Chapter 11

The Inner Defenses: Intrusion and Access Control

Goal: To offer students an overview of physical security as it relates to inner area security and the equipment routinely used.

Objectives:

• To understand the significance of doors, files, safes and vaults in maintaining adequate security.
• To understand access control, including traffic control, control of visitors and employees, and package control.
• To identify and explain various types of alarm systems and sensors.

Lecture:

"Within any building...it is necessary to consider the need to protect against the internal thief as well as the intruder." (This is a quotation from page 193 in our text.) Here we first meet the potentially dishonest employee. We are inside the building, and control of sensitive areas and pedestrian traffic is essential. This is true for employees as well as visitors (customers, vendors, repair persons, etc.).

By now you should all understand that there will be big differences between the security system at a nuclear power plant than at a big department store. There are different threats and different operations that need to be supported at each. For example, if you tried to apply the security measures from a nuclear power plant to a department store, no customer would ever get into the department store and you, as the security manager, would not last long in the job. (I used to be in the nuclear world and when we went to the reactor we needed to be processed through several security stations; strip down; put on coveralls with no pockets; be monitored at all times for radiation as well as operations that we might be performing; always under a "two-person rule" escort; etc.

You also know that you must do a threat evaluation and conduct a survey of your facility. In the survey, you should be able to determine the traffic flow inside your facility. Where and how do employees, visitors, and products move about? Where are there weaknesses (vulnerabilities)?

In most facilities these days, employees wear badges that tell who they are and where they are allowed to go inside the facility. These badges might also provide indication of security clearance, programs or departments they work in, etc. Most facilities now use badge making equipment that uses digital cameras and computers to make the badges and keep records on each badge made. There must be a system of accountability of badges and for dealing with lost badges and badges of employees who leave the facility, especially if they are fired. (With digital photos of employees, you can even send a photo to the main entry points to say, "This person just got fired so don't let him in if he comes to the gate or lobby.")

In the retail world, you can't badge customers so you need to count on other security measures to deal with them. For now, we'll focus on facilities other than retail where you can and must have more control over visitors. In such a facility, you need to consider badging visitors with a special badge, different from employee badges. You need to consider escorting visitors. You need to consider whether or not visitors need to be arranged for in advance, or can they just drop in unannounced? And these days, you might need to consider whether or not foreign citizens can visit. (This is the case partly because of the current world situation but also because of U.S. export laws. These are laws that regulate the export of U.S. hardware, technology and services. One law, known as the International Traffic in Arms Regulations, controls export of weapons and other military commodities..)

What about using "personal recognition" as your system? Actually, in theory, this is better than a badge. However, it works only when the number of employees is relatively small (50 employees or less is the general rule). For this reason, it is not used in larger facilities.

Back to badges: in some really large and sensitive facilities there may be a badge exchange system. In this system, the employee (or visitor) who has need (sometimes called "need-to-know" - this means a given person needs to know the information or process in a certain program or area), exchanges his or her badge for another badge that gets them into the more sensitive area.

What about package control? Can employees or visitors bring anything in and take anything out? Most businesses don't let employees (or visitors) bring in guns, booze (where I work no booze is the rule except when we get visited by Russian inspectors who sometimes come under the auspices of international treaties - they like to bring vodka for a toast so we let them), drugs, etc., and most don't allow company property out. (Here's another booze story: where I work, we have our own sewage treatment facility. One of the tests that we do uses alcohol. It turns out that it is much cheaper to buy a bottle of Everclear than a drum of industrial alcohol. I allow the Everclear in under strict controls.) In the retail world, employees and visitors can't take out unpaid-for merchandise. For this reason, in many businesses, there are warning signs about contraband and theft. And, there are usually some kinds of controls over hand carried items. Perhaps employee lunch boxes and purses are subject to search. And customers might be subject to similar searches. In retail establishments there might be electronic article surveillance ("EAS") systems in place. These are the gate-like systems you walk through as you leave the store. Articles in the store have a little device embedded in the price tag that is removed or neutralized when you pay. If you don't pay and walk out, the EAS sends an alarm and you are caught. Hate it when that happens!!

The text discusses file cabinets, safes, and vaults. Read about them on pages 198 to 202.

Let's look at interior alarm systems. There are alarm systems that protect an entire room or facility. There are alarm systems that protect an object inside a room, e.g., a safe or a diamond display case. Alarm systems have three main components: a sensor; a circuit that sends a signal; and an annunciator that receives the signal. You can read about all these components in the text on pages 204-212.

Let's talk a few minutes about how and by whom the alarm system is monitored.

Central station - in this set up, a company such as Ken's Burglar Alarm Service sets up an office that services several clients/businesses. Ken installs the alarm sensors, hooks them all up to a circuit such as fiber optics, and runs the cables to this central office. For a fee, Ken's monitors all those alarms and when something comes up, calls the police and the customer to respond.

Proprietary system- in this set up, the facility buys a system and monitors all the alarms in a central security office. That office is staffed by a contract or proprietary security officer who dispatches other officers or the police to the area where the sensor went off.

Local alarm and local alarm-by-chance system - all this is is a siren or horn that goes off and that summons security officers or the police to the scene. (Have you ever heard one of these? Did you call the cops? Probably not. That's the main concern about these systems.)

Auxiliary systems - these are tied to police departments. However, the rate of false or nuisance alarms has caused police departments to be very reluctant to provide this service. Sometimes they charge a fee or they assess fines for nuisance alarms.

Dial alarm system - this system causes the sensor to activate a phone that dials the police or the building owner and this delivers a recorded message that says, "Please respond to 215 Oak Street." Again, most police departments don't like these.

Assignment: answer review question 1 on page 213.