SECURITY PERCEIVED

Security Perceived Is Security Achieved Lets change hats for a bit. If we are not able to draw upon experience by finding the right category to file our situation in, we must think of things in different terms. Instead of drawing on what has been, we consider what might be. In other words we think like the aggressor instead of the defender. Be the bad guy, think of what he might do or can do. How might the area I protect be probed for weakness and those found, be exploited? Where are the soft spots? How can I take advantage of what is known? Just what is known? Lets start with that question, seeing as I think it is most important. Knowledge is a very powerful thing, a little goes a long way, the more you have the better you'll fare. The less the other guy has is even better. We as security professionals must take great steps to protect the secrecy of our patron's/client's business, the systems in place to protect it and the recovery plan after the fact. This is paramount.

Perception of what systems are in place and the capabilities of your response should be carefully tailored to send the right message. One message to the casual observer might be that doors are locked after hours and an alarm system is used. In certain circumstances this might be adequate and cost effective. Another stronger signal might be uniformed or armed Officers patrolling a perimeter. Marked vehicles, canine units, Overt CCTV all speak volumes as to what you are willing to invest to protect assets.

These indicators may slow some and stop others.

We can never truly know how effective they will be. Only history will tell the tale. If the sign on the door says beware of dog and it works, great but some day someone who wants in badly enough will pay attention long enough to know there is no dog. I'd rather have the dog and no sign then the sign and no dog. Let them learn the hard way and guess whats behind the door after they hear the barking but I surely wouldn't educate them.

Procedure in communication, tactics or even policy must be guarded and shared on a need to know basis. Security levels should be maintained so that crucial information such as passwords, call signs and codes only be given to those that must posses such information. This goes up as well as down. Being the president of the company does not automatically mean you are in the loop. If the CEO needs this info then by all means, if not then never share for the sake of "giving the Boss his due". Today the Boss, tomorrow who knows. This has happened to me more then once, administrators being shown the door. Now my work begins. What information did they have? What must I change in the security program so I can sleep nights without fear of disgruntled reprisal? Could I have kept such information to the need to know team and still steam forward secure and with all systems in place?

We play our cards very close to the vest and that's how it should be. It's a special thing when we can trust our assets but do not share for the sake of the old boy/one of the gang /he's with us reasons. Things change.

I have seen procedures casually discussed in meetings where only three of the twenty five people at the table had any real need for the information. Never do it.

Changing critical security measures after a administrative change can be fast and easy if only a few are involved, a nightmare if lips have been loose.

The sign out front is the starting point of your perceived security deterrent. Keeping security information well guarded is just as important.

In the business it's about what we allow others to know.

Posted by RJ MOSCA at 15:07

PEOPLE WATCHING PEOPLE

Categorizing People and Situations

We all work from an over filled Rolodex in our mind. We are constantly adding and taking away categories or individuals within a category. As Shakespeare said "The world is a stage and all it's people players." We observe and categorize people and situations in a file in our head. We all do it, our Mothers did it to better address our individual needs as we grew. Our Teachers did it to help us digest information in ways we as individuals would understand and retain. Even a waitress knows how to qualify a customer for a tip and thus adjust the amount or type of attention they should receive. In fact maybe the best people at categorizing people are sales people. In a flash they can tell you more about a person then you would believe, and be correct more often then not. They provide a service, a favor for a fee, not a tangible hold it in your hand article you can take home and scrutinize. They need to satisfy your need there and then right on the spot.

