recent years. Some have started pornography businesses. Others have come up with somewhat more tame business ideas.

Whatever the focus of the host business, employees outsourcing their roles can not only commit fraud against their employers, but they also create major security breaches that may well end up costing the business substantial amounts of money.

Convergence has rendered a whole new set of security problems possible, in turn making more and more security necessary.

Asking the question once more, how much security is necessary in the era of convergence?

Wherever the line is drawn, it will certainly be at a level higher than it has ever been before.

Dave Tyson CPP: President of ASIS International and Senior Director of Global Information Security at SC Johnson & Son

What’s needed? More security In today’s era of convergence, the security profile of a facility is dramatically different.

Physical and logical security professionals have always tried to provide the least amount of security necessary. After all, too much security can slow down the pace of business coming through the doors and travelling across the network. While minimum security remains the goal, the convergence agenda has created a host of new opportunities for internal and external hackers and criminals to find – and take advantage of – vulnerabilities.

Plugging these new holes increases the security effort required. How much more security does this entail, though?

Security professionals are looking for that point, but it’s difficult to find today at the beginning of what is a very new era.

51 www.risk-uk.com

Risk and Brand Management: Strategies for the Hotel Sector We soon realise the true picture and set about the disengagement process of our teams from the faceless and latest ‘VIP client’.

Wherever possible, we’ll notify third parties whom we can see are engaged either as participants, sponsors or providers of some kind of service to support the event. Alerts are then cascaded throughout our sector as a prevention and warning to others.

In truth, the scenario outlined here is a frequent occurrence. It’s often the case that vast sums of money are paid to third party agents for flights, accommodation and tickets for events that simply don’t exist. The hotel venue is contacted and arrangements discussed purely to make it appear legitimate.

Indeed, attempts at defrauding individuals or marketing a fraud wrapped in the confidence of a well-known and respected major hotel brand are not new. To be blunt, this kind of nefarious practice has history.

Fraudulent events, privacy breaches, attempts at circumventing secure physical access, brand and reputational damage, cyber crime, acts of terrorism and political unrest. These are but some of the risks facing security professionals operating in the hotel sector. How might such threats be effectively managed?

Darren Carter adopts a strategic approach

52 www.risk-uk.com

icture the scene. The latest proposal from an event organiser arrives at the top of my Inbox. ‘For Your Perusal’ is the subject line of the message. There’s a conference programme on the horizon put together with a view to discussing matters pertaining to global warming. Attendees are set to be the world’s leading authorities on the subject.

The event is scheduled to run across three days. The basic requirement is for fully-serviced conferencing facilities and accommodation to suit 180 delegates. Make no mistake that this appears to be a highly attractive piece of business for our company. Very profitable. It also fits in nicely with our Corporate Social Responsibility agenda and so on.

Of course, it’s all very well to be dialled into the business, keep track of the commercial activities and help in maintaining a sharpened edge to our offer, but what we’re really talking about with cases such as this is risk reduction.

As we peel back the gloss we begin to see the murky reality of what lies beneath. In fact, it’s an elaborate scam which has already successfully captured and reeled in academics, Government agencies and private sector professionals from around the world.

Papers have been submitted, flights are prebooked and hotel rooms secured. There’s a tangible buzz around the event which is still ten months away.

P

Constantly evolving scenario The security of hotels, the role of security teams within them and the day-to-day work of the head of security function across a group of hotels – or, indeed, a large iconic hotel – continues to evolve at pace.

Fraud – or attempts to commission it – emerges in many forms. As much as 70% of fraud perpetrated across the hotel and travel sector will have originated online. That said, not all forms of fraud have taken great leaps of advancement. Counterfeit currency and payment cards offered in retail bar and restaurant spaces are not uncommon. It follows that we must invest time in training and educating our personnel teams to both detect this type of fraudulent activity and ensure that they respond both effectively and efficiently.

Now, though, my focus turns towards preparing for a product development meeting.

Advanced plans are on the table for a significant new ‘urban resort’ hotel in central London. Although it’s still a few years away from the official opening of this development, our minds necessarily leap into the future in a bid to determine the needs of our customers and staff members alike.

Remaining attuned to the latest guest service experiences and innovations in our sector is an absolute necessity. The development of

In the Spotlight: ASIS International UK Chapter

electronic and physical security solutions is rapid, of course, and it can be tempting for hotel security professionals to capture systems and duly propel them into service in order to maximise their appeal and capitalise on what’s deemed to be a ‘brand differentiator’.

Such a strategy may work for a few months before complications emerge. System reliability becomes a problem. Things fall apart. We’ve all seen the procurement disasters of some high profile public sector projects of late. It’s fair to say that the private sector wouldn’t have been nearly so absorbent.

Taking advice from trusted partners, seeking evidence and endorsement is all part of the process. There’s also a fundamental principle at play which is always worthy of note.

Do not try to be clever or cutting-edge for the sake of being seen as ultra-modern and innovative. If the proposed solution doesn’t work it could end up being extremely costly and deeply damaging.

Preserving reputation and brand Like many others, the hotel industry makes huge investments in creating, building and maintaining an image. A brand identity. A formula that’s immediately attractive and affordable for customers but equally sustainable – and profitable – for the business as a whole.

Preserving the reputation of a brand is the mission of an entire workforce, of course, but the role of the hotel security manager in all of this is critical. Not normally an expert marketing guru or a media-savvy sensation, he or she will spend much of their time managing activities that could significantly harm the reputation and profitability of the brand if not dealt with effectively.

Hotels are crowded places. For their part, city centre hotels are attractive prospects for petty criminals and bag snatchers. Deep understanding of how spaces are used and who populates them helps to determine how best to manage the risks presented.

Allowing low level crime to flourish or even exist is likely to have a potentially damaging and long-lasting impact on the brand.

What’s not unique but is very much key to our industry is the need for us to preserve the reputation and image not only of our own businesses but also that of our clients’ companies. Whether you’re talking about a private individual leisure guest or the members of a large international corporation, their stay should never be seen as simply a transaction.

Those who choose to spend time with a particular hotel do so on the basis that they

have full confidence in that business to meet their service needs. The product offering and facilities fit their specific requirements and, more importantly, they place their trust in the hotel business to fulfil their expectations.

This being so, it’s not surprising that, in today’s environment, the safety and security needs of a potential client play an everincreasing role. What about the corporate guest identifying conference space for a series of small, commercially sensitive meetings? Then there’s the company looking to host a largescale AGM or product launch.

Addressing ‘The Privacy Agenda’ Full service hotels in the UK can all demonstrate extremely advanced and sophisticated fire, life safety and security systems. This is a minimum expectation, and rightly so. Also of paramount importance to a hotel guest is their privacy. This doesn’t suddenly stop at the door to their bedroom, and the physical environment in hotels has been developed over many years to ensure absolute minimum interference with a positive guest experience.

Attempts at accessing personal information have certainly increased over recent years. We recognise this at a very basic level with ongoing attempts to obtain payment card information via voice calls to various business departments.

More sophisticated efforts arise in the form of embedded links within e-mails that contain malware. We’re also familiar with phishing emails masquerading as having been sent by well-known High Street banks.

There have been various Denial of Servicestyle attacks on communication systems and attempted diversion to criminal groups again seeking to harvest payment card data. Even if it’s reasonably small in scale, any data breach might endanger a hotel group’s relationship with multiple clients and pose significant risks to future commercial opportunities.

Key to any risk reduction programme will be communication and the thorough training and education of staff across all business departments and at all levels.

Cyber-focused criminality, for example, is an area that requires intimate and expert knowledge on the part of systems and network managers while also demanding end user awareness via detailed mandatory training.

Darren Carter MSyI: Head of Security at the Edwardian Group and Hotel Sector Lead for ASIS International’s UK Chapter

“Allowing low level crime to flourish or even exist is likely to have a potentially damaging and long-lasting impact on the brand” 53 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

Preparing for Operations in Kazakhstan ention Kazakhstan to most people in the UK and they would probably respond with any number of Borat Sagdiyev-style sayings once voiced by Sacha Baron Cohen’s popular fictional character who ‘retired’ from our television screens way back in late 2007.

Many of those quizzed wouldn’t even know where the country – the ninth largest on the planet by land mass, in fact – is located.

In terms of a brief history and geography lesson, Kazakhstan obtained independence from Russia in 1991. Although located in central Asia, the country prefers to describe itself as a Eurasian nation by dint of the fact that its western regions are actually located in Europe.

Imparting a little more detail, China sits immediately to the east while the so-called ‘Stan’ countries – ie Uzbekistan and Turkmenistan – reside to the south.

Politically speaking, President Nazarbayev has been repeatedly elected since independence and, indeed, recently polled no less than 90%-plus of the votes cast in this year’s election. This is one of the factors as to why Kazakhstan is seen by many to be both a calm and stable democracy: one that’s ‘friends with all and enemy to none’. Why, though, is it of such interest to security professionals and the security profession in general?

The simple answer to this question involves oil and gas. The oil and gas industry is the main reason for Kazakhstan’s economic success over the past two decades and, in order to maintain its effectiveness, joint ventures have been created with several international partners.

The international providers rely upon the expertise of expatriates and, in order to protect them, there’s a definite need to understand what ‘real’ threats actually exist when operating in the region.

Corruption appears to be endemic and allegedly spreads from the highest levels of Government to lower-level civil servants and the police. There’s anecdotal evidence to support these assertions, with Transparency International ranking Kazakhstan as the joint 126th most corrupt country in the world (out of 175 declared nations).

Although there have never been any direct accusations of corruption levelled at the President, some of his wider associates have been linked with alleged corruption.

With stories of political positions allegedly being bestowed through patronage as opposed to competency, the opportunities and ability for

M

Viewed by many commentators as a calm and stable democracy that’s friends with all and enemy to none, Kazakhstan is the former soviet state located to the east of the Caspian Sea and directly south of Russia. Why, though, is the country of so much interest and intrigue to today’s practising security professionals? Andy Davis investigates corruption to occur may not only exist but could also flourish.

The prospect of organised crime may be listed as ‘medium’ on the chart. While organised crime can go hand-in-hand with corruption, it’s not always as visible as it appears in other countries. However, that doesn’t mean it doesn’t exist in Kazakhstan.

The country sits on the northern supply route in terms of heroin that’s leaving Afghanistan destined for Europe and China (a route said to be worth $20 billion per annum). As this falls on the old ‘Silk Route’, other commodities – including electronic goods and minerals – are also on the ‘hit list’ for potential smugglers.

Wherever heroin reaches the Kazakh markets, there’s an increase in drug-related deaths, street crime and gang violence, although this is similar to the case pertaining in many UK cities.

Climate, violence and bureaucracy Probably one of the biggest threats that can directly impact safety and security in Kazakhstan centreson the extreme climate swings, from +40 degrees centigrade in the summer down to -40 degrees in the winter.

While most international organisations operating in the country provide suitable protective equipment designed to handle these extremes of temperature, they do directly

Andy Davis MSc CSyP FSyI CPP SIRM: Owner and Managing Director of Trident Manor, a Member of ASIS International’s CSO Round Table Leadership Development Committee and the Technical Committee/Working Group for Investigative and Risk Assessment Standards

49 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

“Kazakhstan’s economy never truly recovered from the global economic downturn of 2008 and, with the price of oil sitting at around $50 per barrel, there’s clear evidence of a massive slowdown in development within the extractive sectors” impact operational abilities whether through an increased risk of dehydration or sunstroke through to frostbite and the cancellation of flights and ground movements.

The Kazakhs are a tolerant society and, while violence exists, it doesn’t normally target expatriates. Where violence does occur, in many cases it’s due to cultural insensitivities, notably towards the Kazakh females, or during the course of street crime. Violence exists, but no more so than it does in western countries.

Although several aspects of the Kazakh nation are forward-thinking, it’s also fair to state that many of the governmental procedures and processes are embedded within the soviet mentality, in much the same way that India is still referred to as having a colonialstyle civil service. Until December 2017, UK citizens can visit Kazakhstan without a visa, although stays must not exceed 15 days.

Different rules exist for working in Kazakhstan.

Of late, there have been several reported cases where expatriates’ visas haven’t been renewed due to the expatriate/national employee ratio being deemed too high in favour of the former.

Risks in the supply chain Aside from limited access via the Caspian Sea, Kazakhstan is landlocked and, as such, the choice of supply paths is curtailed to a few land-based routes, air transportation or the Russian inland waterways.

All supply routes are threatened by the weather, with the freezing of the waterways for between four and six months of the year and land/air routes being affected by the temperature extremes mentioned previously.

Basic infrastructure – ie roads, drainage systems and the rail network – varies throughout Kazakhstan, with areas in the east being well maintained while other parts of the country suffer from potholed roads, lack of drainage and airport closures (in the case of the latter, most notably during the winter).

Using the UK Government’s established threat levels for potential terrorist activity, the risk of terrorism in Kazakhstan falls somewhere between ‘Moderate’ and ‘Substantial’. This might be an area where others disagree. The justification for this assertion is that, although Kazakhstan experienced terrorist attacks in

50 www.risk-uk.com

2011 at the hands of ‘Jund al Khalifa’ (Soldiers of the Caliphate), those episodes were relatively unsophisticated and limited in sustainability. Since the robust response to these attacks, there have not been any successful terrorist strikes against targets within Kazakhstan.

Terrorism and political succession Kazakhstan’s security services have adopted a robust approach to managing terrorist risks which appears to have served them well, at least until the present moment, but without wishing to sound contradictory, the current threat is as it is because of a number of factors, among them the approach of the security services, the social non-acceptance of terrorism and economic benefits previously experienced.

Two factors would lead us to believe that, in future times, the terrorism threat is going to increase. These are the economic downturn and the ‘fall-out’ from Kazakh Islamic fighters.

Kazakhstan’s economy never truly recovered following the global economic downturn of 2008 and, with the price of oil sitting at around $50 per barrel, there’s clear evidence of a massive slowdown in development within the extractive sectors. This has resulted in increased unemployment, or at the very least a distinct lack of employment opportunities. In turn, that landscape has the potential to engender increased social unrest and the opportunity for that social unrest to be exploited by radical elements.

The second factor revolves around the number – believed to be near the 400 mark – of Kazakh fighters presently classed as foreign fighters. These fighters are active in Afghanistan and within the newer combat zones of Syria and North Africa. It’s anticipated these fighters will return home and bring with them newly acquired skills and experiences that can be used against the Kazakh Government as well as international targets.

Kazakhstan hasn’t known life without President Nazarbayev and there are no clear succession plans in place. While Kazakhstan is a democracy, the ruling political party has no clearly identified future leader. Many of those favoured have either been found guilty of wrongdoing or physically fled the country.

Given this state of political uncertainty, a void may be created that could be exploited by individuals or organisations and lead to civil unrest in tandem with internal feuding.

Without addressing the succession issue while President Nazarbayev remains in relatively good health, the chances of a smooth transition of political power will be reduced.

In the Spotlight: ASIS International UK Chapter

ASIS/ANSI/RIMS and Risk Assessments eveloped by ASIS International in conjunction with the Risk and Insurance Management Society (RIMS)* and accredited by the American National Standards Institute (ANSI), Risk Assessment Standard RA.1-20151 highlights the timeliness of ‘getting risk management right’.

The document is complementary to the ISO 31000:2009 Risk Management Standard2 and provides a generic model for conducting risk assessments (including impact assessments).

The strength of the standard is drawn from the expertise and input of more than 250 crossdisciplinary international security practitioners.

On that note, Dr Marc Siegel (commissioner for the Global Standards Initiative at ASIS International) commented: “Just like an Italian recipe, the standard tells you what to think, but lets you tailor the approach to the needs of your organisation.”

The standard itself is set out in seven chapters – followed by seven appendices – comprising detailed guidance for applying risk assessments and potential treatments. The document begins by introducing the important principles involved: impartiality, independence, objectivity, trust, competence and due professional care, honest and fair representation, responsibility and authority, a fact‐based approach and the need for buildingin change management and continual improvement to risk assessments.

To elaborate, the section on trust, competence and due professional care focuses on ensuring that activities in risk assessments are conducted with “honesty, integrity, diligence and responsibility”.

Also, RA.1-2015 states that the “assessor’s technical competence and integrity” should provide “confidence” for interested parties. In the context of this standard, competence concerns the ability to apply the “knowledge, experience and skills to achieve the intended purpose and accurate results”.

D

Professional care and integrity Due professional care should be exercised when risk assessments are conducted along with integrity which “provides the foundation for professionalism and trust”. An awareness of – and compliance with – applicable legal, regulatory, safety and security requirements should be demonstrated.

The standard also recognises that many organisations may have an established Code of

Security and risk specialists are tasked with making informed risk management-based decisions. With future threat scenarios often difficult to predict, though, this process can sometimes prove to be a difficult task. Thankfully, the new ASIS/ANSI/RIMS standard focuses specifically on risk assessments. Dr Allison Wylde has the overview Ethics in place that sets standards of conduct in the performance of work and that, in order to instil trust, an assessor’s ethical principles and integrity may be codified by a formal set of ethics (including the overriding need to address issues of practitioners’ “competence, independence, diligence, honesty, integrity, impartiality and confidentiality”).

