Home > Articles By Issue > Safety & Security > Article Mar 2004

Special Report
Security: Building A Stronger Foundation

By Joe Ricci

According to the Budget of the United States Government, Fiscal Year 2005, "Total funding for homeland security has grown significantly since the attacks of 9/11. For 2005, the President's Budget includes $47.4 billion for homeland security activities, a $6.1 billion (15%) increase over the 2004 level. This is $26.8 billion, or 130%, over the government's funding level for 2002."

Ironically, expenditures into the commercial sector's security needs will more than likely experience minimal benefit from projected federal funding. According to a 2003 survey conducted by ASIS International, spending in the commercial security sector increased by only 4% in the 18 months following the attacks of 9/11. In fact, the majority of that spending took place immediately following the attacks.

Clearly, facility professionals are faced with some uncertainty regarding the financial support of corporate security measures. Still, these executives should be able to protect the people, property, and practices within their buildings by taking advantage of the growing number of tools available to them.

Additional Involvement

In many ways, the close analysis of commercial security has actually drawn facility professionals deeper into the management of these tasks. Simply put, the pursuit of cost effective, practical security measures has created a larger demand for consolidation. Because of their knowledge of buildings, their experience managing outsourced vendors, and their direct relationship with senior management, facility managers are naturally poised to play a greater role. Even if in-house security personnel are in place, many are falling under facility professionals in the management hierarchy.

Last December, TFM released the findings of its research report entitled "The Changing Role Of The Facility Executive." Sponsored by Muscatine, IA-based Allsteel, this survey identified increased security as one of the most important issues affecting the jobs of facility professionals-second only behind the impact of computers. More than 50% of the respondents indicated they regularly handled security and disaster planning issues. They also mentioned that one of their biggest challenges was the integration of evolving security technologies.

Familiar Tools

As facility professionals struggle with the increased responsibilities associated with security integration, upper management continues to emphasize reducing costs and liabilities while achieving increased productivity. To make the case successfully, facility managers will have to demonstrate added value, increased productivity, and reduced liability. Accomplishing this goal will require the assistance of various tools commonly made available to facility professionals.

Open Systems And Web-Based Solutions. Familiar because of the connection with CAFM and CMMS, open systems and Web innovations offer real-time access to important security data. Historically, however, the typical system consisted of several different components, and in turn, numerous product vendors. These functions were managed through several closed systems and databases.

But now, "People want to be able to open and close doors, change access protocols, review and record video images, track time and attendance all from their mobile phones and PDA devices," says Bill Bozeman, president and CEO of Denver, CO-based PSA Security Network. "We are getting a lot closer to true systems integration. Customers are demanding increased functionality and the industry is struggling to stay current with evolving technologies," he observes.

"[With] the convergence of user friendly interfaces, scalable technology, and workable ASP applications, facility professionals can manage larger teams of internal and outsourced solutions," explains Anthony Petraco, president and CEO of Woodbury, NY-based Valiant, Inc.

"The evolving power of the Internet, wireless technology, and integration are creating very powerful management tools for daily operations and for emergency management," Bozeman adds.

Outsourcing. Another familiar facility management concept, outsourcing can be appealing when applied to security tasks. By outsourcing services, companies maintain better control over administrative costs and overhead (such as salaries, benefits, and work space).

Although handling multiple outsourcing partners requires a variety of management and communication skills, the proper selection of these partner relationships can build a more effective security and safety program. Additionally, outsourcing frees up facility managers to focus their efforts and expertise on traditional core functions. Performance Metrics. While facility professionals frequently seek benchmarks for building performance, the standards of operation for their outsourced security vendors is equally critical. Thus, organizations are reinforcing their screening procedures-and hoping to minimize liability-by seeking vendors who can help them develop performance matrices.

Says Prentice Robertson, executive vice president for St. Louis, MO-based Whelan Security and the Transnational Security Group, "To manage a security force effectively, we've identified two critical and consistent elements: on site project or account management by the outsourced provider; and a monthly quantifiable and measurable performance scorecard provided by the outsource company. This baseline ensures the vendor is in compliance with training requirements, licensing, and other standards-as well as meeting or exceeding expectations and living up to its promises."

Glen Sandford, manager, corporate security and safety, of McLean, VA-based Gannett Co. Inc. adds, "Performance metrics are big. Working collaboratively with all our major vendors, we've defined success in their respective services and set up systems to identify and measure their success."

Voices Of Frustration

In spite of familiar parallels, facility professionals still struggle with some security issues. During last year's TFM Show® at Construct AmericaT, more than 85 facility managers participated in an open forum discussion of the latest trends in security What quickly came to the forefront was the frustration experienced by many of those in attendance.