So where do we fit in? We must be able to accomplish both tasks well and even more effectively. We must learn through observation and the security mind set to "categorize" individuals and "respond" appropriately. But wait you say, isn't that profiling? It sure is. Try to get through the day without profiling. It can't be done. The way we present ourselves throughout the day is directly in response to our auto profiling behavior. The tone of our voice the posture in our stance and smile, smirk, stare, sit, drive, walk. All a product of profiling. As an exorcise, watch what some men do as a beautiful woman walks toward them. They first will categorize in a flash then react in a sudden and sometimes drastic and detectable way, like sucking in the gut or standing tall or maybe even dropping the voice an octave as they bid good day. Twenty five feet further down the hall an elderly woman approaches and gets a totally different reaction. Just around the corner a tall muscular jock type waits at the elevator, a new audience and a new stage for an entirely new show. It's an auto reaction all sexes and cultures have and use to some degree. Reading and learning to read People. Good sales people can profile you before you open your mouth. They take it all in and pull a card from the Rolodex in their head and start the pre-programmed sales pitch complete with subtle modifications specially selected to suit your profile. They may check your shoes or your hair or take note of logos and style of clothes, the manner of your walk or the way you "present" as you walk into the sales area. You open your mouth and give even more information, not so much by the words spoken but the style or slang of the voice. Intelligence, monetary worth and social standing is then plugged into the equation. Further development of the profile is made and before you know it you are pegged to the exact card in the Rolodex. With this information the sales person acts on experience of what has worked in the past. Failure doesn't mean a loss of the sale it only means a change in tactics. If they start to wonder from the category they put you in, they adjust by combining categories until the correct signal is received. I for one wouldn't have it any other way. It serves me well by being tended to by a person that can "read" and steer me towards what I'm looking for. The truly impressive thing is that really good profilers don't even know they are doing it. They call themselves "people persons" and in fact that's true but not for the reasons they think they are. They will tell you they "like people" but what they like is the game of reading and dealing with strangers. It is like Fencing or maybe even Wing Chun, it's a none verbal conversation. A probe and reaction, a question and an answer. Arriving at the right answer gives them pleasure and satisfaction, a real feeling of accomplishment, they love their jobs. The best have been at their jobs for years and many customers with patronize the business just to receive that level of "comfort". They are known, somebody cares, they are treated well. They as customers are unaware, but they have a card with their name on it in that persons Rolodex.

I take the time to be cognoscente of what and how the sales person is doing. He or she may not know they are being studied by me and who would but they have much to teach the security professional. We as professional observers have much to learn from such people. Watch and learn.

Keep watching and learning. RJ Mosca

A SECURITY MIND SET

A SECURITY MIND SET A fresh look at an old idea.

One is not born with a suspicious mind, we earn a suspicious mind through observation, experience and reaction. Animals avoid a poison water hole because of the bones on it's banks. Those that ignore the signs add to the bones. Those of us that are "professionally" paranoid or suspicious come by it the hard way. This is not always a bad thing, in fact if cultivated and nurtured it can be a valuable asset. Of course one must expose oneself the the right kinds of stimuli, experiences and situations and see them through to fruition in order to learn what lessons they have to teach.

The security professional must recognized them for what they are in order to learn to differentiate, categorize and collate these at times subtle indicators. Things are often not as they seem.

Can we trust our fellow man? To some degree the answer is almost always no. A person is capable of many things, not all in line with laws or rules. Desperate people can do desperate things at times. The expectation of what any given person is capable of is a difficult skill to master. Many times we know people for years and are still surprised at what they are capable of. Criminals are people, and people are as different as the stars in the sky. Today a successful business man with a beautiful home, wife and two kids in collage. Trips to Hawaii with his and hers Lexus in the drive. Tomorrow in hand cuffs standing before the judge working out a plea deal for a crime his neighbors never would have suspected him capable of. It happens every day and all around the world. Can such behavior be predicted? Of course not. If it were people like you and I would be out of a job over night. But it's our job to try.

So it's back to the drawing board to learn at the most basic level how to do the job we as security professionals are tasked to do. We provide many things in the name of security, systems both real and theoretical. Formulas based half on first hand experience and half on hypothesis. Like a doctor, we examine a problem and based on our experience or the experience of others make suggestions or changes if we are empowered to do so. We let the program run for a bit and watch to see if the boat floats or if it springs leaks. If it floats we pat each other on the back and collect our pay for a job well done. We sleep the sleep of children with happy smiles on our faces. If on the other hand it leaks, we fill the hole we missed with our first appraisal of the the situation and we watch again. Sleep evades us as we ponder the possibilities and consider alternatives. If we care, we worry a bit.

The security professional can be mildly paranoid, allowed to sweat the details, a worry wort, that's us. Those of us that have worked with varied experiences and situations can readily predict and propose how to react to an incident after the fact. This however is not the job we are tasked with. We are not merely "reactive" to an incident like a policeman, fireman, ambulance crew or attorney. We are expected to be "Pro active" to avoid an incident that might cost our patron/client loss of assets such a Property, Reputation, loss through litigation or even loss of life. We learn quickly from our mistake and if we are lucky, by the mistakes of others. Observe, react and report is our mantra. We exploit our own soft spots and weaknesses and come up with solutions until we reach a point where we can find no soft spot to exploit. We must never wait for others to take advantage of the wrinkles in our security programs. Ignorance is indeed bliss but once we are enlightened we must act to address the wrinkle or suffer the consequences.