The standard continues by presenting sections on managing a risk assessment programme, including the steps involved in understanding the organisation and its objectives, establishing the framework, configuring the programme itself, implementing the risk assessment programme, monitoring the same and then reviewing it with a view to making improvements.

The following section sets out the processes involved in performing individual risk assessments. There’s plenty of interesting discussion around planning and then conducting the risk assessment activities followed by an overview of post-risk assessment activities. This section also includes the necessity of confirming the competence of risk assessors. The final section addresses issues surrounding competence.

Dr Allison Wylde FRGS DIC (Imperial): Member of the ASIS International Commission on Standards and Guidelines

49 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

*Founded in 1950 and headquartered in Manhattan, the Risk and Insurance Management Society is a professional association dedicated to advancing the practice of risk management.

The organisation represents over 3,500 industrial, service, non-profit, charitable and Government entities across 60 countries worldwide and serves more than 10,000 risk management professionals based around the globe

References 1ASIS/ANSI/RIMS (2015), ‘Risk Assessment Management Standard’, ASIS International 2ISO 31000:2009 ‘Risk Management’, ISO Copyright Office 3Talbot J and Jakeman M (2009): ‘Security Risk Management Body of Knowledge’, Systems Engineering and Management Series, Wiley 4ISO 31010:2009 ‘Risk Management: Risk Assessment Techniques’, ISO Copyright Office

The appendices set out the detailed risk assessment methods, starting with conducting a risk assessment, the data collection and sampling (including the types of interactions, assessment paths and sampling methods). The second appendix considers root cause analysis, focusing on techniques and the key ten steps to take. The third appendix centres on background screening and security clearances, with detail around background checks and procedures, interviews and privacy protection.

The next two appendices set out the detailed contents of the risk assessment report together with issues of confidentiality and document protection. The final two appendices include examples of risk treatment procedures that enhance resilience of the organisation, such as the procedures of prevention and mitigation, response, continuity and recovery. The final appendix is all about business impact analysis.

Designed as a useful resource for security and risk management practitioners, the appendices provide a wealth of detail.

Root cause analysis Root cause analysis was developed in the safety and engineering disciplines and traditionally associated with ‘after the event’, rearwards-looking reactive assessment following a major risk event or loss. In contrast, RA.1-2015 presents a root cause analysis approach to forecasting risks by drawing from the technique’s investigative capabilities.

Following on from a significant loss as a result of a process failure resulting in damage or injury, or a planned activity that has failed to achieve its outcomes, a root cause analysis may be conducted to identify any trigger and/or failure modes. For reference, a trigger is viewed as ‘something’ that may cause ‘something

“Root cause analysis was developed in the safety and engineering disciplines and traditionally associated with ‘after the event’, rearwards-looking reactive assessment following a major risk event or loss” 50 www.risk-uk.com

unwanted’ to occur. It may come about – as an unintended consequence – due to a change management programme.

The simplest form of root cause analysis is most useful in examining basic cases of failure and undertaken through the process of ‘Five Why’s?’ (5W). The 5W approach is based on systematically asking ‘Why?’ a factor may have contributed to an event. This process continues by asking ‘Why?’ until such point that the process is exhausted and no further explanation can be identified.

More complex failure events may require a ‘Cause and Effect’-style Ishikawa approach involving the classic fishbone diagram. Here, the ‘Cause and Effect’ factors are mapped out to the multiple risk drivers that may be involved, subsequently allowing for a somewhat more detailed analysis.

RA.1-2015 illustrates the benefits of using root cause analysis techniques on a strategic basis to identify potential sources of risk. By developing a picture of potential risks, planners are able to better incorporate risk treatment activities right up front rather than as an ‘addon’ after the fact. This ‘up front’ approach shifts the question from what caused the problem to what might cause something to fail, allowing the more important question of what will cause something to succeed to be explored in greater depth. This type of analysis can also draw on other well-established management analysis tools like a force-field analysis – specifically designed to identify the drivers in the business environment – and influence analysis.

Finally, how root cause analysis can potentially help a forecasting analysis to identify solutions following the study is then explored. To summarise, investigators are encouraged to seek answers to the identified issues and, in doing so, may identify potential unintended consequences as well as potential untapped success drivers.

Toolkit for risk managers The inclusion of analytical tools and techniques in RA.1-2015 offers a welcome toolkit for risk and security managers.

It’s also worth bearing in mind the ‘bow tie’ approach. This provides a visualisation – in the shape of a bow tie – which helps the analysis and identification of causal relationships that may exist around a particular risk or threat3.

Taken together with ISO 31000:2009 and ISO 31010:20094 on risk assessment methodologies, RA.1-2015 certainly offers a comprehensive approach to risk assessment, allowing practitioners to address their own organisational needs, practices and contexts.

Private Investigations: Potential Pitfalls of Outsourcing Protection Act is one of the most complex pieces of legislation with which we’ve ever been confronted. Its complexity derives from the horizontal effect it has on almost everything we do. In the case of Naomi Campbell versus Mirror Group Newspapers (2002) EWCA Civ No: 1373 Paragraph 72, Lord Phillips described the Act as “a cumbersome and inelegant piece of legislation.” He commented that, in the first instance, the High Court Judge had described the Act as being akin to “weaving his way through a thicket”.

Fog of legal uncertainty

No matter how you package it, an investigation will be an intrusion into a person’s privacy. For this intrusion to take place there has to be a lawful basis upon which it is founded.

As Chris Brogan suggests, the investigation conducted must be ‘reasonable and proportionate’ and in accordance with Article 8 of the Human Rights Act 1998

52 www.risk-uk.com

he Human Rights Act isn’t an immediate problem if you’re not a ‘public authority’.

However, if the outcome of the investigation ends up in a Court of Law or a tribunal situation then these are very much public authorities and, as such, the Human Rights Act will be considered.

In essence, an investigation involves collecting information about a ‘living human being’. Due process will bring this information within the definition of the Data Protection Act 1998. It follows, then, that any investigation should be compliant with the Data Protection Act. Also, the investigator to whom the task is sub-contracted ought to have more than just a passing acquaintance with this Act in addition to knowledge of other privacy laws.

Over the years, investigators have complained that the Data Protection Act has prevented many of the enquiries they need to make. Is this really the case? In truth, the Data Protection Act doesn’t stop you doing anything.

What it does do is impose certain conditions upon you before the processing of an individual’s personal data can take place.

Satisfy these conditions and most of the perceived ‘problems’ disappear.

Those conditions are not insurmountable.

They’re just very complex. Indeed, the Data

T

In a two-page article it’s not really possible to provide you with a definitive pathway through the fog of legal uncertainty created by this cumbersome Act, but at least let me try to identify some risks you may not have considered before you decide to bring an external investigator into the equation.

The investigator is acting for you, the client, and owes you obedience and a legal Duty of Care. This legal Duty of Care is created by the legal contract into which you have entered. As you’ll probably be aware, the common law definition of ‘Contract’ is: ‘Offer, Acceptance, Consideration, Legally Binding’. If any of the clauses are missing it’s not a valid contract.

You’ll be asking the investigator to process personal data as defined by Section 1 of the Data Protection Act. The investigator will be your nominated data processor. This is a legal relationship which has to be ‘evidenced in writing’ (Data Protection Act, Section 1, Part 2, Paragraph 12) and raises the question: ‘Does the absence of a clause creating this legal relationship invalidate the contract?’

We must leave that discussion with the contract lawyers, but you might want to pose the question to your in-house lawyer.

If the creation of this legal relationship hasn’t been evidenced in writing, is the investigator a data processor? If he/she is not, then is he/she the data controller and, if so, on what part of the Data Protection Act is the client relying to justify the transfer of the subject of enquiry’s personal information to this third party (ie the investigator)? A breach of the Data Protection Act may well have taken place.

An individual (ie the investigator) not entitled in law is in possession of a person’s ‘personal

In the Spotlight: ASIS International UK Chapter

data’. This breaches Principle 7 of the Data Protection Act which is focused on the security of personal data. Personal data is being processed on an unauthorised basis, and is therefore an unlawful procedure (representing a breach of Principle 1 on fair and lawful processing). The data subject is not aware of this ‘stranger’ who has unauthorised possession of his or her personal data. That particular scenario is a breach of Principle 6 detailing the rights of data subjects.

How many more breaches need to be identified before the defendant’s lawyer raises the argument to the Judge/Magistrate/tribunal that this evidence against his or her client represents a breach of Article 6 of the Human Rights Act? “These are clear breaches of the Data Protection Act 1998”… “How can it be fair if the evidence against my client has been gathered unlawfully?”

The investigator’s contract Let me pose another question to you. How many of you include the Data Protection Act clause creating this legal relationship in your contracts with investigators? It’s the responsibility of the client (ie the data controller) to ensure that his or her data processor (the investigator) complies with Principles 1-8 of the Data Protection Act. In the mainstream media, we constantly witness reference to loss of data and the consequences of that loss. Principle 7 of the Data Protection Act imposes strict criteria for safeguarding personal data that the client must insist is followed at all times by the investigator. The investigator is acting on the client’s behalf. If he or she messes up then the client has messed up.

The client’s defence is likely to be that the investigator stepped outside of their Terms of Reference. Did he or she sub-contract any of the enquiries? Did you give him or her permission to do so? Is the sub-contractor knowledgeable about the Data Protection Act and the other privacy laws impacting the investigative process? Are these points clearly addressed in the contract?

Could your organisation’s reputation rest in the hands of a sub-contracted investigator whose existence you are not even aware of?

That has to be bad business in anyone’s books.

Many of you who work for large companies will have an in-house Security Department that provides investigation services to the group companies. At first glance, you might well adopt the viewpoint that what you’ve read so far doesn’t need to concern you, but just consider this argument for a moment.

As part of the security team, you’re employed

by ABC plc. You’re often instructed by associate or subsidiary companies. Each of the companies may be ‘profit centres’ and, as such, you operate an internal billing system.

You are a separate legal entity from your associate/subsidiary companies. Fact (as referenced by the Companies Act 2006). You are therefore being instructed by a separate legal entity and the relationship of data controller/data processor needs to be addressed. If it isn’t then the above issues could apply.

Government licensing We’re repeatedly informed that, any day now, private investigators will be licensed under the Private Security Industry Act 2001. This would mean that, if the activity of private investigation is provided without there being a licence in place, the investigator and his or her client could be committing a criminal offence.

It would seem obvious that an external investigator will need a licence, but if your Security Department is providing an investigations service to your associate/subsidiary companies under contract (possibly with monetary reward as a byproduct) then you and your colleagues may need to be licensed as well.

This argument has been raised with the Security Industry Authority by my good self on nine separate occasions over the past eight years – and all the way to the top of that organisation – with regard to all licensable activities under the Private Security Industry Act 2001. On each of those nine occasions, assurances have been given that the matter will be looked into and a response forthcoming. It has yet to arrive in my Inbox.

If my submission is correct then this nonlicensing under the Private Security Industry Act 2001 is likely to be a further breach of the Data Protection Act, not to mention Articles 6 and 8 of the Human Rights Act (with not only the consequences of breaches of the privacy laws, but also possible prosecution for a breach of the Private Security Industry Act 2001).

At the very least, you could be facing a criminal action if you’ve not ensured that your external investigator is licensed and that he or she doesn’t sub-contract any part of the assignment to a non-licensed investigator.

Chris Brogan MA LLM MIBA FSyI: Partner at B&G Associates

“Could your organisation’s reputation rest in the hands of a sub-contracted investigator whose existence you are not even aware of? That has to be bad business in anyone’s books” 53 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

In Search of ‘Collaboration, Not Isolation’ ollowing on from my presentation to a NATO public-private partnership Working Group some years ago, its chairman David Kamien asked me to flesh out my ideas and offer a UK perspective within the publication he was editing at the time – namely McGraw-Hill’s Homeland Security Handbook.

A rather unusual request given that this was an American production. On that basis, I spoke to David about his reasoning. He duly said there were plenty of articles in existence speaking about specific organisational threats and risks and how these issues are addressed internally, but seldom do they examine the wider context. More specifically, how public and private sector partners can work in collaboration to reduce their collective risk.

An excellent news item by Brian Sims appeared on Risk UK’s website (www.riskuk.com) back in June. The article – entitled: ‘Police and Security Group consultation highlights routes towards more effective collaboration’ – focuses on the Police and Security (PaS) Group initiative in London. It states: “A closer examination of the barriers and enablers to successful partnership working reveals that almost 30% of respondents cite communication and information sharing as being absolutely key to making collaboration between the police service and private security more effective. In tandem, perceived lack of trust and staff changes have been highlighted as potential barriers to success.”

The article goes on to comment: “In terms of aspirations for the PaS Group, there’s an obvious desire highlighted to improve communications, make intelligence sharing easier and enhance attitudes and mutual understanding that will encourage trust. There’s also a call for focused training.”

F

Insight on the national context As someone who feeds into the PaS Group and represents Susannah Fish OBE, the National Police Chiefs’ Council (NPCC) Lead for Business Crime Reduction and Private Security Industry Liaison, it’s appropriate for me to provide Risk UK’s readers with an insight into the national context for these areas and show how the 43 police forces in England and Wales are actively collaborating with the business community to design a public-private partnership response for all aspects of business risk.

Nationally, the landscape for business crime partnerships is crowded with well-intentioned,

Austerity, the evolving dynamics of terrorism and an increased focus on risk are all contributing towards changes in attitudes around how to fight business crime. We’re now beginning to see increased collaboration rather than isolated pockets of Best Practice. In fact, we’re witnessing ‘Collaboration Not Isolation’, as Richard Stones explains but sometimes inconsistent approaches being applied to local business risk. Legacy practices inherited from 1980s Shop Watch and town centre-focused partnerships have, in some cases, created ‘fiefdoms’ wherein local policies have failed to recognise the changing crime dynamic while practices have failed to evolve as offending patterns change.

A few years ago, DCC Fish had a variety of businesses contacting her with a view to talking about the need for change and how, although the police and such companies were the common constituents in any business crime partnership, they had to adopt their practices to fit in with the local model.

It wasn’t uncommon for police forces to have to adopt five or more different practices in different town centres across a county policed by one force. Not a recipe for efficiency.

Consider also the perspective of the national business chain that’s expected to pay into these five partnerships to achieve five different responses to the same risk. Not really effective.

Multiply this for all similar companies across England and Wales and you begin to appreciate why businesses were rightly questioning the value of their investment in partnerships.

Richard Stones OBE MSc CSyP FSyI FCMI: National Police Liaison for ASIS International’s UK Chapter

53 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

In theory, at least, the response was a simple one. Let’s look to common national partnership standards, a way of monitoring and quality assuring those standards and the additional benefits that arise from collaboration.

National Business Crime Forum In 2010, the National Business Crime Forum (NBCF) was established. This began to pull together the various membership bodies and representative business groups in a manner that allowed all partners from all business sectors to join forces in discussing risk. Not thematic risk or single issues, but rather the wider contexts of risk and criminality.

Convergence, enterprise risk management, call it what you will. It meant that various business sectors spoke about ‘The Bigger Picture’ and how, collectively, they could collaborate to minimise risk.

The next bi-product of that, and one influenced by austerity, was the formation of the National Business Crime Solution (NBCS).

Businesses wanted a private sector intelligence ‘hub’ where they could begin to share their information in a secure, impartial environment that would allow for various data sources to be contrasted and intelligence maximised.

Gone were the days of businesses hiding behind the stock response of: ‘Oh, it’s commercially sensitive or damaging from a reputational perspective’.

DCC Fish took a bold decision. Let’s contrast police data with private sector data and see how that further enhances the intelligence picture. The fact that, collectively, we’re now charging around conspiracy and securing convictions for such courtesy of the developed intelligence from the NBCS speaks for itself.

The process didn’t stop there, though.

Recognising the need for simplified approaches towards data sharing, DCC Fish also took the NPCC portfolio for information sharing.

In the midst of all this collaboration and change was the recognition that consistency with business crime extends to working with the private security industry and gaining its support for a collaborative response to all business risk (hence DCC Fish’s NPCC portfolio for Private Security Industry Liaison).

What does all this mean, then, for the business community and how will everything

“The National Business Crime Solution has its own member Advisory Boards and collectively supports the ethical and impartial stances with which businesses and the police service need to engage” 54 www.risk-uk.com

develop for a collective benefit? Working with businesses via the NBCF, engaging with the various sectors of Oris Forums and the PaS Group, the Home Office and the British Retail Consortium, we’re now defining common national standards for local partnerships.

Let me be clear at this juncture. These standards are not intended to take away the good work carried out at the local level, but rather guide some partnerships towards a model that better allows for effective intelligence exchange and more collaboration.

In parallel, we’re working with the various security solution providers in encouraging them to continue their innovative and entrepreneurial approach towards finding technical solutions for the problems we jointly face.

We’ve also asked them to consider sharing their crime data with the NBCS in order that their clients can access a more comprehensive intelligence picture. This is not intended to undermine businesses, which must of course remain both competitive and independent, but whenever they have crime data and intelligence sat on a standalone system then their paying customers are denied access to intelligence others are willing to share.

Ethical and impartial stances To encourage sharing, though, we knew full well we had to manage the body that ultimately collates the intelligence. DCC Fish was very clear with the NBCS. It had to be not for profit, all-inclusive and independently governed before joint working would be contemplated.