Facility professionals were seeking turnkey security solutions or comprehensive checklists that would help them determine what needed to be done to secure their facility. Yet, the lack of access to valuable, accurate, and unbiased information made the task seem impossible.

Unfortunately, no single solution can be replicated to the same effectiveness, even when circumstances and properties seem similar. Instead, facility executives were urged to consider the importance of thorough security assessments.

An assessment allows managers to determine site specific risks, evaluate existing measures, and decide what solutions are-or are not-affordable. This information provides the guidelines for the development of the proper level of security measures, policies, and procedures. Facility professionals need to implement only the most practical measures and policies based on real risks and threats.

"It simply makes good business sense," states Andrew Podolak, vice president of operations for Washington, DC-based Global Options. "Security assessments provide facilities with a blueprint for minimizing risk, which in turn maximizes productivity and cuts losses in the event of an emergency."

In fact, security assessments are becoming so important that many government entities and organizations have begun developing guidelines and standards intended to bring consistency to the process. For federal buildings, ports, and other facilities, specific timelines and checklists have already been mandated. These mandates are likely to impact the commercial sector as well.

Disaster Planning

Similar to risk assessments, disaster planning and prevention programs are essential to every facility executive's security program. In fact, for companies with more than 10 people, OSHA requires a written evacuation plan.

An evacuation plan assigns responsibility for floor wardens, evacuation routes, and other requirements. Each potential incident, from fire to bomb threat to a workplace violence incident, requires a separate planned response-including whether or not to evacuate and where to go if evacuation is necessary.

There are many examples of successful development plans that demonstrate how practice drills save lives. However, there are far too many sad stories filled with injuries and fatalities.

Podolak asks, "How can you tell if a plan will work unless you test it? Many companies have their plans on a shelf and have merely created a huge risk and liability problem."Crisis situations that have gone mortally awry are often traced back to disorganized, unpracticed response plan. Examples include workplace violence situations where people were wrongly evacuated. By emptying into halls and rushing out of buildings, those evacuees became targets themselves.

"Emergency situations create panic, and people instantly rely on learned response," states Podolak. "If you don't regularly review the plan, drill the plan, and properly document the plan, you will lose valuable assets and create liability circumstances. This can translation into huge losses and may mean the end of a company. Nearly 2/3 of all companies that experience a disaster never recover and are out of business within three years."

In spite of this unpleasant reality, there are many innovative products that may help facility professionals plan for disasters and emergencies. Manufacturers in this area have been working diligently to introduce products that will help ensure continuous operations for businesses while improve physical safety for personnel.

Access Control

The most recent developments in this area involve the adoption of new identification technologies such as smart cards, biometrics, facial recognition, and integration of access control with other security systems like CCTV and Web-based applications. Smart cards include an embedded chip that can be either a microcontroller with internal memory or a memory-only chip. The card connects to a reader with direct physical contact or with a remote contactless electromagnetic interface.

With an embedded microprocessor, smart cards have the ability to store large amounts of data, carry out their own on-card functions, and interact with a smart card reader. Smart card technology is increasingly being adopted by commercial and government enterprises for ID systems that must support fast, secure, identity verification.

A smart card-based system can deliver a proven, cost-effective solution that accurately verifies cardholder identity. It may also meet the need to protect personal information. Password theft and unprotected PIN-based controls are the top security threats to internal information networks.

Biometric devices have been in use for a number of years, but they have only recently begun to be more readily accepted and implemented due to reliability improvements and price reductions. These technologies measure a wide variety of distinct characteristics, including eye and facial recognition.

The most widely used biometric access controls are hand and finger readers. These technologies are effective not only for access control but also for time clocking and attendance.

Professionals should consider five key issues when examining biometric technologies:

1. Acceptability. If people are afraid to use a device, they may not operate it properly. Privacy concerns also must be addressed. The higher the level of security, the more intrusive the biometric. Make sure it will still be acceptable to users.

2. Ease of use. People like using security tools that are simple and intuitive. The larger the population, the more critical this factor becomes. For companies many employees, 10 minutes of training time per person can add up quickly-making the enrollment process a nightmare.

3. Functionality. How well a biometric system works will determine if it stays on the job. If a biometric feature is working properly, it does two things: allows authorized access and denies trespassers. Biometric devices face two error issues: false accept and false reject. Since every attempt by an authorized user is a chance to make this type of error, this rate becomes more important as the number of transactions increases.