If you are suitably interested and of an open mind, I will endeavor to peal back the facade on the subject of security and try to give you a view of the security mind set that is the foundation for security programs no matter what the task be.

RJ Mosca

The Flavor Of The Month

THE FLAVOR OF THE MONTH

Predictability is the the crack that eventually brakes the security dam. If your security program and its procedures are so predictable that an interested party could examine and exploit it, what have you accomplished? Nothing but forestalling the inevitable. In today's climate of mass produced fast fixes and off the shelf answers, we tend to put much faith in "products" both tangible and theoretical for the solutions to our fears. If the business down the road puts up fencing maybe we should. If the anti car bomb barrier is now designed in some business, maybe we need one too. Facial Recognition Software is being used by a company in Europe, so our business may need it too. BUY BUY BUY.
There will always be some hack that will be standing just outside the circle of fire light waiting to "read" you and sell you anything (Everything) to help you sleep tight. Remember, as much as we as security professionals rely on these systems to "aid" us in our job, these systems are not what accomplishes the job. The Human Factor must always play a central role in the program.

The Flavor of the month toy, be it CCTV, Thermal Imaging, Full body Scanners, Bio Metrics, RF sensors/detectors and what have you, are ONLY to support security professionals in their task. These tools of the trade should never be thought of as the solution alone. As an example,Canine units posted around sensitive or critical installations may be very good at detection and deterrent but only a fool would be happy with dogs alone. What works in some environments or at certain times can not be counted on to work at all times and certainly not without human control and restraint. So why should business be different? Closed Circuit Video Systems cannot challenge or confirm nor can they "read" or recognize at a distance what is on the mind of those on camera.

The Human Factor rules supreme at this task. Yes using selected flavors of the month tools of the trade is important but with the absence of the security mind set they are so much plastic, wire, metal and glass, a mindless collection of junk. Eclectic staffing is paramount.

We are not so much in the people business as the "suspicious" people business. Whatever the job, we are the centennials that stand between our patron and unwanted outside (some times inside) influence. Due to an ever changing and educated criminal and or terrorist element, we are constantly dealing with variables. Nothing is static, all security work should be considered fluid and dynamic. Dealing with these variables takes time training and life experience. The security mind set tells us that some people automatically demand certain attention while others do not. Certain individuals may attract my attention while you feel they are of no consequence. This is merely life experience helping with selection. Why? who knows really. Perhaps some lesson learned as a child or in some other employment or with an ex-lover, ex-Boss, relative, or friend that screams a message no one but you can (will) read. Old school police call it "gut instinct" while others say they had a feeling. Whatever it is called, it is valid and steps should be taken to never suppress it. Courts and other judges of intent will tell us this is unfair, to act upon a feeling rather then cold hard evidence but I remind you we are a "proactive" group and as long as you act sensibly and in good faith you will be well served.

Squeezing the sponge. My tools are people, whenever I interview a prospect for employment I look at the whole person not just what is submitted in writing. The letter of reference and resume information are a starting point from which I will glean much more information. One must squeeze the sponge dry to get the most of a persons capabilities.

My prospective new hire may not have or know they have skills needed to ultimately be who I need them to be. It all starts with having the right background or up bringing. Little attention is paid to this item for a number of reasons the most obvious is that it is considered "judging" or "profiling" and is a no no in most overt ventures. However it is almost always done privately and in ones mind. Any employment consideration will be subject to the employers feelings as well if not more then what the resume claims. My hiring experiences have been varied, some times disappointing and regrettable, other times satisfying and rewarding as I watch a new security staff member really meld into the team. It is a matter of being able to tap the individuals inner core principles. If you can start with a non typical natural talent that is malleable and receptive you almost always have a winner. I have met few with well cultivated security mind sets but most can be lead to it by exposure and self discovery. If you surround yourself with an eclectic group of people that can draw upon a wealth of life experience and training you will strike gold both for you and your patron.