The NBCF acts as the governance structure for the model. The NBCS has its own member Advisory Boards and supports the ethical and impartial stances with which businesses and the police service need to engage.

We’re also working with the College of Policing and the University of Derby’s International Policing and Justice Institute to ensure that all of our interventions are academically evaluated before we place a College of Policing badge upon them. This ensures a consistent national delivery.

To quality control the model, we’re adopting the principles of Primary Authority and locally agreeing with company head offices on nationally-applied policies and procedures that manage both business and police service expectations around, for example, crime reporting, evidence capture and staff safety.

We can all learn something from effective partnerships. Capturing their methodologies and incorporating them within the model will result in a more efficient and effective way to tackle crime on a collaborative basis.

Security Membership Organisations: Who, What, When, Why and How? these various memberships, the benefits of devoting pro bono hours on these organisations and the plus-points of me doing so for my company, myself and, indeed, the wider security community.

High risk location

In today’s security world there now exists a plethora of professional membership organisations which risk professionals might consider joining. What are the benefits of doing so, though, not just for the individual concerned, but also their employer? David Clark speaks from personal experience

52 www.risk-uk.com

ack in August last year, it was an honour for me to become chairman of the newlyformed Security Commonwealth (a group of security business sector-based organisations who wish to continually work together on advancing the discipline of security).

What surprised me was the sheer number of bodies enshrined within this Commonwealth, among them ASIS UK’s Chapter 208, The Security Institute, the British Security Industry Association, the International Professional Security Association, the Association of Security Consultants, The Worshipful Company of Security Professionals and the Fire and Security Association.

Upon reading the membership list, it was equally surprising to recognise just how many of these organisations I had been a member of in the past, the number of which I’m presently a member and, indeed, which I could possibly join at some point in the future.

This prompted me to think about why there are so many different organisations in our sector, and what the value of being an active or passive member of them is in the real world.

It was time to rationalise the memberships I’d undertaken in 2015 with the intention of articulating to my CFO the advantages of spending some of my employer’s funds on

B

To offer some context, my present role is head of security for The Francis Crick Institute, a new Biomedical Research Centre in London’s St Pancras district. There are considerable risks associated with the Institute’s research activity.

We’re located in a high risk area next to three major transport hubs and in a London environment where the usual urban crime issues are commonplace.

‘The Crick’, as it’s known, opens in May and will be transparent in its operation. To promote this fact, our building houses an exhibition space and café which is open to the general public. Due to the type of work undertaken and its strategic importance, ‘The Crick’ is on the Centre for the Protection of National Infrastructure’s (CPNI) register.

My role is about managing any risks posed to the organisation and defining the strict security strategy while maintaining our open and transparent ethos. No easy task, then. There’s nothing comparable in the UK or Europe.

For my part, I would suggest that I’m highly experienced, well qualified for the role and capable. I know a good deal about security, with subject matter expertise in some fields but certainly not all. I hope my peers would call me a generous chap who gives freely of his time to help guide, support and mentor others both inside and outside of the security sphere.

Guidance and validation Although confident in my own ability and knowledgeable, I’m fully aware that there are others far more qualified than myself. Although they may not operate in quite such a diverse organisation as ‘The Crick’, these security professionals are certainly experts in their respective fields.

At times I need guidance and validation when undertaking ambitious or otherwise demanding elements of my job. Where, then, do I go to find experts who might help me? Where can I glean advice and assistance from others willing to share the benefit of their wisdom? What forums

In the Spotlight: ASIS International UK Chapter

are available for me to participate in and share my own experiences and challenges with others in a confidential manner?

The ideal solution lies in membership organisations, both in point of fact and in terms of value. An annual membership fee is less than half that of a consultant’s day rate – apologies to all of my security consultant colleagues, with this point being made to demonstrate value for money from membership, not to illuminate high fees – while the support and advice on offer is, generally speaking, uncapped.

Membership organisations are the best avenues for achieving all of the above and ensuring that education is continuous.

Eventually, one can aspire towards becoming a subject matter expert. This may take time, but with applied learning and years of practice it’s a goal that can be achieved. Even then memberships should be retained and validation sought from fellow members when required.

To be frank, individual membership of a security organisation is where it’s at. As stated, there are many security membership organisations in existence, some of them excellent, others good and some just not currently relevant to me or my organisation.

From a personal standpoint, I’ve been a very active member of ASIS for a long time now and know the benefits to be derived, but right now I need some grass roots, dyed in the wool, sector-specific help. Who to join, then?

How should I decide which organisation suits me best and, importantly, how do I make sure that I’m eligible, qualified and, of course, welcome within the ranks?

The PISF and the PIIE The core business of The Francis Crick Institute is science, but there’s no ‘Scientific Research Security Group’ (at least not as far as I’m aware). Who, then, might be able to advise me going forward?

First of all, it’s time for a quick telephone call to an ASIS UK colleague who puts me in touch with Guy Mathias (now risk, compliance and operations director at Lucozade Ribena Suntory, but the former occupant of one of the UK scientific research sector’s most high profile security management roles). I’ve duly found an expert in the same field in which I operate, but I know full well that I cannot rely on one ‘Guy’ alone (please excuse the pun) to help me. I invite Guy to a working lunch and make it known that I want to know where he goes for wise counsel in times of trouble or when validation of an idea is desired.

Along with some very frank and candid advice, Guy recommends the Pharmaceutical

Industry Security Forum (PISF). He also arranges to introduce me to the current chairman of the PISF, namely Les O’Gorman (head of facilities management at UCB).

Les subsequently informs me all about the PISF. It transpires that all of the heavyweight pharma and science organisations are members. The PISF does exactly what I need.

Les invites me to the next meeting and then the AGM and I’m hooked. It’s a very mature and well-oiled set up with good governance.

The PISF is part of the Association of the British Pharmaceutical Industry and clearly well respected in the wider industry. It also offers ‘Masterclasses’ in a range of scientific research security subjects.

The fees are £360.00 per annum for membership, with each member organisation allowed two appointed persons, but wait...

At the AGM, Les introduces me to Elaine Johnson-Smith from Pfizer. Elaine explains that she’s the chairman of the Pharmaceutical Industries Information Exchange (PIIE), itself a CPNI-facilitated information exchange primarily focused on cyber which allows one company to learn from the experiences, mistakes and successes of another without fear of exposing company sensitivities.

Elaine invites me and my CIO to join PIIE. Amazingly, the organisation is free to join. The vetting and sign-up processes are very strict and the criteria for joining stringent.

Relevant and beneficial Both the PISF and the PIIE work incredibly closely together. They both focus on the same threats to their members, although these threats are realised by entirely different methodologies. It’s still about bad people wanting to access sensitive material.

Both of these groups know all about ‘The Crick’ and the challenges we face. They’ve conducted their research. They know all about me, too, largely thanks to some very kind words imparted by fellow ASIS members and others.

They know ‘The Crick’ is relevant and, although not a pharmaceutical company per se, we do have strategic alliance initiatives with pharmaceutical organisations and face the same threats. Paperwork filled in for both organisations, I became a member of the PIIE last September and await my formal membership of the PISF to begin this month.

David Clark CPP PSP PCI is Chairman of ASIS International’s UK Chapter and Head of Security at The Francis Crick Institute

“Eventually, one can aspire towards becoming a subject matter expert. This may take time, but with applied learning and years of practice it’s a goal that can be achieved” 53 www.risk-uk.com

Foreign Exchange: Developing PublicPrivate Sector Security Partnerships sector to blossom, the main building block is a mature private sector market.

In addition, for a country such as France, the concept of public-private sector co-operation around security isn’t as obvious as you might think. Indeed, according to the French declaration of civil rights – itself a key component of the French constitution – security can only be provided by a public force.

Across Europe since the 1950s, it’s possible to highlight the move towards security deregulation and increased co-operation between public and private sector professionals, but in France the trend isn’t quite the same. Although France didn’t have a national police force until one was imposed in 1941 by collaborators then in power, the move was never reversed and it’s only very recently that municipal police forces came to be restored. Despite this step to bring its provision closer to the citizen, security remains very much the quasi-exclusive domain of the state.

The flurry of terrorist attacks across Europe in 2015 – and, more specifically, those that occurred in Paris on Friday 13 November – highlighted more than ever the need for closer co-operation between public sector law enforcement resources and private security sector professionals.

Dr Nicolas Le Saux elaborates on this highly topical theme

54 www.risk-uk.com

ublic and private sector collaboration in the security space has been evident within the UK for some time now through great initiatives like Project Griffin in the City of London (‘Project Griffin: A Blueprint for Awareness’, Risk UK, September 2015, pp2425). Developed in response to the increasing terrorist threat, Project Griffin has long been a shining example of a balanced partnership.

At a time when public sector resources are now increasingly scarce, this type of partnership should be emulated across several countries, France among them. Indeed, as early as 2013, ASIS International’s volunteer leadership in both the UK and France began to look at ways in which to convince the French authorities to adopt such a scheme. Several Best Practice exchanges between London and Paris underlined the effectiveness of what may at first appear to some to be a rather modest initiative in the fight against terrorism.

In effect, co-operation goes beyond schemes like Project Griffin. It requires a relationship built on the solid foundation of mutual trust and respect between public and private sector players, but also among stakeholders resident within the private security business sector. It can be argued that, for strong security partnerships between the public and private

P

Transposition of ideas However, faced with ever-decreasing resources, recently the state simply had to turn towards the private security sector in order to realise an adequate security provision. Two years ago, the Office for Public and Private Sector Security Cooperation was duly created at the French Ministry of the Interior.

As stated, for some time ASIS International’s French contingent had been looking at Project Griffin. This was an obvious choice when selecting a Best Practice example which could inspire senior staff at the French Ministry of the Interior. Thanks to the help of Don Randall MBE and Graham Bassett, an inaugural visit to London was organised on the initiative of ASIS International’s Region 9A (which includes both the UK and France).

Stéphanie Bergouignan (leader of the Women in Security initiative for the French region), Eric Davoine (chairman of the ASIS French Chapter), Thierry Coudert (Préfet, Délégué Interministériel aux Co-opérations de Sécurité, head of security partnerships) and his deputy Colonel Pascal Hurtault met with the City of London leaders of Project Griffin, among them Ian Mansfield and Alex Williams. This initial exchange of views paved the way for more visits and, in particular, an in-depth review of

In the Spotlight: ASIS International UK Chapter

the Awareness Day training put in place by the City of London Police at Wood Street as well as several on-site exchanges with private security company representatives.

During the second visit, the French delegates were joined by Valérie Hatsch, chief of staff to the Préfet of Hauts de Seine, one of the busiest business areas near Paris.

Thierry Coudert stated: “Testing co-operation projects between public security forces, private security providers and municipal police services is an important innovation upon which we’re now working, and which should find practical implementations in the years to come.”

Based on lessons learned from Project Griffin, one pilot area has been identified in the business district of La Défense close to the heart of Paris where public and private sector security operations and the police are present and, indeed, face significant challenges. By way of an example, the storming of a terrorist cell near Paris in the days following the 13 November attacks uncovered a plan for a further terrorist episode in this very area.

A first pilot project, designated ‘Projet Vigie’, began last June and was expected to lead to an official launch by the end of 2015. Due to the terrorist attacks and the priority given to the response initiated around them, that launch has been delayed until early this year.

One can only hope that the tragic events of last November brought home to the French Ministry of the Interior the urgent need to or accelerating the roll-out of the programme and its extension to other areas of Paris, not to mention across France in its entirety.

At the strategic level On its own, training security officers in counterterrorism techniques isn’t enough. To develop effective co-operation, it’s also necessary to foster collaboration at a more strategic level as well as share Best Practice techniques, ideas and key intelligence on a continual basis.

In the wake of the Paris attacks, it rapidly became evident that there was a need for ASIS International members to pool the information they had to hand when co-ordinating responses and synchronising decisions. To provide our members with actual benchmarks on what was happening, and who was doing what in response to the crisis, several conference calls were set up immediately over the weekend following the terrorism episodes.

An international call allowed members to gather support from the ASIS network across the world, while also enabling ASIS International’s leadership to collate almost real-time feedback on the situation in France.

A bridge call was also set up in France to canvass updates for ASIS members and share initiatives and ideas. This proved extremely useful for our members in giving them actual data on what other CSOs, security managers and security solution providers were doing.

The bridge call idea has since been maintained on a weekly basis. Pleasingly, the Ministry of the Interior has been an active participant with a senior colonel from the unit in charge of public-private security co-operation divulging information on the present situation as well as collecting the views from a crosssection of private security professionals.

Support from the UK has been important, with input from ASIS members in Britain, but also through help provided by the leadership of organisations such as London First.

Improving staff reactions One area of concern we’ve faced in France is how to improve staff reactions in the event of terror attacks. While participating in a Project Griffin training session in London back in 2014, we identified the training video developed by the National Counter-Terrorism Security Office (NaCTSO) entitled: ‘Stay Safe: Firearms and Weapons Attack’. Thanks to the subsequent help of Sir David Veness CBE QPM – chairman of London First’s Advisory Board – and NaCTSO, we’ve been able to begin developing a French version of an active shooter training session which we plan to roll-out from this month.

Fostering co-operation between private security initiatives across Europe is a longer term goal which should be set if we want to react more constructively to the new terrorist threats as well as the more ‘classical’ ones posed by general criminality.

Several major cities across Europe have now been hit by these new terror threats. Based on experience, partnership schemes involving all key stakeholders have been developed. We aim to better leverage these initiatives by building a true information exchange and sharing network that enables us all to better react towards – and ultimately cope with – any forthcoming crisis.

One thing we’ve learned over the last few weeks and months – and in no small measure thanks to our British cousins – is that we’re not alone. We also strongly believe that successful co-operation will be realised by way of both larger initiatives and continuous small steps.

Dr Nicolas Le Saux PhD CPP: Chairman of the European Advisory Council at ASIS International

“Fostering co-operation between private security initiatives across Europe is a longer term goal which should be set if we want to react more constructively to the new terrorist threats” 55 www.risk-uk.com

Physical Access Management: Focusing on Contractor Compliance What’s needed is a solution which helps organisations in managing the entire lifecycle of a contractor by automating processes around contractor requisition and approval, access and change management, badging, termination of employment, renewals and reactivations.

In a business that needs to manage contractors’ identities and provide them with a badge and/or physical access, the following aspects must be fully considered as part of the administrative process: • are the access entitlements of contractors correct and precisely defined as per the host company’s stated policy?

• in the same vein as full-time members of staff, have contractors been properly vetted and trained before any granting of access rights?

• are contractors enrolled for – and terminated from – the use of security systems immediately upon their contract expiration, or upon termination of their employment with the business concerned?

• is there a detailed audit trail available around existing access and/or badge requisition and approval procedures?

In today’s competitive and risk-prone business environment, security professionals need to understand whether their current physical security and access management systems are capable of minimising or otherwise completely eliminating the threats posed by external contractors, as Vibhor Gupta explains

54 www.risk-uk.com

espite the fact that organisations hire thousands of contractors to carry out different kinds of work on site, security and risk management around these individuals is one area that can often be overlooked when it comes to identifying threats and minimising potential losses to the host business.

Contractors add great efficiency to the organisation as they bring specialist expertise to their role, but it remains the case that these professionals – and third party vendors – are not included in the same category as that of employees and, hence, are often not subjected to the same rigorous set of vetting policies as would be the full-time members of staff.

Since they’re an external entity, for the most part contractors simply cannot be trusted to the same degree as regular employees. They may well pose a serious security threat to the host organisation, and need to be properly vetted by way of rigid policies and procedures.

Imagine how dangerous a hostile contractor could be for an organisation if they continue to have access to a given zone or area of a company’s headquarters building after their contracted work period has come to an end?

D

Existing challenges “In our organisation, every department has its own database and process of hiring contractors, but there’s no audit trail in relation to why someone gained access to a restricted area”… These are the words of a physical security director working for a leading global electronics manufacturer. Concerning, isn’t it?

The present mechanism of managing contractors involves several manual, redundant and paper/e-mail-based steps around onboarding, background verification, training checks, role-based access determination and approvals. These processes are often executed in something of a disjointed sequence.

The access-related information is maintained in a paper/spreadsheet format, and manual updates will be made whenever changes are required. There’s usually no proper way in which to make sure that the security policies are wholly implemented as they’re enforced manually in so many instances.

Current methods usually fail to capture and manage details of various transactions pertaining to contractors, such as who requested a contractor’s attendance on site,

In the Spotlight: ASIS International UK Chapter

what was the request justification, who approved/denied the request and the reason behind the decision that was made.

Maintaining details of this complete audit trail is a manual process and involves much cost and time effort which might not be accurate. Additionally, security practitioners have a regular need to associate physical assets – eg metal keys, tokens, mobile phones, PCs and so on – with the contractors to whom they’re being provisioned.

The present means of issuing and then tracking a company’s physical assets are manual, and can lead to lost, stolen or missing assets. Organisations are required to follow the same set of external regulations or internal standards for managing contractors as they have to for organising their own employees.

Degree of effort The challenges around recording, monitoring and reporting specific details for contractors involve a significant degree of effort. That effort is very often manual in nature and, therefore, prone to human error, thereby potentially exposing the organisation to a significant level of risk as time progresses.