4. Throughput. The total time it takes for a person to use the device is a logistical issue that should be considered carefully. This is difficult for manufacturers to specify, since access control is application dependent. Most manufacturers specify the verification time for the reader, but that is only part of the equation. The elapsed time from presentation to identity verification is the verification time. Potential customers must look beyond the verification time, however, and consider the total time it takes a person to use the reader. This includes the time it takes to enter an ID number, if required, and the time necessary to be in position to be scanned. The total time required for a person to use the reader will vary between biometric devices depending on their ease of use and verification time.

5. Enrollment. The failure-to-enroll rate quantifies how many people simply cannot be enrolled in the biometric device for one reason or another. If too many people cannot be enrolled, the technology simply can't be used.

Facial recognition software is another developing technology. This type of biometrics analyzes facial features and landmark places on the face called nodal points. (There are approximately 80 nodal points on a human face.) Some of the nodal points measured by facial recognition software include: distance between the eyes, width of nose, depth of eye sockets, cheekbones, jaw line, and chin.

In theory, the software program can be set up so only a given percentage of nodal points need to be matched by the computer to yield a positive identification. The software uses an algorithm called local feature analysis (LFA). Each faceprint is stored as an 84-byte file.

Using this methodology, many faces can be stored in a given database using a minimal amount of digital memory. The computer scans the face and then assigns a value using a scale from one to 10. If a score is above a predetermined threshold, the computer declares a match. The operator then reviews the face or group of faces selected from the computer database to determine the correct match.

At present, facial recognition technology holds much promise for ATM security, check cashing identity verification, and elimination of voter fraud because local field conditions can be carefully controlled and monitored. However, reports from the field have claimed that when used to monitor large crowds to locate criminals at large, this technology has not provided optimal results. The problem is that a person must position his/her face a certain distance from to the camera in order for a correct identification to be made.

Integrating biometric elements with smart cards and IDs appears to be a rising trend. When a typical badge is lost-from the time it's misplaced to the time it is subsequently reported-that badge is still alive and active in the access control system. By adding a biometric feature to the access control system, a badge alone cannot be used to gain access. Both the badge and the biometric are required, eliminating a possible breach.

Smart cards raise the bar even higher, providing additional capabilities. Facility professionals must be cognizant of the template size required for the integration of smart cards with various biometrics.

While access control technologies are helpful, they are not as important as the implementation of the right system. To articulate the pros and cons of biometric technologies as they apply to individual applications may make the difference in system acceptance by upper management.

CCTV

One of the great advantages digital CCTV holds over conventional video recording technologies is its networking ability. Digital CCTV is an extension of more common computer models and architectures, making it similar to computer networks. Network capable CCTV architectures generally follow the server-client computer model, where the server accepts all the cameras and records incoming video; the client is used to access live or recorded video. As with any network, system performance is highly dependent on a number of factors: equipment selection, volume of data transmission, software architecture, and network bandwidth.

For CCTV, image resolution, quality, and compression are a main concern. After all, the objective is to record images of maximum visual quality and size based on facility variables such as purpose of video, threats faced, and network resources available. Data volume, image quality, and compression trade-offs are common concerns-particularly as network bandwidths become strained by added system integration.

Digital systems being implemented by facility professionals are overcoming this issue by using cameras that store recorded video internally. The systems only transfer stored images to the server when the bandwidth requirements are at a minimum. The principal reason behind recording video is to review it when the need arises. The challenge facing facility and security personnel is how to review and search for specific video images or clips quickly and accurately.

Search performance-the time it takes to find an image-is directly related to the capability of the video storage system, its structure, and the total volume of data stored. Digital CCTV has the means to capture and store millions of images, and it has the ability to review an image or clip quickly, based on time, alarm triggers, and motion or event detection.

Digital CCTV also allows facility executives to combat another growing concern: false alarms. Due to this continuing problem, cities such as Los Angeles, Salt Lake City, and Las Vegas now require visual or audio confirmation of alarms prior to response. Companies are also considering measures to confirm entry of unauthorized people during fire emergencies. By integrating CCTV systems so visual verification can be obtained and sent to PDAs, mobile phones, or e-mail, facility executives and law enforcement professionals can view properties in real time.

One major consideration for those looking to implement such systems is knowing how to set up the equipment to capture the right information effectively and efficiently. While corporations have set up multiple CCTV cameras in their buildings and around their properties, monitoring numerous video surveillance cameras can be a daunting task. To combat this problem, detection devices integrated into CCTV cameras allow video to be displayed on the monitors only when motion is detected. This technique can be used to minimize the amount of visual information that the security officer at a command center has to view at one time.