What are we looking for? Well to start with we don't want the flavor of the month. The saying goes that great minds think alike, I'll steal a thought passed on to me by my Brother in law that I like very much "great minds think for themselves". We need to start by categorizing prospective security staff as we would any other person we are scrutinizing. As we read them we watch how they are reading us. We send signals that start them down a path of misdirection and watch what they react to, then we subtly switch gears and watch how they react. It's an experiment, using the tools they supply such as resume information. As you ask questions based on this information I might take a side path asking purposely non related questions that are only slightly related to the information provided. This can be very illuminating. Most people have confidence in what is on their resume and are prepared to elaborate in much detail as long as we stick to the script. I once took a course through the New York State Troopers on interview and interrogation. My instructor Det, Salmon would ask students in the class to make three statements two being true and the third being false. As a demonstration of "reading" people he would pick the lie out of the list of three. It amazed and amused the class and was a truly impressive demonstration of reading people. I can only hope others in the class appreciated what Salmon was gifting us with. It was truly a look not only into other people but into Salmon himself. Who and what he was, an instrument, a tool, a small wonder. Through life experience and training he was a walking lie detector. His claim that many recipients of his teachings were hard to live with was probably true. Divorce, mistrust and intolerance to others due to having new insight made them look at life in a different light. The light of truth. We tell lies every day. White lies that smooth our path and help us get things done in the most streamlined and efficient way. You do it, I do it and that's okay. As long as we are not formulating and fabricating falsehoods that others count on. For example I may be pages deep in paper work that just must be done today when a knock on my office door distracts me. Standing outside is an employee with a non critical request that I read as something that can wait without causing inconvenience to the employee or myself. I might say I'm very busy now and they should try me back later in the day or phone for an appointment. This can send the message that their need is not important to me and I have better things to do. Trust and respect are important components to what we do so instead I might say they caught me just as I was about to join a conference call but please stop by and try me later. This sends an emergent signal that they can truly relate to and with this understanding are more then willing to stop by another time. A lie to be sure but one without expectation, no disappointment associated with it, not rejected just postponed. A camera cannot tell the difference between the truth and a lie, it collects information that must be collated and sifted through by a human being. The only thing that we can count on in the end is us. In a court room we are judged by twelve people, maybe with the aid of other evidence but people none the less.
General George Patton claimed the most dangerous battle field instrument was the M1 rifle in the hands of a well trained "solider" (one well aimed shot) not the tank or helicopter or even the atomic bomb. Humans thinking, adapting, evaluating, responding and reacting. This is the core of what we do and who we are as security professionals. Nothing, no trade show tool or flashy toy type flavor of the month can do that as well as the ultimate security machine......the human mind.

Posted by RJ MOSCA at 09:09

Imaginary barbed Wire

Imaginary Barbed Wire
Borders, Boundaries and Control Points.