Such problems are further compounded in larger companies spread across multiple locations, since each of those locations will usually have its own policy in place for hiring contractors, which often results in a multitude of databases.

Due to the existence of such ‘silos’ and the fact that there’s no central database, security teams can suffer from a lack of visibility. That being so, their ability to make informed decisions around authentication, authorisation and physical access entitlements is rendered somewhat more difficult.

To assure compliance against external regulations and internal audit requirements while also complying with cost pressures, there’s a growing need within enterprises to optimise access management processes and administrative tasks for contractors.

The ‘need of the hour’ is to have a policydriven solution in place which can automate all current manual processes for the provisioning and de-provisioning of contractors and vendors, in turn ensuring that accurate verification related to contractors is both captured and stored securely within the system.

Basic capabilities A Physical Identity and Access Management (PIAM) solution follows this idea at its core.

PIAM deployments are increasing due to technology and product development,

compliance mandates, a greater desire to manage alternative user populations and a sharp emphasis on timely and secure access.

Indeed, PIAM capabilities such as a common authenticator and user provisioning are now relatively mature.

The basic capabilities of a PIAM solution are focused on: • centrally managing contractor data and making site-specific information readily available on a local basis • automating contractor management processes and providing a single web interface to allow sponsors to make requests for the onboarding and off-boarding of contractors and, subsequently, automating the approval of workflow procedures • automating security policies governing contractor management and related compliance • providing ‘audit ready’ reports and the ability to put internal controls into business processes in order to bring accountability and visibility into the overall security operation With a solid approach towards PIAM, physical security specialists can closely connect their physical and logical security infrastructures, quickly lowering operational costs, improving their compliance standing and lessening their overall level of risk.

Real world examples A global technology company gained better control by consolidating multiple contractor databases within a bespoke PIAM solution.

In another example, this time a large utility business in North America defined and enforced one set of policies for the onboarding and off-boarding of its contractors thanks to a PIAM-based solution.

Managing the lifecycle of contractors is a complex procedure, but it’s a strategically important one in order to achieve cost savings and ensure a more secure and risk-free workplace. Making certain that contractors are managed confidently and in a fair and consistent manner is extremely important for all those enterprises trying to increase performance and reduce their cost base.

A PIAM solution offers an holistic approach towards identity and access management by integrating logical security with physical security in a bid to safeguard the critical operating assets of a given company.

Dr Vibhor Gupta PhD: Technology Lead for ASIS International’s UK Committee

“The challenges around recording, monitoring and reporting specific details for contractors involve a significant degree of effort. That effort is often manual and, therefore, error prone” 55 www.risk-uk.com

Setting Standards for Private Security Companies

The new ISO Standard 18788: Management System for Private Security Operations – Requirements with Guidance for Use was issued last October, but how did it materialise and what are its most important impacts on private security companies?

Mike O’Neill trawls through the detail

54 www.risk-uk.com

he use of private security companies to provide security and logistics services in complex operating environments really began to grow throughout the 1990s.

Thereafter, the immediate period following the invasion of Iraq in 2003 witnessed a huge rise in the number of such organisations offering armed protection services to Nation States, NGOs and businesses alike.

In practice, they provided armed services including the protection of static locations, convoy escorts, security escorts for individuals and private security details to high ranking officials. Unarmed services included, for example, logistics support, operational coordination and risk analysis.

Such developments realised growing discussions and concerns focused on how these companies operated, to whom they were accountable and exactly what laws, if any, applied to them. Many of the more reputable companies themselves were looking for standards that would afford them guidance on how to protect Human Rights while maintaining rigorous security regimes for their clients.

As part of a broader drive towards providing guidance about balancing the demands of states and business with Human Rights which provided strong background to the

T

development standards specifically for private security companies, we should reference: • The Voluntary Principles on Security and Human Rights, which had been issued in 2000 as a Code of Practice for the extractive sector detailing how to maintain safety and security within their operations while always observing respect for Human Rights • The United Nations Guiding Principles on Business and Human Rights was commenced in 2005 and finally issued in 2011. This has three pillars focusing on the State’s duty to protect Human Rights, the corporate responsibility to protect Human Rights and access to remedies for the victims of abuses (‘Protect, Respect and Remedy’). For reference, these are also known as the Ruggie Principles In light of these concerns, the Swiss Government and the International Committee of the Red Cross launched ‘The Swiss Initiative’ in 2006 which brought together representatives from Governments, the security sector and civil society. They looked at the responsibilities of three different types of States: those who contract with private security companies, those whose territory they operate upon and the home states of the security companies.

The Montreux Document These efforts resulted in the issuing of the Montreux Document on 17 September 2008.

This document was the first to define how international law applies to private military and security companies operating in armed conflict zones. It’s also relevant to non-armed conflict situations, duly highlighting the obligations of States regarding private security companies during armed conflict and providing no less than 70 good practices for guidance.

Following on from the Montreux Document, the International Code of Conduct (ICoC) for Private Security Service Providers was developed by a body including States such as the USA, the UK and Australia in tandem with private security companies themselves, academics and civil society organisations.

This guidance is intended to build on the Montreux Document by setting out principles and standards for security companies operating in complex environments. It duly focuses on the protection of individual Human Rights and respect for international law.

In the Spotlight: ASIS International UK Chapter

After robust discussions held during a series of four meetings, the ICoC was finalised at a conference in November 2010. Throughout this process there was always an intention to develop an independent mechanism to oversee the compliance and accountability of private security companies, and this led to the formation of the ICOC Association in 2013.

In 2011, ASIS International was commissioned by the US Department of Defence to develop an American National Standard for private security companies which would build on both the Montreux Document and the ICoC and establish auditable criteria such that companies could gain certification to a recognised standard. This standard was deliberately framed to allow other States and non-US private security companies to adopt it.

Over 200 experts from around the world contributed to the development of the standard which was issued in 2012 as the ANSI/ASIS PSC.1-2012 Management System for the Quality of Private Security Operations – Requirements with Guidance.

The first sentence in the Scope section of the document states: ‘This standard provides the principles and requirements for a quality assurance management system for private security service providers including private security companies to provide quality assurance in all security-related activities and functions while demonstrating accountability to law and respect for Human Rights.’

PSC2, which is a conformity standard providing guidance for auditing and third party assessment services to private security companies, was issued at the same time.

Importantly, the standard was adopted as a requirement for private security companies supplying services to the US Government, while in December 2013 the UK’s Foreign and Commonwealth Office (FCO) announced that our Government would require adherence to this standard by any private security companies supplying services outside of the UK.

An international standard Due to the fact that some countries will not recognise national standards from other nations, ANSI/ASIS submitted PSC1 to the International Standards Organisation (ISO) for consideration as the basis of an international standard. ISO duly formed ISO Project Committee 284 to oversee the process of adapting PSC1 to the ISO format.

With contributions from many countries’ committees, the process of adapting and aligning PSC1 with an ISO format started in 2014. Particular care had to be taken to ensure

that the new standard was developed in line with ISO Annex SL which introduced the new high-level structure for all management system standards of the future.

Different countries had many different thoughts about key aspects of the standard that could be varied or afforded different emphasis at this stage. The UK Committee was very concerned to avoid any question that the new standard would be applicable within the UK as we already have a mature set of domestic standards for the security sector.

Finally, consensus was achieved and the new standard ISO 18788: Management System for Private Security Operations – Requirements with Guidance for Use issued in October 2015.

The first companies to be certified achieved their certifications last month.

One key sentence to note from the scope of ISO 18788 is: ‘This international standard is specifically aimed at any organisation operating in circumstances where governance may be weak and the rule of law undermined due to human or naturally-caused events.’ The UK Committee members felt that this was enough to exclude the use of this standard from being applicable in the United Kingdom.

Leading the way forward Private security companies across the UK have led the way in pushing for and adopting standards to show they’re taking Human Rights very seriously. The Security in Complex Environments Group (SCEG) was formed in January 2011. Later that year, it was appointed as our Government’s partner for the development and accreditation of standards for UK private security companies operating in the land and maritime environments overseas. The relationship is primarily through the FCO, but also works with other Government departments where relevant. An FCO representative sat on the UK Committee for ISO 18788.

There are discussions about how the ICoC will audit those companies wanting to be members. A logical solution would be accepting certification to PSC1 or ISO 18788.

Many of the civil society members wish to see even tougher criteria being required for ICoC membership, but this would cause unnecessary double-auditing and expense for security companies at a time when rates and margins are already under downward pressure.

Mike O’Neill CPP PSP CSyP FSyI: Managing Director of Optimal Risk Management

“Private security companies across the UK have led the way in pushing for and adopting standards to show they’re taking Human Rights very seriously” 55 www.risk-uk.com

UK plc on Terrorism Alert: What Does This Mean for Business?

In February, Islamic State (IS) announced to the world that it will focus its European terrorist operations on London, and claimed that the UK would receive the ‘lion’s share’ of its European terrorist attacks. This warning came in response to the UK Government’s earlier decision to extend its aerial bombing campaign against IS from Iraq into Syria, which IS claimed was a “declaration of war against Muslims”.

On 20 March, The Sunday Times informed the public that the police service, security agencies and special forces have been told to prepare for up to ten simultaneous terror attacks on the streets of London, and that the National Crime Agency has been ordered to make a crackdown on firearms a priority amid fears of a Paris-style attack by terrorists returning from Syria.

Thinking the unthinkable

The fear of crime and terrorism remains high on every corporate concern’s agenda, not to mention those of citizens. With risk and security management of crucial importance to big business and society alike in today’s world and policing budgets constrained, how might private security play a bigger role in protecting society?

Michael McDonagh focuses on the partnership approach

52 www.risk-uk.com

ast December, I conducted a review of the future of British policing and how it might feature a public-private sector collaboration approach, specifically partnering with private sector security to deliver key policing services.

My article in Risk UK (‘Collaboration: The Future Landscape of Policing and Security in the UK’, January 2016, pp22-23) provided a snapshot of the insights from this review and where I see this particular agenda progressing.

Back then, I spoke of the era of austerity, adaptation and transformation and the removal of funding streams, the downsizing of resources and a need to revisit previously held strategic views, plans and objectives. Greater public expectations, complex operational challenges and the perplexing financial context must be set against renewed political imperatives.

Some months on, little has changed my position. Overall crime, the fear of crime and terrorism is still high on every corporate’s agenda and list of concerns, not to mention those of citizens. We’ve seen the ‘In-Out’ campaign focused on the UK’s European Union membership take up much air time in the media, but recent terrorist attacks in Paris, Turkey and Brussels have refocused security concerns towards the safety of these shores, our cities and our people.

L

In today’s world, the issue of risk and security management is of crucial importance to big business and society alike.

During my years of working within the counter-terrorism protective security arena, ten simultaneous terror attacks on the streets of London was never in our planning assumptions.

The recent episodes in other major European cities have shown that we now have to think the unthinkable, explore all of our options and really prepare for the worst.

First, we need to look not only towards the police, the Security and Intelligence Services and the military, but also to the private security company personnel already protecting our capital and other major cities across the UK. Second, most large corporates, company headquarters, shopping centres and department stores have the benefit of trained, accredited, professional and willing security personnel on site who can ably assist should a terrorist attack take place.

Many of these security officers have attended numerous counter-terrorism awareness programmes, such as Project Griffin and Project Argus. A number are ex-Armed forces and more than capable of supporting a proactive operation designed to provide a safety and security presence that will deter, detect and prevent many terrorist activities. This is where private security can be used to add real value and benefit to the organisations it protects and the communities it serves so diligently.

In the Spotlight: ASIS International UK Chapter

In addition, the March Budget has witnessed further reductions in critical funding to national services. A series of carefully worded articles by senior police officers in the national press reiterate that terrorism and cyber crime are seen as constant threats but that, set against a landscape of unprecedented cuts to their budgets, they have to think more radically if they’re to tackle these issues on a safe, secure and effective footing.

Partnership approach Across the first quarter of this year, I’ve spoken with several senior police officers who want to use the services of private security companies to support, assist or otherwise complement their overstretched resources, but either for budgetary or reputational reasons are cautious about engaging with such service partners or solution providers.

Many of the senior officers I speak with are not aware that, currently, there are a number of police forces in the UK that have existing successful partnerships with the larger security companies, many of whom are providing a real ‘surge capability’ without which many of our police partners would find it challenging to provide such a financially effective and efficient service in-house. Services realised here include crime scene guarding, Control Room operations, custody support, prisoner transport and civil contingency back-up.

It’s critical that, as a sector, we recognise how the impact on police budgets is continuing to have a real influence on policing strategies and services and that, with such enormous threats being posed to national security, we all have a social and corporate responsibility to assist when and where we’re able.

Practically and in reality, then, what can private security companies do to support the UK Government and law enforcement agencies?

Organisations need to identify their vulnerabilities to actual or perceived threats, confirming what needs protecting and why.

They must remember that no security plan or programme can be truly effective unless it’s based on a clear assessment and understanding of actual risks with built-in early warning mechanisms to highlight potential issues or critical malfunctions (ie disasters).

Lines of communication Security businesses should establish strong and robust lines of communication and working relationships with local and national police forces as well as other law enforcement agencies. They must ensure they’re embedded into local business networks, partnerships and

security forums to receive the latest and most up-to-date information and intelligence in respect of any and all incidents that may be occurring in their particular sector or region.

Also, security providers should proactively review security and counter-terrorism training and awareness for all members of staff, and ensure that they’re fully prepared, exercised and ready to deal with an incident that could threaten safety and security. Further, there’s a need to review incident and crisis management policies, protocols and procedures, test escalation measures, call-out structures and systems monthly and also practice responses.

Within our organisation, we continually reflect on events through active monitoring, analysis and feedback systems. We’ve also looked in some detail at recent terrorism events across the world and, in particular, Europe.

Subsequently, we’ve taken definitive steps to provide a real-time response. These include: • forming a discreet high-level Working Group to identify the current strategic and operational threats and risks across clients’ businesses • orchestrating a dedicated 24/7 Operations Desk to monitor and respond to current threats • conducting analyses to assess, prepare and notify the resources that we have ready and available to support our clients, the police and Government agencies in case they’re required • identifying a cohort of trained and vetted Protective Services Officers to provide a ‘surge capacity’ that the police and our clients would be able to access at short notice We need to keep focusing on the next terrorist attack as well as the next terrorist development, and then review any operational weakness we need to work on to deny the terrorists any opportunity to perpetrate harm.

We all need to be prepared and ensure that we can positively answer these key questions: • Do you – and the leaders of your organisation – truly understand the current threats and risks to your business? (Analysis) • Have you validated your plans and procedures? (Validation) • Have you developed staff competencies and practised with them in carrying out their roles in the plans and procedures? (Training) • Have you tested well-established procedures (Testing) • Have you and your organisation prepared for the worst? (Resilience)

Dr Michael McDonagh MSc: Director of Policing Development at Securitas UK

“Security businesses should establish strong and robust lines of communication and working relationships with local and national police forces” 53 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

Risk Management: A Boardroom Problem harles Darwin, originator of the biological theory of evolution, once very famously wrote: “It’s not the strongest that survive, nor the most intelligent, but the ones most responsive to change”. Bear this classic quote in mind as you read on.

With business interruption, reputational damage and cyber crime now their Top 3 concerns, Boards of Directors are acutely aware that they face highly resourceful cyber criminals. It should be clear, too, that law enforcement agencies are broadly overwhelmed by the scale of the cyber crime ‘battle’, and have gradually ceased maintaining the pretence that they’re somehow defeating it.

Cyber crime everywhere is classified as a Tier 1 Strategic Threat. It stands shoulder to shoulder with terrorism, international military crises and major natural disasters. The exponential rise of computer-based crime and its global nature has created a virtual tsunami of risk. Rightly, new laws seek to force businesses to raise their defensive game and protect the data with which they have been entrusted. These laws come replete with revenue-based fines and personal liability for those stationed in control functions.

Bilateral cross-border jurisdictional agreements are becoming the norm. On that basis, it’s best you know where your liability lies. The US has been particularly aggressive about chasing foreign miscreants. We can also expect the European Union (EU) to show an increasing appetite for displaying legal muscle in the coming years.

Criminal convictions and jail time are now very real possibilities in some jurisdictions for those who are negligent with data in their custody. The EU’s new General Data Protection Regulation represents a seismic shift in the requirements placed on enterprises to protect any data they hold. The new laws will come into force in July 2018. At that point, and maybe before, we would expect the regulators to have no interest in ‘why’ something happened. If you were supposed to do something to protect sensitive data, and you didn’t do so, you will likely be for the proverbial high jump.

C

The problem… Vulnerabilities Criminals purposefully seek vulnerabilities to exploit. Those vulnerabilities can be anywhere – for example, in access control regimes, within staff training or even poor hiring policies. In short, it’s not only about your technology.

Just like cars and guns, computers are not intrinsically dangerous as objects. Inject carelessness, pressure or malice, though, and in the blink of an eye you have a completely different scenario with which to contend. Governance, proactive management, ongoing education and training are all part of the solutions mix aimed at preventing cyber breaches, as Russell Penny elucidates Any vulnerability – or combination of vulnerabilities – will do. Criminals just want to access your money, or use you as a stepping stone on the way along their wicked road. Like many, they’re motivated by risk and reward and they will follow the money.