Nonetheless, there are many 24-hour facilities, and this makes motion detection technology a less than optimal solution. Other advances (such as behavior recognition technology) have made monitoring numerous cameras more manageable.

Behavior recognition software programs use complex mathematical algorithms to track pedestrians and vehicles as they pass in a camera's field of view. Cameras can then classify the motion and activities of each.

Programs are designed to detect an array of behaviors such as: someone lying on the floor; pedestrians moving in an erratic way; a person or vehicle staying in one place for an extended period; a person or vehicle traveling against the flow of traffic; someone running; someone dropping a bag or other item; and objects newly appearing on the scene.

The program uses a combination of velocity and geometric shape analysis to detect if a person has fallen. These programs may be maximized by having a few key surveillance cameras on display; other hidden cameras in the system can be called up only when some type of anomalous activity is detected.

This intelligent video technology is currently being used at major airports with good success. At Palm Beach International Airport, for example, the system detects wrong way motion at the exit lane on the concourse level. This prevents anyone from attempting entry to the secure concourse level by way of the exit lane. At Dallas/Fort Worth, the system has been installed at three American Airlines checkpoints to monitor wrong way motion as well.

This technology continues to be developed and improved. It should become an effective security management tool for those professionals charged with corporate and industrial physical security responsibilities.

Glass Safety

During hurricanes, vandalism, terrorist attacks, and other incidents that shatter windows, glass is the leading cause of injury and death. This is significant because it is believed that more than 50% of injuries and fatalities result from flying fragments.

Consequently, window film can have a significant impact on many of the most probable risks facing facilities today. Window film treatments significantly reduce the fragmentation and integrity of windows.

These tough, self adhesive safety films use multiple layers of polyester to form a heavy gauge, high-tensile skin for glass surfaces. The skin provides a level of integrity to the glass that mitigates glass fragmentation and the creation of glass projectiles that could potentially become life endangering shrapnel.

This solution may provide additional benefits for the building's energy costs. Solar protection can lead to a reduction of the absorption and retention of heat, thus moderating thermostat usage to regulate comfortable settings. Reducing glare into offices can help to protect people from ultra violet rays.

However, "Energy films are not constructed to provide any additional level of security and safety," clarifies Darrell Smith, executive director of the International Window Film Association (IWFA).

"The most desirable aspects of energy film, to be as thin and clear as possible, and the properties of the adhesive process eliminate virtually any value as a security or safety measure," states Smith. "Safety and security films work by using the adhesive to maintain the integrity and shape of the glass fragments themselves."

Many users turn to consultants to analyze risks and determine the necessary levels of glass performance based on the risks associated with man-made and natural threats.

Facility professionals should keep in mind these are often costly assessments and only affordable to larger companies.

"The biggest problem is middle to small commercial owners often don't understand their risks and the most-effective means to overcome these concerns," says Smith. "These owners may not have high risk facilities, but they're located near higher risk occupants or are in the path of more natural dangers."

According to experts at Martinsville, VA-based CP Films, the glass safety marketplace has been driven by cost-effective and productive safety solutions that reduce the damage created by flying glass. Thanks to evolving methods of attaching film to existing structures, using window films has made retrofitting a more affordable process.

Education, Awareness, And Training

Without a consistent and deliberate plan, the implementation of security technologies, measures, or planning is ultimately a disservice to the organization. "All the latest biometrics, RFID cards, CCTV equipment, and other security measures are dependent on people," says Podolak. "As humans, we often fall into behaviors and patterns that may counteract even the most stringent security controls."

During the implementation and initial introduction of security, training plays a vital role. However, it's the follow up training, drills, and surprise tests that determine the true positive impact of a system or policy.

"We are often contracted to conduct assessments and told by the client that they have state-of-the-art equipment and that the survey is a mere formality," explains Podolak. "This is usually our first clue that complacency and a lack of appreciation for the human element has taken hold.

"Our assessments are done without an appointment, and we often show up and walk through the entire complex unchecked simply by looking like we belong, acting like we know where we are going, and using propped open or held open doors and access points. We've found companies with complex CCTV systems and no monitoring or recording capabilities," he continues.

"People are often too busy for security or expect to be exempt from following procedures due to their position. Having a series of three ring notebooks containing all the safety and security policies and procedures is more than useless-it's dangerous," explains Podolak. "Manuals piled on shelves foster a false sense of security and will create huge liability issues for companies that don't implement or monitor the compliance of their own security policies and procedures."

The key to sound security is conducting regular security surveys and assessments, implementing practical cost-effective measures, and developing easily understood and applicable policies and procedures. By reinforcing this approach with ongoing training, facility professionals will be better prepared to face the security challenges ahead.