The subtle hostile environment is an intricate part of the program. Security control comes in many forms, some not as overt as others. Knowing how to stack the deck can allow you to stay on top of key elements in the environment thus giving us less to constantly monitor.
Restaurants and other fast food enterprises have used these "subtle influences" for years both to attract and repel their patrons. Lets look at some of the techniques used in the game of Social Engineering and Behavior Modification.
Phase One: The sign outside the restaurant was clear and unmistakable. It proclaimed the business name followed by the "comfort" phrasing. Such as HOME COOKING or OLD STYLE, something that "sells" the idea of quality or trustworthiness. The building or store front is shaped like a home or has features of a private residence, curtains and earth tones to attract the slower paced, come in and relax crowd. Lighting is adequate, not dim but not bright either, almost at levels you would have in your own home. White noise is carefully controlled to blot out stray sounds or at least give the impression that although you are in a public place, you can relax and not be over heard by the party seated at the next table. It's not at all true but we chose to fake it for comforts sake. You can relax and be yourself.
Phase 2: You are escorted to an area best suited to the size of your group number and seated. The seats have been chosen not for comfort or styling but to sit the customer up right in the eating position. After all that's what you are here for. The table is laid out with the standard utensils and settings, maybe a center piece that makes an important impression of quality and has a spirit of "occasion". The size of the table seems more then adequately roomy and you stake a claim to your personal space. It is all that you expect from a eatery but if you are paying attention, the subtleties start to subconsciously creep into your thoughts. The table cloth is Red, a color used by restaurants for years and commonly expected, however is it a color you would use on your table at home? Most generally NO. The color Red is distracting and even disturbing to most people. You would not paint your walls Red at home it would have a very negative (aggravating) effect on you. Color is a powerful but often overlooked modification technique of the environment. Mental health institutions found many years ago that colors particularly Light Greens and Blues have a calming effect on the human mind. Pale colors such as Yellows and Pinks are used in some prison environments to both calm, sooth and emasculate violent prisoners. Colors are powerful juju. Although the place was comfy when you parked the car it has some rough edges. The decor is ether open and cafeteria style or close and mildly claustrophobic but only to the subconscious. In all outward ways it can be considered comfortable. Now that you are settled in and have your order placed, you look around and take in the surroundings. The carpet, probably dark to hide dirt and grim is most often of the rough institution type that is better at standing up to high traffic then being or looking soft and welcoming. The doors (except the kitchen doors)are in sharp contrast to the walls colors allowing your subconscious to notice their location without thinking about it. The main entrance/exit is an entirely different and important portal I will elaborate on later. The ceiling is almost always busy with pattern, decoration, accent or device (fans/light) that draws some attention. When did you last glance at the ceiling in your dinning room? You politely converse and wait until the Waiter arrives and is introduced with a smile followed by.........
Phase 3: The polite Waiter/Waitress smiles and takes out the order pad to take notes for further requests.....it is important to note at this point that the waitress may not even know the effect this action may have on the customer and may be as blissfully unaware that the sight of this "prop" is a subtle signal that represents many things. It is an instrument to serve and a punctuation to the finale of the service event. It represents both the beginning and end of the contract you are about to enter into. It is a commitment that sets the stage for both your expectations of the product you are about to receive and the tip that is expected when the contact is complete. You place your order and the work end of the cycle begins. Center pieces are removed from the table to make room for the meal, as they leave the table, so does a bit of the ambiance that gave you the feeling of comfort you had at first glance. Food is delivered in what is hopefully a reasonable amount of time, Too slow gives the impression of incompetence or indifference - too fast speaks to the quality of the product, and goes against the illusion set forth by the sign out front. At a period approximately two thirds into your meal the Waiter/Waitress comes over to ask how everything is and if you might need something.....it is important to note at this point that the waitress will almost always NOT have the "prop" order pad out and the visit to your table seems more hurried and transient, less purposeful.
Phase 4: You have eaten and the table is now full of plates and napkins and glasses, space once adequate now seems sparse, you feel crowded. You have had just about enough of the Red linens and table cloth and your body it seems is just not as comfortable in this chair as it was when you staked your claim at the table. The Waitress now approaches with the "prop" and in tones very different from the first she asks if you need anything else. The "prop" and the situation being such, sending the message that she has held up her side of the contract and it's now your turn. The smile is practiced and "tip" dependant. After the monetary exchange you rise to leave. An interesting thing happens at this point, or doesn't. The bus boy will begin to clear your table quickly to set up again for the next customer. This sends a message to you that you might be in the way and should hurry along or the table is ignored and left in it's crowded state of disarray again a situation you can't wait to walk away from.
Phase 5: The finale. As you walk to the exit you may take notice of the strategically placed pleasantries, plants, paintings maybe a sign that thanks you and asks for you to come again. A free mint or tooth pick may be offered as a parting gift and if staffing allows, a "nice to see you, come on back now" from a friendly employee all designed to give a favorable last impression.What does this have to do with security you ask? What doesn't it? Being able to predict and control the environment in the friendliest if not undetectable of ways is of the utmost importance to business. Malls, Department Stores, Stadiums, Schools, Airports, Hospitals even Churches (don't get me started) use these behavioral engineering techniques to influence or limit actions by the herd. If you look for them they are evident all around us. As a security professional you may wish to use some of these tools / techniques to welcome a select group of people while making others feel uncomfortable.
I recall one such example of the technique,while running the security program for a large enclose mall, I made the following changes. The mall was over run by what we lovingly referred to as "Mall Rats" kids that spent little money but just needed a place to congregate and get out of the weather. They were a loud collection of Vandals that scared the more mature "paying" customers. We tried many different ways to move them along without much success. Finally we took the benches away from the door ways and change the canned music from contemporary top forty to easy listening. The environment was slightly less friendly to them. In short time the area lost it's appeal and they moved along of their own volition. We controlled the environment, in all ways possible without being too overt. A natural attractant/repellent that is a valuable security tool.
God Bless Barry Manilow.....................He writes the songs you know.

RJ Mosca

Posted by RJ MOSCA at 09:27