Their language is gobbledygook. The ‘Cyber Security Industry’ loves jargon. That mystical cyber language – endpoints for devices and sockets for connections, for example – appears intended to deliberately confuse. Why use a word or two when an acronym can confuse much more easily, and particularly so when the decoded acronym might leave you as confused as the beast itself? BYOD, AFH, 3DES… They all add to the degree of impenetrability.

There’s also a ‘slack’ use of language. ‘Cyber Security’ when they mean ‘Information Security’. This might seem pernickety, but say ‘Cyber’, think ONLY ‘Cyber’ – which is probably what vendors want. That’s like starting the alphabet at F and finishing at R! The front and back are missing, but vendors have lots of technical ‘cash cows’ they want to sell you and they don’t like the suggestion that you can do a good deal for yourselves.

Just remember that the threat begins long before anyone’s anywhere near a computer. If a compromise of your Intellectual Property or

Russell Penny CPP MSyI RISC: Associations Liaison Lead for the ASIS UK Committee and Director of Human Risk and Physical Security at BeCyberSure (a Division of Bronzeye Integrated Business Risk Management)

59 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

processes occurs outside of your security perimeter, you may well never know.

Pathological secrecy Victims are desperate to avoid the reputational damage which might accompany a big cyber incident so they keep quiet whenever they can.

Frequently, the police and regulators are not informed of a breach. Maybe only 5%-10% of cyber breaches ever become public knowledge, masking the true scale of the problem and fuelling ignorance-based complacency. Even where compulsory notification is in place, if an occurrence can be classified as ‘non-digital’ in any way, it will probably not be reported.

It has been said that cyber security vendors issue propaganda and then sell expensive ‘solutions’ into it. Most vendors will not be going around selling things that don’t work, but they have a commercial imperative to sell and expensive sales teams to maintain. They also have an automated solution for everything, and then they’ll sell expensive fixes to patch the holes they created in the first place.

A complex ecosystem has evolved around this merry-go-round. What the expensive sales forces will not tell you is that there’s much you can do to defend your data before you need to invest in any expensive technical solutions.

Many companies also convince themselves they have nothing of value to hackers. Bad luck… All data has a value and all companies have something which will interest the cyber criminals. The only way you can be too small that you will not have something of interest to cyber criminals is if you don’t exist. No business is too small to be of interest.

For now, the regulators are focused on financial/critical infrastructure companies and any new laws are primarily aimed at them. As many as four-in-five data breaches in larger companies originate within their supply chain.

Suppliers are a constant source of cyber infection and reinfection. New regulations will put pressure on companies and we know that nasty things roll down hill. They will mitigate their risk by insisting that their suppliers’ cyber security is up to speed.

In a recent survey, 2% of respondents indicated they would sell their company’s data for as little as $10. At $1,000, 15% would. We hear that criminals are offering $20,000 for Google employee logging in credentials. Google

“Maybe only 5%-10% of cyber breaches ever become public knowledge, masking the true scale of the problem and fuelling ignorance-based complacency” 60 www.risk-uk.com

invests huge efforts in its own security, but it’s impossible to make any system totally impregnable. Yes, I did say impossible, even for Google. Someone – probably several – among Google’s circa 20,000-strong workforce might be persuaded to sell the information desired.

You just need the wrong combination of factors to come together to create that occurrence.

If cyber criminals ever manage to acquire a set of Google admin credentials they will potentially have themselves a goldmine. $20,000 will look like an absolute bargain, and don’t let the $ sign fool you into thinking it doesn’t happen here in the UK as well.

IBM recently stated that 95% of breaches involve human error (or a malicious act). Such an accurate and large number should be taken with a good fistful of salt. IBM is probably just about to market a gizmo which promises to ensure that humans can never make another mistake again.

The simple fact is that no-one really knows the true statistics about anything connected with cyber security. All we ever see are extrapolations of collected data and, if they’re correct, it will be purely down to luck.

That said, what we do know is that we have a big problem on our hands.

Many breaches are caused by user error.

Most are preventable by following simple security measures. User error is known as ‘The Insider Threat’ and, without doubt, it’s the biggest threat to information security.

Governance regimes A well-constructed governance regime, proactive management and a good education and training programme – which should be at the heart of any information security efforts – will go a long way towards helping with countering ‘The Insider Threat’ and ensure a significant lowering of the general cyber risk.

In the process, you will create many more trained eyes working on your security efforts.

All of this will improve crisis management capability. It’s all extremely positive stuff.

In conjunction with developing this ‘security culture’, a comprehensive threat assessment can then be conducted. It should draw together all aspects of your risk: physical, personnel, cyber and governance. Then you can concentrate on acquiring the right technical tools to add to your defences.

Acquisition of potentially expensive technology will only be actioned in response to a measured and genuine need.

Strong governance enables a Board of Directors to understand the threat and be confident that preparedness is in place.

Business Resilience, Cyber Security and Business Continuity… Or Is It More? respond to and recover from potential disruptions. The resilience approach is proving more flexible and efficient than a purely preventative emphasis that dominated management thinking into the start of the 21st Century. Organisational culture, meanwhile, is an essential element in determining the success of the resilience approach, as is the use of new technologies.

Resilience in business

Today, most businesses of size can be found to have at least four essential components: operations, a supply chain, finances and information. The disruption or loss of any one of these key elements can spell disaster. That simple fact alone has spawned the explosion of the ‘Resilience Phenomenon’, as Bruce Braes discovers

46 www.risk-uk.com

ith cyber attacks and their accompanying high profile news reports becoming almost a daily occurrence, companies have gradually begun to realise the magnitude of the increased threat cyber criminality presents. Senior management is beginning to take interest in the potential impact on the business, most particularly in terms of reputation and financial or regulatory costs. What’s also becoming clear, though, is a distinct absence of ‘resilience thinking’ at the highest levels of today’s organisations.

Very few organisations have reached the maturity level where the connection between business continuity management, physical security, crisis management, disaster recovery and managing or responding to cyber incidents is recognised. A recent survey dominated by CSuite executives revealed 39% of respondents didn’t have a formal incident response plan (at the time of answering) and yet, of those organisations which admitted having no plan (and no team), almost 38% claimed some level of preparedness for a cyber incident.

Resilience is fast developing into the ‘Best in Class’ strategic approach towards maintaining the viability of business operations enabled by a comprehensive ‘all risks’ strategy designed to anticipate, assess, prevent, prepare for,

W

What is resilience in business, then, and why should it be part of ‘business as usual’?

First, resilience in business encompasses far more than just cyber and having a Public Relations firm on standby. While the management of risk is nothing new, of course, many businesses find it difficult to achieve the ultimate outcome of becoming ‘resilient’.

A risk-based approach towards resilience and the resulting designs in security and processes needs a Boardroom champion who can take overarching responsibility for their design, testing and implementation, as well as their renewal, retesting and embedding as ‘business culture’. Conducting risk and vulnerability assessments and, more importantly, using the data generated by those assessments to deliver meaningful outcomes that improve bottom line results for a business remains ‘The Holy Grail’.

For many companies, risk management is a regulatory requirement. While this is a sound reason for undertaking risk management activities in a structured and formalised way, often organisations fail to realise the ultimate value as management lacks the courage and innovation to make the big changes required.

Joined-up thinking across silos such as facility management, security, IT and information security under one overall leadership helps close gaps that could otherwise be exploited. However, Risk Registers all-too-frequently sit in many different organisational places and have no linkages.

This separation leads to the resilience of the business being compromised. Oversight at a senior level is often flawed or non-existent.

Linking risk management to business planning and strategy frameworks is absolutely key to successfully delivering business objectives and creating a competitive advantage by dint of enhancing the adaptive

In the Spotlight: ASIS International UK Chapter

capacity of the organisation. It also positions a company to be prepared to make the most of any opportunities that present themselves.

Regulatory obligations Companies listed on Stock Exchanges across the globe now face regulatory obligations to identify and manage risks on an ongoing basis.

In the UK, the Corporate Governance Code (formerly the Combined Code) states: “The Board is responsible for determining the nature and extent of the principal risks it’s willing to take in achieving its strategic objectives. The Board should maintain sound risk management and internal control systems around the Listing Rules to report on how they have applied the Code in the Annual Report and Accounts.”

In Australia, Principle 7 of the Australian Stock Exchange’s Principles of Good Corporate Governance and Best Practise Recommendation states: “A company should recognise and manage risk, establishing a sound system of risk oversight and internal control.” The US response to the collapse of Enron, WorldCom and other corporations was the passing by Congress of the Sarbanes-Oxley Act 2002.

Probably more importantly, the general Duty of Care requirements under the Occupational Health and Safety legislation across the globe has now placed greater responsibilities and liabilities on managers and directors to ensure workplace conditions and work practices don’t endanger the lives of workers, whether they be employees or contractors. All directors must exercise a general Duty of Care and, in the case of publicly-listed companies, this responsibility is often a requirement of listing obligations.

Crucially, the coupling of statutory requirements for risk management with a desire for business improvement should deliver the best results for an organisation. Indeed, this is the first small step towards becoming a ‘resilient business’.

‘One size fits all’ model While there are some common threads to becoming a ‘resilient business’, there’s no simple ‘one size fits all’ model, as it depends on company size, structure and the markets in which a given company operates.

Resilience isn’t a plan or a checklist. The capacity of resilience is found in a business’ culture, attitudes and values.

In essence, to be resilient an organisation needs to anticipate emerging threats and understand the impact of those threats on the business, the supply chain, the community in which it operates and upon employees’ lives, develop and maintain supportive partnerships

with critical stakeholders present in its supply chain, sector and community and respond to (and recover from) disruptions as a unified ‘Whole of Business’ team.

The organisation must also adapt to disruptions and react flexibly to restore routine functions and strengthen the business and ensure staff members are willing and able to support the company when it comes to achieving objectives in times of adversity.

Leadership must have clear direction while also enabling devolved problem solving.

The Road to Resilience For a business to begin the journey along the ‘Road to Resilience’ it must be built upon the ‘Foundations of Resilience’ listed below before it can display the attributes required to become resilient. This will enable it to embrace the ‘Principles of Resilience’ in order to reap the ‘Benefits of Resilience’.

That said, the ‘Road to Resilience’ is a rocky one and challenges will be discovered regularly along the way. However, leading businesses now plan to manage outcomes rather than specific scenarios and create capability-based approaches. Organisations may not be able to anticipate every scenario, but can move towards creating response capabilities that will be resilient to whatever causes the disruption. *Foundations of a Resilient Business Leadership, Culture and Trust, Vision, Purpose and Governance *Attributes of a Resilient Business Effective and empowered management that displays clarity of purpose, anticipates and manages change swiftly, promotes and supports a culture of building resilience, provides resources to build resilience and coordinates functions and disciplines that support resilience building *Principles of Business Resilience Shared purpose and vision, an understanding of the changing context both internally and externally, adapting capacity to a changing context, diversity, skills, knowledge and experience as well as effective co-ordination across management disciplines *Benefits of Business Resilience Increased competitiveness, coherence and efficiency, an enhanced reputation and heightened societal/community engagement

Bruce Braes CSyP FSyI CPP MA MEng: Treasurer for ASIS International’s UK Chapter and Director of Resilience Consulting Services at Optimal Risk

“In essence, to be resilient an organisation needs to anticipate emerging threats and understand their impact on the business, the supply chain and employees’ lives” 47 www.risk-uk.com

Protecting Security Professionals from Post-Traumatic Stress The trauma of witnessing a distressing event, or suffering an injury during the course of an incident at work, is a threat facing professionals in the security community.

Alas, many across the security business sector still don’t know enough about the consequences of these events for mental health and the onset of Post-Traumatic Stress Disorder.

Crawford Chalmers and Patrick Rea offer their thoughts on this vitally important issue

Crawford Chalmers: Executive Committee Charity Liaison for ASIS International’s UK Chapter

46 www.risk-uk.com

xactly what is Post-Traumatic Stress Disorder (PTSD)? How might security professionals be affected by it and, most important of all, to whom can they turn for help should it visit them at some point?

The lack of knowledge around PTSD often applies as much to Human Resources (HR) staff working in our organisations as it does to line managers. Unrecognised, the symptoms of PTSD can persist and result in job loss, family breakdown or even worse. At best, it can lead to poor performance in the workplace in tandem with a generally low quality of life.

It’s for these important reasons that ASIS UK has taken steps towards addressing the issue by partnering with charity PTSD Resolution to access its national network of therapists for the treatment of trauma suffered by members.

Indeed, ASIS is the first security membership organisation probably in the world to offer trauma treatment as a member service through a preferred supplier. This means that any member of ASIS UK who feels that they might be suffering from trauma, however it may have been caused, can access the PTSD Resolution network of some 200 therapists at a preferential fee rate.

A major benefit is that an appointment for therapy can usually be arranged in just a matter

E

of days. Also, the service is confidential and no referral is needed from a GP. ASIS UK has worked with PTSD Resolution for several years now in support of its primary aim, which is to provide help to UK Armed Forces’ veterans and reservists who may be experiencing the residual effects of military trauma. The charity has helped many veterans – some of whom work in the security business sector – as part of a service that’s both compassionate and hugely effective.

Ever-present risk There are particular issues of mental health associated with the security sector’s community, not only because of the number of veterans resident within its ranks, but also because of what members of staff may see or hear or otherwise experience during the course of their work. Given the current level of terrorist threat, there’s an ever-present risk of being exposed to trauma, either at first hand or through the accounts of colleagues.

All responsible organisations of any size now have contingency plans in place to deal with a terrorist attack or other security threat or damage. It’s universally recognised as a sensible and logical precaution, but too few organisations have any kind of back-up plan

In the Spotlight: ASIS International UK Chapter

worked out in terms of how to deal with the trauma that staff might experience from any of these or other circumstances encountered during the course of their employment.

According to the UK Statistics Authority, there were 17 million workdays lost nationally to stress, depression and anxiety in 2015 alone.

The cost of this to the UK’s economy is estimated at £2.4 billion. This figure shows an increase in the number of lost workdays from the previous year. In 2014, the equivalent statistic was 13.6 million workdays.

Duty of Care Employers have particular responsibilities towards those with PTSD or other mental health disorders. In the workplace, there’s a legal Duty of Care to protect the health of employees. This is enshrined in the Health and Safety at Work Act 1974 and reinforced by the Management of Health and Safety at Work Regulations 1999 (which state that employers must assess the risk of stress-related injury).

Failure to comply with these regulations can make the employer liable to pay damages. Also, under the Equality Act 2010, it’s illegal for an employer to discriminate on the grounds of an existing mental health condition.

In addition to any legal obligations, as responsible people working in the risk and security sector it’s fair to say employers should acknowledge that trauma and stress can be a problem. They should be able to recognise the symptoms in themselves or in their members of staff, and then know how to take action and what to do – in much the same way that when we recognise we have toothache, we don’t hesitate to visit the dentist.

The relationship with PTSD Resolution means that there’s now a clear pathway to treatment for ASIS UK’s members. In addition, the charity can arrange half-day Workshops for members working in HR or as line managers such that they can recognise the symptoms of trauma and ‘signpost’ help.

The charity empasises that the goal of these courses is not to turn security people into psychotherapists, but rather enable them to be aware of what to look out for if a member of staff, or indeed they themselves, is exposed to a potentially traumatic incident (whether it’s at work or at any other time). Contact the charity direct at www.ptsdresolution.org if you wish to organise a Workshop, which should be for a minimum of ten participants.

We firmly believe that support for trauma – in other words ready access to a local network of therapists skilled in dealing with PTSD symptoms – will become, and should be, the

normal provision for professionals working in this business sector.

Basics of therapy Many environmental stimuli will cause alarm and distress in a traumatised person and, as time goes by, the patterns can generalise, making less and less of the world tolerable.

This is precisely why we see people who have been living in tents, or even underground, in an attempt to escape from the noise and random threats of the world.

PTSD Resolution offers treatment straight away, as close as possible to where sufferers live, and generally in domestic rather than institutional premises. The whole aim is to keep the therapeutic meetings as calm as possible such that the process of teaching the traumatised brain to calm down and see that everyday noises are not threats can be achieved as quickly as possible.

Almost all approaches towards trauma will involve some degree of re-exposure to the traumatic events themselves, as the ultimate aim is to teach the brain that those events can be considered without any alarm bells ringing.

Some methods here are considered violent, like the virtual reality system using simulators that seems to be gaining ground in the US. Generally, people are asked to recount the events they suffered, often many times and over many meetings. For the most part this appears to work, though again it seems to be a burden most veterans might prefer to avoid.

PTSD Resolution uses a different approach as the first choice with its clients. Therapists first teach individuals to become very calm both mentally and physically. This is a vital life skill in itself, and one that’s even more useful to traumatised people. Therapists then ask clients to construct a mental ‘film’ of the event(s) and view them, in a state of great calm, on an imaginary television screen which, in the first place, they don’t even have to look at.

Over multiple iterations, they become able to view the events more directly, until in the end they can watch their traumatic events without a significant emotional upset occurring.

Together with re-appraising the history and consequences of the trauma and building effective and efficient strategies for re-entering normal life and coping with its difficulties, this realises good results for most.

Patrick Rea: Director and Trustee of PTSD Resolution

“Many environmental stimuli will cause alarm and distress in a traumatised person and, as time goes by, the patterns can generalise, making less and less of the world tolerable” 47 www.risk-uk.com

Transitioning from the Military and the Police to Security: The Challenge While many individuals have successfully made the transition to civilian employment after leaving the Armed Forces or the police service, a significant number have struggled to find meaningful roles or otherwise accepted jobs which have failed to match either their expertise, aspirations or true potential. Scott Paterson outlines why the latter scenario need not be the case

ive years to go… 3, 2, 1… Six months… Next week… You’re out of the Armed Forces or the police service, but you don’t have a job, much less any clue about what you want to do, never mind where you should settle down.

Does that scenario sound familiar?

Many of our Armed Forces and police service personnel consistently find themselves in this position when they enter ‘Civvy Street’.

Although there are many schemes, initiatives and support opportunities in place for them (and especially so for those leaving the military), somehow the individuals looking for that support are not receiving the message.

Let’s be clear at this point. There’s no suggestion that all ex-Armed Forces and police officers make for great corporate security professionals. However, what we can agree on is that those who do transition into such roles invariably do so very well. What’s more, it’s in every current security professional’s interest to find, mentor and steer these potential candidates at the earliest opportunity.

For businesses, those transitioning will harbour some highly-sought after vocational skills, not to mention a wide range of transferrable ‘soft’ skills. Among them will be communication skills practised with both internal and external stakeholders,

F

46 www.risk-uk.com

organisational skills and project management abilities, leadership and management skills alongside high degrees of professionalism, problem solving abilities, Health and Safety and security awareness, the tendency towards teamwork and, of course, an ethos to ‘get the job done’ to the required standards.

Last year, somewhere between 20,000 and 27,000 individuals left the UK’s Armed Forces and the police service. While creating significant job competition between those leavers, this does provide a huge pool of potential security professionals looking for opportunities in civilian employment.

Security management roles For the service leaver, they can never start their transition too early. Depending on the career they’ve enjoyed to date, their length of service, pension (if applicable) and individual drive for a second career, there are many considerations to think about. ‘Courses, courses, courses’ is normally the clarion call for most leavers. While important, many are spending money on courses and ticking completion boxes rather than thinking about what they actually want to do and speaking to people in such positions.

For those looking to move into security management roles, there are now many options

In the Spotlight: ASIS International UK Chapter

available at different levels and to suit all from those with Level 4 certificates up to Master’s degree level and beyond. There’s no reason why these qualifications cannot be achieved with two-to-three years left in service (if not earlier).

‘Network, network, network’ is next on the list for most. Exhaust all your own contacts for information and advice. Join security organisations such as The Security Institute or ASIS International’s UK Chapter as these will provide platforms for meeting professionals and academics at the highest levels as well as opening up a whole new business language that’s often far removed from service life.

Through networking, you will begin to understand the vast security landscape and variety of security roles within it (not to mention the potential career paths involved with those roles) including jobs focused on electronic, cyber, information, personnel, physical and canine security as well as executive protection and surveillance.

By speaking to current professionals and asking for their advice (not a job!), you’ll be surprised at how many want to actually help you and provide guidance. You’ll begin to shape what it is you want to do. Such interaction should inform and steer you towards relevant courses designed to support your goals.

Salary expectations are sometimes the first area of thought for a service leaver, but before that it’s extremely important to be clear on where you’re going to settle down or base yourself and decide on what your personal priorities are in terms of location or salary. Both have an effect on each other, and have considerations attached of which you need to take account, such as travel time to work (and how long this will make you average working day) as well as the cost of that travel and weighing that up against any salary options.

You may well discover that an opportunity closer to home pays less. However, once you’ve deducted the three hours of travel to and from the office, and the cost of that travel, the end result may actually work out quite favourably.

Sharpening your focus Once clear on priorities, tailoring your search criteria for opportunities becomes narrower, and you can begin to focus on whether you’re looking for a new career to grow into or an opportunity that provides a level of stability and perhaps tops up your well-earned Armed Forces/police service pension.

Be realistic about a target salary. Set it high, by all means, but budget low as it may be the case that you need to take a few steps backwards before fast-tracking your way

through specific roles (if that’s what you’re looking to do).

Be extremely humble in everything you do and with everyone you speak to. No-one owes you a job. Just because you reached a certain rank in your previous incarnation doesn’t mean that you can walk into an equivalent one on an immediate basis. Remind yourself of this on a constant basis. If someone walked into a police or military Careers Office and told you they were currently a security manager for Company X, and that they now believed they could join either service and be a sergeant, what would you say? Fair enough, the comparison isn’t exact, but it’s worth thinking about as you may be speaking to employers with no previous experience of your former career.

What’s out there in the way of support? First, there are many initiatives for Armed Forces leavers, not least the Career Transition Partnership (CTP) which provides a solid baseline prior to leaving. While acknowledging that many appear to give the CTP something of a hard time, think about this: there isn’t an equivalent for those leaving the police service.

Another great initiative for ex-military types that was launched only recently is the Veterans Employment Transition Support (VETS) scheme.

This venture joins up many businesses that support Armed Forces leavers in several ways, including through work placements and ‘Insight’ visits to a variety of job roles. There’s notification of jobs advertised.

VETS also provides a mentor scheme that allows individuals to select a potential volunteer mentor to support their transition and helps in opening doors. Further detail is available at: www.veteranemployment.co.uk

Scott Paterson CPP PSP MSyI MCMI: Lead for Armed Forces Liaison on ASIS UK’s Committee and Head of Consultancy at ICTS Consult

Specialising in security For its part, ASIS UK lists a wealth of ex-military and ex-police service employees among its ranks who are now in some of the top security positions around the UK and across the Globe, in addition to several well respected recruiters who specialise in the security business sector.

All of these professionals will do everything they can to offer advice and discuss personal situations on a one-to-one basis. By increasing your exposure through networking at events, you’ll begin to build up a detailed picture of what’s right for you and, subsequently, find the correct career path to follow.

“Be realistic about a target salary. Set it high, by all means, but budget low as it may be the case that you need to take a few steps backwards before fast-tracking through the roles” 47 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

Big Data Analytics in Security ttention is now being focused on all elements relating to the protection of information and personnel across a given business. Those elements are many and varied.

For example, there’s a need for policies to be devised and defined around access to critical areas (be they physical or virtual) for subsequent implementation and monitoring.

Also, in order to reduce the probability of ‘The Insider Threat’ materialising, organisations are including measures designed to vet and audit each individual (or logical account) who has either requested – or already enjoys access to – critical areas within the company.

The boundaries of these physical or logical areas are carefully defined, taking into account both local operations and industry regulations.

Today, it’s more often the case that all aspects of security – encompassing cyber, data, people, assets and physical sites – are being looked at from an holistic perspective with specific reference to core business objectives.

In addition to this, Security Departments are becoming – or are increasingly intending to be – far more proactive towards the matter of identity risks and threats as opposed to being reactive to issues which might have already impacted the host organisation’s business, people and/or reputation.

In this regard, various tools and technologies may be deployed to capture data across the aforementioned areas and, with most of these technologies now connected to the network, it’s becoming relatively easier to integrate them.

Doing so offers a cost-effective alternative to managing various operations that, as an alternative, would be divided across different individuals and systems.

A

Identifying and resolving risk The wealth of data today’s dedicated Security Departments are capturing on a continual basis through their various activities or systems is being used in novel ways to identify and resolve risks (ie exceptions) which would otherwise go unnoticed until manifesting themselves in potentially serious incidents.

The principles of these novel approaches may be classified under the ‘security intelligence’ and ‘behavioural analytics’ banners. Let’s examine a few examples. The management team for a global bank playing host to a large workforce (ie over 150,000 employees) and operating out of more than 100 sites across the world was keen to identify instances of where

Given the spate of recent incidents occurring on the global stage, it’s no surprise that much attention is being visited upon cyber security. However, as most organisations now duly recognise, attention isn’t only limited to the cyber side of security. Vibhor Gupta expands on that notion the company’s staff were ‘remote’ logging-in to its IT systems despite being (physically) inside the organisation’s premises. Such exceptions relate to possible duplication of an identity record, which is a serious threat indeed.

As the bank’s management team duly discovered, the ‘best’ – in other words the cheapest, quickest and most easily replicable – way for them to approach this issue was to apply the simple principles of data integration and visualisation across base logical and physical access control systems. By doing so, members of the security team were notified of any exceptions to the rule in real-time, in turn allowing for instant investigations and assisting the bank with risk mitigation tasks.

A Fortune 500 organisation had multiple reported cases of expensive equipment being stolen from different buildings across its main campus area. The management team suspected the thefts were occurring after normal office hours, but an analysis of access records registered by the installed physical access control system alone wasn’t very helpful.

Hundreds of individuals were working late at that site on a regular basis so it was difficult to identify a manageable number of suspects. By applying analytical intelligence to an integrated set of time and attendance data as well as physical access data, the management team was then able to resolve this situation.

Vibhor Gupta PhD: Director of Sales and Business Development (UK and Europe) at Quantum Secure and Technology Lead for ASIS UK

61 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

The team first defined a ‘usual’ behaviour of an individual and groups of individuals (ie which areas they accessed the most and at what times). Management team members then looked for exceptions (ie if certain individuals or groups accessed certain areas at specific times which fell outside of their ‘usual’ behaviour). By dint of conducting this analysis, a single employee stood out. This individual’s access pattern also coincided with the thefts.

The next time that employee entered a new area after normal working hours, the Security Operations team was notified. A security officer was then sent to inspect the building and the thief was caught red-handed.

This determined and focused approach not only helped management to resolve a mystery, but also provided the team with a strategy to prevent similar activities occurring in the future.

Individual risk assessments In another case, a highly secure Research and Development-focused organisation had spent enormous amounts of money each year on performing background checks for every person accessing its campus. A reduction in the security budget led to a change in policy, and a decision was taken to perform risk assessments on each individual. Checks were re-run on those who represented the highest risk. However, this simply led to a cut in the frequency of checks and raised the risk levels quite significantly.

It was critical for the business to redefine the way in which it conducted risk assessments.

The management team began by factoring each individual’s level of access, the time they had been with the organisation and the period since they last went through a background check.

This information was coupled with their known ‘behaviour’ (ie which areas they were accessing on a frequent basis and at what times) in order to compute a ‘risk score’.

Background checks were mandated for individuals with a high risk score and those who showed a sudden increase in their overall result. This helped a great deal in terms of maintaining high levels of security – no issues have since been reported – while reducing operational costs by approximately 85%.

There are several other use cases highlighting the benefits and values Security Departments are now beginning to create using the principles of ‘security intelligence’ and ‘Big

“Look for ‘extensible’ solutions that can actively contribute towards the bigger picture if that should become necessary.

Scalability is easily achieved with ‘out of the box’ solutions” 62 www.risk-uk.com

Data’ analytics. Salient points to note are: • Site usage metrics: to what degree is a site being used?

• Key Performance Indicators: how well are operational security teams doing based on defined Service Level Agreements?

• Impact analyses: conducted in case of changes such as an alteration of security policies or in existing technologies like access cards and access control systems • Supporting the ‘green agenda’: reducing energy usage in zones not greatly occupied based on the analysis of available data

Successful outcomes All of that said, every great idea ultimately requires a successful execution (ie implementation) for that ‘greatness’ to be recognised. To this end, there are several tenets deemed as being key to successful outcomes.

First of all, identify the use cases (which should be addressed through the endeavours of ‘security intelligence’ or ‘Big Data’). Base these use cases on the experiences of known risks, threats and exceptions.

Look for ‘extensible’ solutions that can actively contribute towards the bigger picture if that should become necessary. Scalability and extensibility are easily achieved when ‘out of the box’ solutions are deployed as opposed to customised ones. This really does assist organisations in protecting their investment as such solutions can be geared towards handling changes occurring in terms of other third party systems or business processes.

Partner with systems vendors who actively specialise in the security vertical and connect to applicable systems (such as access control solutions, logical Human Resources systems and general security devices) in a noncustomised/non-bespoke manner.

Avoiding generic solutions In addition, avoid generic ‘Big Data’ solutions from vendors who don’t understand security.

Domain knowledge is very important given that one size certainly doesn’t fit all. That domain knowledge coupled with the referenced experience of a solution provider implies cheaper, shorter and scalable implementation.

It’s evident that Security Departments around the wolrd are fast recognising the opportunity for them to become business enablers. As a result, they’re aligning their objectives such that host organisations can run efficiently. This is a very welcome deviation from the traditional view of security being seen as a reactive and investigative process only and one unfairly labelled as merely a cost centre.

The Making of Today’s Multifaceted Risk Manager: An Appraisal Security Risk Management (ESRM). In short, ESRM is a philosophy and management system used to effectively manage security risks – both proactively and reactively – across an enterprise. The process quantifies threats, establishes mitigation plans, identifies risk acceptance practices, manages incidents and works with risk owners on remediation efforts.

ESRM covers such areas as personnel security, IT security, resilience, business continuity, investigations, fraud, loss prevention, asset management, safety and brand protection. Instead of considering risks in isolation, an ESRM approach is both comprehensive and collaborative.

Threats and opportunities

Today’s security professionals face an increasingly diverse and dangerous threat profile from across the risk spectrum. Each type of threat is ominous on its own, but in combination could present a nightmare scenario.

Peter O’Neil outlines the threats and opportunities presented to risk managers along the immediate and future Enterprise Security Risk Management spectrum

38 www.risk-uk.com

illions of passwords routinely compromised… Distributed Denial of Service attacks disrupting Internet traffic around the world (targeted at sites such as Twitter, PayPal, CNN and Netflix)… State actors using cyber warfare to interfere with other nations’ elections... Extreme weather events causing sweeping devastation… Terrorists and criminal attacks increasingly aimed at soft targets: a nightclub in Orlando, a music festival in Germany, a bakery in Dhaka, a park in Lahore, an office party in San Bernadino and a stadium, café and a concert venue in Paris.

Consider a series of cyber and physical attacks timed to coincide with a major hurricane. Such co-ordinated attacks could disable network control systems and target physical infrastructure when people need stability the most, leading to cascading effects that could result in the crippling of sectors of society. In fact, research conducted by ASIS International shows very few organisations have truly converged Security Departments that can holistically deal with cyber, physical, personnel and information risks.

In the past decade, however, some of the world’s leading security professionals, thinkers and organisations have adopted an holistic approach to managing risk called Enterprise

M

What are the threats and opportunities along the ESRM spectrum? One of today’s biggest areas of concern is the vaunted Internet of Things (IoT). It’s projected that, by the year 2020, more than 50 million objects – among them cars, commercial aircrafts, pacemakers, control systems, manufacturing process control components, wind turbines, surveillance equipment and access control devices – will have discrete IP addresses.

The IoT opens incredible risk, which is only hinted at in news stories of White Hat hackers gaining access to aircraft controls and selfdriving cars showing their first vulnerabilities.

In fact, millions of unsecured security cameras were said to have been harnessed to perpetrate the widespread Distributed Denial of Service attacks that occurred last month.

Worse still, industry lacks the resources to address these cyber risks. Gobal information security talent is scarce. A recent survey conducted by IT governance association ISACA shows that 94% of respondents are having trouble filling cyber security roles.

In parallel, (ISC)2 predicts a global shortfall of 1.5 million information security positions by 2020. This scarcity pushes IT security into a reactive role. At the same time, corporate Boards are now recognising the importance of cyber security and will be holding security executives accountable for any breaches.

Despite the ever-complicating cyber threat profile, the same technology that challenges us also offers tremendous opportunity. We’re all concerned about Big Data and the privacy

In the Spotlight: ASIS International UK Chapter

implications, but many Security Departments are ingeniously harnessing their data to create a more secure environment. Microsoft, for example, is building a Security Operations Centre that pulls data from 27,000 separate security devices, including cameras, card readers and duress alarms, not only to depict security trends and ‘hot spots’, but also to monitor the health of the devices themselves and create a priority matrix for maintenance and the replacement of parts.

They’re also now creating a virtual Security Operations Centre that focuses on high-level mission critical life-safety data. The goal is to be able to marshal a virtual Command Centre from anywhere using any connected device.

You don’t have to be the size of Microsoft to do the same. Smaller Security Departments are using Big Data to contribute to the corporate bottom line, enhance quality or streamline operations. For example, one airport is using data analytics from a combination of its parking ticket dispensers, license plate readers and parking spot sensors to route traffic, ensure proper parking fees and market its services to passengers from far afield.

Shifts in demography Another area of risk involves changing global demographics and its effect on resources, markets and populations.

For example, the US National Intelligence Council report entitled ‘Global Trends 2030’ predicts that, by 2030, China’s economy will be the world’s largest. South Asia and Africa will become the two most highly populated regions of the world. Africa will overtake South East Asia in terms of the global percentage of population distribution, while China and India will be the largest consumer markets in the world, combining to total half of all consumption. The US dollar will likely represent less than 50% of the global currency reserves.

That’s a long way away, but movement in that direction is more evident every day. These shifts are already having a profound effect on security. The most unstable regions have the youngest populations – and those most prone to fanaticism – as well as the richest natural resources. European and East Asian populations are failing to sustain themselves organically as birth rates drop.

In terms of resources, competition is intensifying for energy, minerals, food and water. In fact, the 2016 Global Economic Forum found that the top concern for business leaders over the next ten years is going to be access to water. Water scarcity affects everything from conflict in India to food prices in France

through to data storage costs in Nevada. That’s true even with all the flooding in the world, which itself raises the inverse issue: the increasing frequency of natural disasters.

The good news is that these threats offer prime opportunities for security professionals and providers. As people age, they’re more likely to spend on security for themselves and their families. The ageing population will spend on healthcare and pharmaceuticals, likely increasing security positions in those sectors.

Experts predict that more than 50 global cities will have populations of at least ten million people. With the rise of megacities and the proliferation of urban areas, the demand for security will soar. Beyond personal protection, security companies will profit from urbanisation by dint of the need to protect expanding critical infrastructure, such as power lines and water supplies. Most of these security opportunities will occur in sub-Saharan Africa, India and across South East Asia.

Management component For their part, security professionals will need to master the ‘M’ of ESRM: the management element. Today’s leading security practitioners are business strategists, trusted advisors to and collaborators with the C-Suite, contributors to the bottom line, talent acquisition experts and empathetic leaders.

According to Professor Mario Moussa of the Wharton School of Business, the workplace of the future will be “flatter, looser, wider and faster”. This means that hierarchies will matter less, flexible schedules will predominate and remote work will become commonplace, yet staff need to be more collaborative and teamoriented. Security managers will have to lead a widely dispersed staff from many cultures, backgrounds and geographies.

Facilitating communication is going to be critical, particularly given the proliferation of millennials who will make up 50% of the workforce by 2020. Experienced security professionals must work to keep these highly mobile members of the team engaged and demonstrate that their talent is valued.

Tomorrow’s landscape is daunting. Security professionals require a wider facility in risk management than ever before, and they must wield the toolkit of a 21st Century business leader. They have to make their work count.

Peter O’Neil FASAE CAE: CEO of ASIS International

“ESRM covers such areas as personnel security, IT security, resilience, business continuity, investigation, fraud, loss prevention, asset management and brand protection” 39 www.risk-uk.com

The Security Commonwealth: Working For The Common Good T

The Oxford English Dictionary states: “A Commonwealth is a voluntary association of independent (sovereign states) organisations/ representatives consulting and cooperating in the common interest of their (people) organisations/ members and in the promotion of common understanding (and world peace).” For The Security Commonwealth replace ‘sovereign states’ with ‘security membership organisations’ and ‘world peace’ with enhancing UK security, as David Clark outlines

David Clark CPP PCI PSP: Chairman of ASIS UK and The Security Commonwealth and Head of Security for the Francis Crick Institute

38 www.risk-uk.com

he Security Commonwealth is a voluntary association of independent security membership organisations/representatives consulting and co-operating in the common interest of their organisations/members and in the promotion of common understanding and enhancing UK security.

The aim is for the Commonwealth to be the all-inclusive industry advocate for security issues in the UK, create lasting networks and alliances and promote and lead the security sector with integrity, honesty and education.

Very clever, but why? The Security Commonwealth is the brainchild of The Security Institute and was set up last year in response to increasing demands for just such a body. The UK’s security sector is wide and diverse and consists of a range of highly complex disciplines, professions and specialisations.

With decreased funding for police and Government security services and now a confirmed Brexit, more than ever before the UK’s security sector needs to come together as an alliance and reinforce the private sector’s ability to inform and support Government initiatives while enhancing the standing and professionalism of the sector as a whole.

The Security Commonwealth has been established to co-ordinate the development and use of Best Practice, involving existing industry stakeholder organisations to: • establish a Commonwealth wherein all organisations come together on an equal and continual basis and discuss the development of common approaches towards joint challenges • create an awareness programme by working with key industry sponsors on developing key messages and something that can be used as a kitemark for all security interventions • set up a shared information service: this will be used by all member organisations to receive, share and disseminate information at the appropriate levels • show security to be the challenging, intellectually stimulating, exciting and publicserving discipline that it is • promote the Security Commonwealth to businesses through focused business engagement supported by a robust media and communications strategy, in turn building confidence and reassurance • promote Security Commonwealth awareness

to businesses through timely industry-focused information, disseminated to key individuals within the Commonwealth • encourage the gathering of like-minded professional security sector leaders in dedicated meetings to drive through associated security issues • share Best Practice and promote continuous improvement via the network • support industry engagement and development by creating a UK-wide communication network for professionals • champion professional recognition and continuing development around The Security Commonwealth • provide a strategic platform for the sharing of learning, knowledge and security experience • create a consultation and lobbying group to speak on behalf of all the Security Commonwealth organisations

Immense change ahead In days gone by, similar attempts have been made at creating something akin to The Security Commonwealth. The Security Alliance and the Joint Security Associations tried largely the same thing, but with limited success.

These are times of immense and rapid change for the security profession and all of its practitioners. The nature of threats is evolving: accessible information technologies, global networks, the diversification of threats and disruptive technologies will all create risks for members of the public, society at large and, indeed, for businesses in equal measure.

Now, increasing co-operation at a bilateral and multilateral level is the necessity and the norm. Complex threats require complex solutions and this demands far greater collaboration and co-operation from those responsible for the security of assets as well as the organisations that represent them.

What has the Security Commonwealth achieved to date? Strategic meetings are held quarterly and these are well attended.

Representation and support from Government agencies such as the Security Industry Authority (SIA) and the Office for Security and Counter-Terrorism (OSCT) is forthcoming.

Topical security subjects are discussed and wide agreement is sought on a unified approach towards security.

In the Spotlight: ASIS International UK Chapter

The Security Commonwealth has already been involved in a number of consultations including that involving the Government’s counter-terrorism CONTEST review, the Home Office review of the SIA and the London Mayoral security and preparedness review for the capital.

Constituent members Membership of The Security Commonwealth consists of most of the major security membership organisations in the UK, such as ASIS UK, The Security Institute, the International Professional Security Association, the Association of Security Consultants and the Institute of Professional Investigators as well as sector-based membership organisations like the Sister Banks and the Pharmaceutical Industry Security Forum.

Many other august organisations are involved covering all security disciplines including counter-terrorism, physical security, cyber security and more.

Membership also includes representation from special interest groups such as the Security Awareness Special Interest Group, the Women’s Security Society, TiNYg and the Project Griffin National Executive.

Industry representative organisations such as the British Institute for Facilities Management and the British Security Industry Association are involved, so too geographically significant organisations like London First’s Security and Resilience Network and the South Bank Business Watch. Membership is open to any security membership organisation that wants to play an active role in consulting on, informing and/or influencing UK security provision.

In 2017 and beyond Going forward, The Security Commonwealth must assess and inform the impact of Brexit on the UK’s security business sector. Brexit has caused just about all UK industries and industry leaders to sit up and take notice of the potential impact of Britain’s exit from the EU, and the security industry is no exception.

Research shows that a number of Eurosceptics have suggested Brexit will compromise the UK’s ability to fight crossborder crime and terrorism, but the degree of reality in that statement will not be known one way or the other for some time to come.

Despite the potential risks to UK security provision associated with Brexit, it will almost definitely mean change. These changes should be embraced and measures implemented that compliment whatever these changes might be.

We do know that The Security Commonwealth

needs to be at the very forefront of any highlevel discussions and plans for the UK’s security sector now more than ever before.

There must also be continued engagement with the newly-formed Joint Security and Resilience Centre (JSaRC). The Home Office has committed £11 million over the next four years to establish the JSaRC, which will provide a flexible capability whereby the Government and the security sector (encompassing both industry and academia) can work in partnership to respond to both urgent and longer term threats posed to the UK’s national security, while also seizing opportunities to support the growth of the security sector in general.

JSaRC will act as the front door for the security sector to access the complex security machinery of Government. It will be Government’s primary means of co-ordinating industry support, refining requirements, understanding the industry offer and sharing strategic priorities.

In parallel, dialogue with the OSCT’s Security Industry Engagement Team will be ongoing.

There will soon be a new chair of The Security Commonwealth. This role is rotated among security membership organisation chairs. A new chair will be appointed from a Security Commonwealth member organisation during the early stages of 2017.

“Research shows that a number of Eurosceptics have suggested Brexit will compromise the UK’s ability to fight cross-border crime and terrorism” 39 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

Securing Tomorrow By Investing Today hile a young professional is typically defined as an ASIS UK member who’s less than 40 years of age, or who has spent fewer than five years in the security profession, participation is encouraged by anyone passionate about this initiative, regardless of their age or experience.

The ASIS Young Professionals Group’s core mission is to develop and educate younger practitioners in the security industry. Expanding on this core Mission Statement, the ASIS UK Board recently reinvigorated and re-energised activities relating to such programmes in the UK, recognising the need to embrace and engage the security practitioner of the future and connect those looking to advance in the industry with those best placed to assist them in achieving their ambitions.

When I was first asked to take on and lead this initiative not long after the 62nd ASIS Annual Conference in Orlando last year, I did take a little convincing. However, as a product of the ASIS educational system myself, there could be no better way for me to give back to an organisation that supported my own professional and personal development, while also having the opportunity to pay it forward by influencing and supporting the next generation of our profession (in which I include myself ).

In the month or so since taking over as the Young Professionals lead in the UK, I’ve been both surprised and delighted by the energy and enthusiasm of not just Young Professionals, but also established industry leaders willing to dedicated their time and knowledge to such a worthwhile initiative. Pretty quickly, we’ve managed to merge a core team of professionals keen to volunteer their time and experience to the cause. Our core UK volunteer team has representation in global consultancy, industry recruitment, training and education and involves practising corporate security managers who all bring unique yet complementary skill sets and experiences that both support and facilitate the achievement of the initiative’s core objectives for both 2017 and beyond.

This team has more than exceeded my expectations in laying out a framework of objectives and deliverables for 2017 that will see the ASIS UK Young Professionals Group move to new heights and represents a step change in UK capability. The programme for 2017 aims to both promote the Young Professionals initiative and the wider ASIS agenda, while also providing real value and

W

The ASIS Young Professionals Group was created in 2010 to provide a comfortable environment both for ASIS members new to security and for future leaders to engage in education programmes and activities. Stuart Eustace examines the objectives and deliverables for 2017 that will see the Group move to new heights opportunity for Young Professionals and senior industry managers alike.

By co-ordinating educational events, mentoring programmes, practical workshops and career development seminars specifically tailored to increase opportunities and capabilities across all industry sectors, including reverse mentoring opportunities, we intend to ensure that today’s leaders are aware of the talent available, and that the talent of today is actively prepared for tomorrow.

Business capabilities As the corporate and commercial world becomes more aware of the value that professional security and risk management functions and services bring, coupled with the ever-evolving and dynamic global security environment, the need for not only functional and disciplinary knowledge, but also for wider, softer and more business-focused capabilities becomes more and more important.

The rise in big business’ acceptance of the security function’s value and the services provided by security organisations is testament to the ability and adaptation of the current practitioner in educating senior business leaders, in most cases by translating security risk terminology into common business language and finding new and innovative ways

Stuart Eustace CPP: Young Professionals Lead at ASIS UK and Global Lead on Risk, Security and Crisis Management at pladis Global

35 www.risk-uk.com

In the Spotlight: ASIS International UK Chapter

*If you’re interested in the ASIS Young Professionals initiative and are under the age of 40, or have been in the industry for less than five years, or maybe looking to break into the industry or are just curious, then you can find more information at https://www.asisonline.org/ Membership/MemberCenter/Councils/YoungProfessionals/Pages/ default.aspx **Additionally, if you don’t fall into the Young Professionals bracket, but would like to be involved as a member of the volunteer committee or as a mentor we would love to hear from you.

For those who wish to volunteer their time, speak at events or share their experience and knowledge with Young Professionals, send an e-mail to: yp@asis.org.uk (volunteering) or ypmentoring@asis.org.uk (mentoring)

of displaying input to the business and, indeed, its value chain.

The methodology used in the sector has changed in some ways, although I would argue that the real enhancement has been in the security professional, and his/her evolution in understanding business process and business needs. This is a trend that will need to continue as the scope of services and expectations continues to increase, with our learning cycle being continuous and ever-widening.

As the business world continues to evolve, so will the risk landscape, and with it the expectations of the Board and commercial clients. The security practitioners and leaders of the future will not only need to be multiskilled in terms of functional capability and domain knowledge, but will also have to possess enhanced social skills, both in person and through the use of social media and/or technology-based platforms and networking forums. They will need to understand business processes and management and be able to sell their value to multiple stakeholders.

This isn’t a new revelation. It’s both well established and expected in today’s world.

However, as a sector it could be said that we’ve struggled in the past to keep pace with our ability to match or meet business needs, specifically when compared to other departments who generally lead on innovation and renovation. The security sector relies on tried and, therefore, perceived tested practices.

While I would agree that these practices and methodologies have stood the test of time in most cases, the way in which they’re implemented, communicated and measured has changed, in general as a result of business evolution and altered business sensitivity.

Leadership and management Most important of all, future professionals will need to know how to manage and lead.

Management and leadership mean many things to many different people, while the styles employed by different managers and leaders are in many ways very different. I would suggest that the similarities in all good leaders and managers are respect, patience and inspiration. All the functional knowledge in the world can be wasted if results cannot be achieved. The ability to inspire confidence, respect and belief both vertically and

“A cornerstone objective is the establishment and development of a mentoring programme that allows Young Professionals to learn from senior leaders” 36 www.risk-uk.com

horizontally within an organisation or client portfolio is – and always will be – invaluable to the practitioner of the future.

The principles of effective leadership and management are well documented and presented across training providers’ educational materials and, it must be said, do go some way towards supporting future capability development. However, this is no substitute for seeing it in practice or being a product of its execution.

Cornerstone objective A cornerstone objective of the ASIS UK initiative is the establishment and development of a mentoring programme that allows Young Professionals to access and learn from senior leaders in a structured manner. Personally, I hope that, as this initiative grows, the ability to match Young Professionals and mentors will not solely focus on learning from the leaders within our industry, but also allow for opportunities to learn from professional business personnel across varying different sectors and disciplines.

After all, these are the stakeholders to whom we must ‘sell’ our profession, talking all the while in their language and with enough inspiration to instil confidence and belief.

The establishment of such a programme, coupled with education and networking initiatives and wider ASIS offerings, will produce a platform to support well-rounded, driven, motivated and well-equipped professionals who can reach out and lean on a system that underpins them.

Further benefits to the wider ASIS organisation and industry leaders include opportunities to understand the employment pool and its capabilities, learn from the next generation and better understand what their future needs might be and who or what is/will be available to fulfil those needs.

Looking to the future As we look to the future and launching this initiative in the face of an ever-changing global security dynamic that drives an ever-evolving priority list from the business world, the ASIS UK Young Professionals team holds high expectations for the development of Young Professionals both within the ASIS organisation and across the wider security landscape.

We all share the same world and work towards a similar end state when it comes to a professional footing. The opportunity to increase knowledge and share Best Practice and learnings can only be a positive thing for the future of our profession.

Security in Crowded Spaces Given the recent spate of terrorist attacks in France, Belgium and Germany, not to mention the inquest currently being conducted into the Sousse atrocity in Tunisia (an episode that led to the deaths of 30 Britons), the focus for many in the security world is upon crowded spaces and how to secure them from the various threats they face.

Christopher Aldous reviews the key points involved for the readers of Risk UK

nfortunately, for many the term ‘crowded spaces’ focuses thoughts almost solely in the direction of stadiums and sporting events, but the associated areas that make such events an experience – such as fan zones, camping sites, hotels, restaurants and bars – are mostly forgotten by the planners.

The $64,000 question, then, is how should a crowded space be defined? The following has now become an accepted way in which to correctly define such a space: ‘A location or environment to which members of the public have access that could be considered potentially liable to terrorist attack by virtue of its crowd density.’

With the above description in mind, the management teams at stadiums who have developed robust operational security supported by architectural design and introduced technical security controls to protect occupants have pushed the risk of attack further out to the crowded zones supporting a given event. Now, the operators of those aforementioned fan zones, hotels, restaurants and bars, etc have to consider the impacts upon their business operations, while for their part policing organisations need to re-examine their public space controls.

It’s worth unpicking the terminology used within the definition, specifically ‘location or environment’. This implies either a specific site or sites that create an environment. If your business falls within an area designated as part of a fan zone, or is located on a major pedestrian route that services the main event then, by default, it too becomes part of a crowded space.

As major stadiums deflect risk from terrorist attacks outwards to businesses in the locality, those businesses may well benefit from the rise in customers, but the buildings and infrastructure housing and servicing them were likely not designed to counter the higher levels of risk engendered. That being so, what can be done to mitigate the risk?

U

Developing operational plans

Christopher Aldous BSc (Hons) CPP PSP: UK Chapter Secretary for ASIS International and Director of Design Security Ltd

50 www.risk-uk.com

Security is seen by many Boards of Directors and senior management as little other than a financial ‘hit’ on the bottom line, yet if planned correctly and coupled with a clear understanding of what security – ie physical, technical and procedural – is offered by the built environment, it’s fair to state that operational plans may be developed that can

provide cost savings and enhance the business’ operation and, indeed, brand reputation.

For businesses likely to become more crowded during major sporting events, what are the likely impacts? It’s important to consider the legislation a business must comply with in order to provide a safe and secure environment for customers and employees. Next, there should be a risk assessment conducted in order to identify what specific security-related risks impact upon the business operation and the probability of those occurring.

Advice imparted by security design experts that’s independent from equipment suppliers and available at the earliest stages will help the host business to understand its legislative obligations and the specific threats such that its formulated plans effectively address them.

This is key to specifying only what’s needed and avoiding any unnecessary expense.

Businesses should review what measures they currently have in place and consider how those solutions would operate should an incident occur. It’s imperative not to make the mistake of rushing out and purchasing CCTV or other security services until such time that there’s a full and complete understanding of what the business is trying to achieve from a security standpoint.

Complication can lead to failure Developing large-scale and ‘wordy’ plans isn’t a great idea. In my experience, complicated plans typically fail. It would be advisable prior to events to have discussions with your members of staff around dealing with situations, advising them on how to spot suspicious activity prior to or during an event, and perhaps when it’s about to end. You and your staff are best placed to decide on what’s suspicious as you see the ebb and flow of visitors/customers and, subconsciously, will label behaviour as being ‘normal’ or suspicious’.

If a given individual’s behaviour is deemed to be suspicious, ensure that all staff understand how to report it. Remember that our policing services cannot be everywhere. They would much rather investigate a suspicion than have to deal with the aftermath of a major incident once it’s already played out.

It’s also important to understand the behavioural aspects, as the way in which people experience security will impact on the business’ operation and brand in a number of ways. Using behavioural insights and

In the Spotlight: ASIS International UK Chapter

integrating security within the business plan can add value to the organisation by making the experience more welcoming for compliant target market segments, and at the same time less welcoming for non-compliant segments.

For example, by targeting the unwelcome behaviour of rowdy and/or aggressive fans the environment becomes more welcoming and feels safer for wider market segments and demographics, such as families, females and both younger and older fans, thereby increasing the revenue potential for the business.

Another positive aspect of an increased security posture designed to mitigate terrorist actions is that other lower level crime, such as person on person crime and vandalism, etc within the designated crowded space will generally be reduced due to the significant police and private security presence.

It’s noted that crime doesn’t stop. Rather, it merely moves to those areas that are less well policed and secured. If your business operation is on the fringes of an event, it’s highly likely that the incidence of crime in these locations will rise. Develop your resilience plans on that basis and consider how that planning could impact upon your staff and customers alike.

Not all security risks can be dealt with directly by a business, so the business’ operation should seek to transfer risks to the Organising Committee if the event size has warranted the creation of such an organisation.

Discussions with the business’ insurance supplier should also be undertaken to ascertain if they still provide suitable cover given the increased security threat environment.

Operational considerations during an event also need to be thought through by the business. If the venue is within an area that has additional security controls in place, then this could impact upon the way in which staff shifts operate. It’s possible that some staff may not want to be subjected to increased surveillance and so resign from their roles or fail to attend, in turn impacting business operations.

Deliveries to the business operation are also likely to be delayed or interrupted due to increased searches and screening of vehicles entering and leaving the designed sites. Road closures may be enforced so it would be beneficial to understand them and ensure delivery companies are made fully aware.

Mutual aid agreements Businesses would do well to develop operational resilience plans and, as part of such plans, consider the option of mutual aid.

In essence, a mutual aid agreement identifies resources that may be shared or

borrowed from other organisations during a crisis. Agreements should be legally sound and fashioned in a written format such that all parties understand what’s required of them.

Resilience planning ought to be based around ‘worse case’ scenarios, but there are many incidents where a full emergency response will not be required. It may be helpful as a business to establish a system that assists you in classifying your key areas of concern.

This way, you can focus your resources and enact a graded response.

Some areas to consider are potential injuries that may be sustained by – or even the possible death of – employees or those visiting your business premises, structural damage to the building/facility (which could be caused in a number of ways), business interruption (ie loss of power, water or communications) and the community impact (ie loss of staff or a reduced recruitment population, etc).

Once you’ve ‘tabled out’ your areas of concern, look to assign an indicator of magnitude for severity: Level 1 – Negligible business impact, Level 2 – Minimal business impact, Level 3 – Moderate business impact and Level 4 – Major business impact. This form of planning will undoubtedly assist your business in developing suitable responses.

“It’s imperative not to make the mistake of rushing out and purchasing CCTV or other security solutions until there’s a full and complete understanding of what the business is trying to achieve from a security standpoint” 51 www.risk-uk.com

Female Business Travel Risk: A Need for Special Treatment?

D

Business travellers will always face a degree of risk, and particularly so when venturing into an unfamiliar environment where most individuals speak another language and have different customs. An increasing number of today’s organisations realise they can lessen or avoid prohibitive legal and/or financial consequences by proactively working ahead of time to reduce employee risks during trips overseas.

Darren Carter delves into the fine detail

Darren Carter: Head of Group Security at Edwardian Hotels London and Hotel Sector Security Lead for ASIS UK

50 www.risk-uk.com

espite the ever-present – and seemingly increased – risk posed to business travellers in today’s world, we continue to see a vast amount of business travel taking place right across the globe. Recent research suggests that the proportion of those business travellers who are female is now as high as 45%-50%: a direct correlation with the increasing numbers of female executives appointed into senior management roles.

On that note, I was recently invited to take part in a panel discussion about this very subject. The discussion was observed by a varied audience of experts and interested parties, among them travel managers, safety and security managers and hotel and travel agency staff. The premise for the discussion was ‘Safeguarding Female Business Travellers’ and whether enough is being done to meet the safety and security needs of that cohort.

Is there really a strong case to be made for any ‘special treatment’ of females when, in 2017, most large companies will have gender equality placed very highly among the key ‘must achieve’ tasks?

Two decades ago, when I first entered the world of hotel security operations, we were talking about female business traveller security at that very juncture, so this isn’t by any means an emerging subject. The discussion we held during this latest gathering was in fact very insightful and clearly demonstrated – at least in my own mind – that there may well be a case for special arrangements to be made that meet both specific and defined needs.

More generally, travel risk for any category of traveller has shifted significantly in the past ten-to-15 years in particular. The completely unpredictable nature of terrorism and rapidly changing environmental conditions affecting the travel and transport industry alone are two areas where an impact can be felt.

As companies examine areas in which they could potentially trim their costs, travel can often suffer with significant reductions in budgets. In some cases, this may considerably alter the risk profile of a given business trip.

Is travel necessary?

In many respects, the question should be asked as to whether the need for travel is absolutely necessary. Indeed, even where there’s no

pressure being placed on budgets, this should be the first question to be posed when considering any business excursions.

Placing a rate cap on hotel accommodation can often introduce further elements of increased risk whereby there may be inferior safety and security facilities at the chosen property, in addition to less ably-equipped staff. The area in which the hotel resides could make it more susceptible to crime.

Where can hotels begin to customise their business? How about tailor-made services for female business travellers? Should the arrangements made here be any different than those chosen for other female or male guests?

Not for the first time, it was suggested that hotels consider offering a ‘female only’ floor: an area of a hotel completely off limits to male guests, exclusively booked for ‘women only’ business travellers. I’m not entirely comfortable with this concept. It feels a little odd to completely isolate a group of people from the rest of the hotel population. If it were the case that guests occupying this class of room found themselves in trouble, there would be no male guests nearby who may come to their aid.

Commercially, such a scenario would be almost impossible to deliver, both in terms of honouring a brand promise or maximising revenue returns. If a hotel had completely sold out of its inventory with the exception of this standard of room then it would most definitely be sold to the first applicant who could well be a male guest. Back in 2014, a Danish hotel was found by a Court of Law to have discriminated when it opened with a ‘female only’ floor offer.

CCTV and access control From a safety and security perspective, such a concept wouldn’t offer anything more than a standard hotel bedroom. Most hotels will now provide guests with key card access control to lifts and bedroom corridors, alongside an almost blanket coverage of CCTV throughout all guest areas. If there were enhanced levels of safety and security realised as part of this ‘upgraded’ room type, it would ask some fairly challenging questions in times where guests in other rooms become aware – or, worse still, are an actual victim – of an act of criminality.

Most upscale hotel businesses will have a constant product development programme in

In the Spotlight: ASIS International UK Chapter

place which reaches for competitive advantages over peer groups in what’s an extremely dynamic and ever-changing market. Safety and security are featured prominently in the design process, building environments which are appealing and functional, but also as safe and secure as possible. Procedures are then constructed around them to further support that environment.

The mere mention of a hotel room number at the check-in desk could compromise the safety of a lone female business traveller. Procedures are in place to ensure no room numbers are mentioned at all to any guest when checking in to a hotel. This is common practice, although not 100% observed in my experience.

In addition, there are a number of other areas within a hotel operation where we constantly strive to minimise risk and promote safer and more secure businesses.

There are many people involved in the endto-end process of planning for business travel.

Each individual will have made decisions which may either provide for a problem-free safe journey or lead to serious – and potentially lifethreatening – situations arising.

The victims of crime – which may involve a phone snatch or a bag theft – will often say that the episode “came out of the blue” or “happened so quickly”. Invariably, if we can analyse such incidents a little further, we often see a series of events or clear indicators that the crime could – or was about to – happen. In truth, it’s often lack of awareness which leads to someone being targeted by a criminal.

Unprepared for travel Often, it’s the case that individuals are completely unprepared when they travel. Only when they run into problems is this ever identified. It’s a little like travelling without insurance: it’s unthinkable in today’s world that anyone would even consider this. As hoteliers, we provide help and support to our guests, even more so when they’re experiencing a time of crisis, when they’re the victim of a crime, a serious injury or a bereavement or even if they’re just simply having a bad day.

A common and often surprising fact is how little capacity a business traveller will have to manage the situation in which they find themselves. Often, we can and do resolve a multitude of issues. What this does say is that the individual’s employer may not be adequately preparing them for travel, the employee may not be listening or the advice being given is wrong or not extensive enough.

Continuing this theme, I would strongly encourage all visitors to a hotel to make use of

the in-room safe. It’s there to provide added security. At the very least it may delay access to a ‘would be’ burglar or even prevent the theft of valuable property and travel documents.

Preparing employees to be able to deal with a range of predictable situations in the workplace is, of course, the responsibility of their employer, whether for travel purposes or otherwise. Business travel introduces a dramatic uplift in risk, whereupon an employee is exposed to a much greater selection of scenarios. Without doubt, it’s the responsibility of the individual to ensure that he or she is ready for travel, fully-briefed and absolutely comfortable with the information provided. If not, they should challenge it or otherwise seek alternative advice or guidance, only travelling when totally satisfied.

What was abundantly clear at the recent panel discussion is that there’s a detailed debate to be had about the future of travel security in general, and not just for female business travellers. It’s always right and proper to question whether the advanced planning in place is as good as it can possibly be.

“There are many people involved in the end-to-end process of planning business travel. Each individual will have made decisions which may either provide for a problem-free safe journey or potentially lead to serious situations arising” 51 www.risk-uk.com

Security: A Great Career for Women Providing support and assistance for women operating in the security business sector should be a key trait of all security companies, but that necessity only comes after winning the battle to inspire those interested in entering the profession to actually do so. Here, Amanda McCloskey interviews several female security professionals to elicit their views on the sector and careers within for women

Amanda McCloskey: Sales and Marketing Director at CIS Security and ASIS UK’s Lead on Women in Security

50 www.risk-uk.com

ccording to national statistics compiled on the police service in England and Wales for 2016, 29% of the policing workforce is female. Compare this statistic with the 9% of females presently resident in the UK’s private security industry and it’s abundantly clear that we’re falling somewhat short on promoting security as being a good career for women.

There are a number of organisations – not least ASIS UK and its Women in Security Programme – fully committed to raising the numbers of females working in our sector, but it’s fair to suggest that more support needs to be given in order to fulfil the potential locked away in gender diversification and allow the private security sector to better reflect the diverse populations it serves.

The benefits of more female security professionals can be realised by both clients and the female members of staff who do take up the roles on offer. Speaking to some experienced female security professionals at a Top 20 premium security company, it becomes clear that we have an excellent opportunity to dispel some of the myths about a career in security for women by sharing success stories like these with those who are at career decision stages in their lives.

The talent is so obviously there: we simply need to let females know about the potential that can be found and realised within a security business sector-centric career.

Maverney Jones is a security team leader at one of London’s foremost universities. Jones is a multiple award-winner in the security industry, but was it always her dream to work in our sector? “No,” replied Jones. “It never even crossed my mind as being a career for me.

When I was a little girl, I dreamed of marrying and becoming a Mother, but as I grew up, I realised that I would need to create options for myself. I studied accountancy when I finished school with a view to becoming an accountancy teacher, but ended up working in the financial services sector in a data entry role.”

How, then, did Jones begin her career in security? “I was at a career crossroads and a female friend of mine, who really wanted to work in the security industry, suggested we both retrain for security roles. I wasn’t sure at first, but it helped that, at the time, my local Council was working on a talent search initiative with my current employer and, as a result, I was supported with funding for my training in door supervision and CCTV.”

A

Challenges of the role Fast-forwarding Jones’ story to the present day, this professional enjoys the challenges of her role, the variety it provides and the “unwavering support” received from her line managers. “I’ve achieved so much and grown in confidence through my work. I come from Jamaica. It’s a developing country wherein working life isn’t always fair and there’s much progress to be made when it comes to gender equality. Working with my team and with my client, I know that if I work hard I’ll be recognised and they’ll push me to attain greater heights the more they believe in me.”

Has Jones struggled with the fact that security can be a male-dominated environment? “I have found it somewhat challenging at times,” responded Jones, “but what job isn’t? I love challenges and I really enjoy proving how I can be as good, if not better than my male counterparts. I now have the awards to prove my ability.”

In terms of perceived barriers to women working in security, does Jones believe there are any in existence? “No, not really,” explained Jones. “I keep telling people that joining the ranks of the security business sector is one of the best decisions I’ve ever made. Once I showed my managers that I was willing to work hard and help out at short notice, I gained their trust and they kept their word about recognising me and promoting me, and subsequently put me forward for award nominations. This really motivates me to keep improving as a security professional.”

By dint of a growing knowledge base, heightened experience and a continual focus on training, Jones is adamant the security profession will keep on improving. “It’s not just a job. It’s a career. Who knows where I could be in a few years’ time? Maybe I’ll be the managing director of a security company, or perhaps working as a security expert in the Home Office.”

When it comes to advice for those women considering a career in security, Jones harks back to working hard and being involved in as much training and education as possible.

“Learning new things has totally opened my mind to the possibilities,” said Jones. “You have to be prepared to be there for your managers and show your dedication to the company and its customers.”

Marta Tworzydlo is a contract manager working for a client in the healthcare sector and

In the Spotlight: ASIS International UK Chapter

looks after daily operations on a challenging site. Tworzydlo arrived in the security world with a background in Human Resources, beginning in the role of security officer before being quickly promoted to Control Room operative and then into a supervisor’s role at one of the world’s most recognised banks based in the City of London.

What does Tworzydlo enjoy most about security? “I really enjoy the work and I’ve been motivated by the praise and encouragement I receive for doing things in the right way and making our client happy. Looking back, 9/11 and 7/7 changed everything. Everybody had to re-evaluate the way they were doing things. I think this is where talented security professionals shone, realising new ideas and being proactive to make people feel safer.”

Did Tworzydlo struggle with the fact that it was a male-dominated environment? “No. My whole focus has been on achievement. My Mother is an inspiration to me given her amazing work ethic, so I try to be like her and focus on my work. I know that, if I work hard, I’ll achieve the results I want. By doing things the right way I can have a positive and professional impact in the workplace for both my employer and the client.”

Does Tworzydlo think there are any current barriers to women working in security? “No, but male or female, you may need to be strong to deal with the flexibility of the working patterns.

You need to have a balance. Getting up at 4.30 am to be on site for 7.00 am for four or more days in a row can be hard, so you need to make sure you rest well on your days off.”

It took some time for Tworzydlo to get back into the swing of things after returning from

maternity leave, but doesn’t feel that’s unique to the security industry. “Many Mothers that I’ve spoken with find this tough. I was delighted to find myself a role which was nine-to-five in nature. It’s something which works well with my family life right now. I’m not going to list the challenging things I see every day. Those challenges are confidential to my site. They’re also part of the reason why I enjoy the security role so much.”

Progress in the sector Tworzydlo has witnessed much progress in the security business sector in recent years, but would like to see more qualified individuals – not just women – occupying security roles.

“The key is in the training and development of people,” said Tworzydlo. “Whether they’re male or female, individuals should always understand their roles and enjoy the fact that they’re making a genuine difference in the world. This is something which security has the unique privilege of being able to deliver.”

In terms of sound advice for any women considering a career in the security business sector, what are the key points to note?

Tworzydlo responded: “Try it out. If you like it, stick with it for a while and gather more and more confidence. If you feel you’ve given security your best shot and you don’t find it appealing, leave the sector and find something else that will make you happy.”

“Individuals should always understand their roles and enjoy the fact that they’re making a genuine difference in the world. This is something which security can deliver” 51 www.risk-uk.com