Showing posts with label enterprise risk assessment. Show all posts
Showing posts with label enterprise risk assessment. Show all posts

To Arm Or Not to Arm - That is the Question!


            It has been 400 some years since Shakespeare’s Hamlet first posed the question, “To be or not to be.” Today, a modern twist seems to be a recurring question; to arm or not to arm.


Edwin Booth as Hamlet
By J. Gurney & Son, N.Y. (19th century) Public domain, via Wikimedia Commons
            Since the shooting at LAX that left one TSA agent dead, the question of arming TSA officers has come up. I’ve seen arguments both for and against arming TSA. It is not unlike the arguments about having armed security in schools or even arming teachers.

            It is not a simple question to answer. First and foremost is to avoid making decisions in a knee-jerk reaction. It is amazing how often within the security realm that an event happens and suddenly there is a rush to make changes. It may be within an organization that experiences a crime, such as an attack on a staff member, resulting in new measures that may or may not always make sense. In other cases, such as this with the LAX shooting, the response and attention is in the public eye, not just an internal matter.

            When there is a major incident or security breach, it is common sense, even wise to review what happened, and make changes when necessary. However, the changes should be well-thought out and address the situation at hand. Following a shooting, there is almost an element of surprise that it happened in that location or type of organization. However, we’ve seen shootings occur almost anyway, from churches, hospitals, museums, small businesses, universities, rural and urban schools and even an Amish school. The bottom line is that a shooting can happen in any location, in any state, in the city or in the country. So a better reaction would be to avoid the next shooting or protect the next target instead of thinking about stopping the last event. Often military leaders are accused of training and preparing to fight the last war, instead of looking to what will be needed to fight and win the next war.

            It is easy to focus on the past instead of looking to the next steps and it is natural, in this case to wonder about arming TSA officers. I have seen some opinion pieces by airline employees argue against arming TSA. The bottom line seemed to be a lack of trust or maybe even an underlying fear of firearms in general. It strikes me as odd, that a group who are entrusted with protecting our airlines from terrorists would be untrustworthy to carry firearms. On the other hand, this was a single incident and does not automatically mean that TSA officers are a target. In fact, I would argue that airports are far safer than many other public venues. Airports have more security and a large contingent of armed police officers to respond to any types of violent acts. I have also seen TSA officers, in uniform, on their way to work, sometimes using public transportation. If TSA is such a high risk target then those employees should be instructed not to wear the uniform on the way to or from work and change at the airport. In fact, that would create a risk that someone could follow an employee home; steal their uniform and perhaps identification to pose as a TSA officer to gain access to secure parts of the airport.

            Self-defense techniques and training unarmed individuals on how to respond to an active shooter have been growing more popular as well. I certainly believe in the benefits of learning self-defense and think that unarmed individuals should not just give up and become victims during a shooting. However, there is an old saying about bringing a knife to a gunfight being a sure way to lose. Bringing nothing to a gunfight is even more risky. Many of the techniques appear to be good ideas and could help save lives. However, most of these attacks are carefully planned and the shooter will certainly see the same news stories and watch the same online videos and adapt their tactics to counteract any resistance.

            So the question really comes back to what is the best way to protect individuals from armed attacks. Lots of money and training has gone into teaching unarmed response. Perhaps we need to reconsider the response yet again.

            Most active shooters have ended when the shooter is confronted by armed response. The real solution may be to train on-site security personnel how to respond the way law enforcement does to an active shooter. This is certainly one solution not getting much attention and is especially suited for organizations that do have a dedicated security force. Hospitals are one example. Shopping malls are another, as are many office buildings in urban downtowns. For enterprises or locations that do have onsite security, the focus should shift to training those personnel how to respond to and stop an active shooter.

            Following the shooting at Columbine High School, law enforcement began developing new tactics to respond to active shooters. At the time, I was a police firearms instructor so was very involved in that training. For the first few years afterwards, the tactics changed repeatedly. As police officers, we finally settled into accepted tactics that we focused on learning and practicing. However, as important as this training was, the amount of time spent for patrol officers was one time a year, often not even a full day. In fact, officers might only run through a couple of active shooter scenarios during the training.

            The point is that private security could easily train and learn some of the same tactics in a relatively short amount of training time. In fact, private security officers would know the building and organization much better than outsiders would and, being onsite, could respond much quicker than law enforcement. Just the presence of armed security would likely deter a shooter, at least away from that target.

            The decision about arming or not arming security is certainly daunting. However, for those organizations that do have security, serious thought should be given to providing private security with the training and tools that would be the strongest deterrence and most protection from an active shooter attack.

 

Eric Smith, CPP is the leading authority on organizational self-defense. He has extensive experience in law enforcement as well as security management. Eric is available for staff education and security awareness training as well as business coaching to help organizations provide safe workplaces. To learn more email Eric at businesskarate dot com.

 

 

If you would like to reprint this post, please contact Eric at Eric at businesskarate dot com.



Avoid Becoming a Victim with 3 Simple Tests


What do crooks look for? Why do burglars pick one house over another? What does a terrorist look for in a target? What do ordinary criminals and terrorists have in common for that matter?


Crooks and terrorists may not be so different after all. No matter how evil their intent, he (or she) must still select a target in order to carry out their plan. Robbery suspects first look for the loot before planning their heists. Burglars look for evidence that no one is home and terrorists want a big bang (literally) for their buck – high publicity.


One well-known bank robber is credited with the statement that he robbed banks because “that is where the money is.” A robber wants to gain something – that is the whole point of the crime. They want to make sure that the quick win is on hand. Many are feeding drug habits, gambling addiction or alcohol. With these kinds of cravings or obsessions, there is no time to waste. They are looking for something of value that can be turned around quickly for cash or traded for drugs.


1.      Value – The goal is some kind of gain or value. For a terrorist, the value may be high publicity, such as a famous building or critical infrastructure or large number of potential victims. For crooks, it may just be something worth stealing.

Favorite targets of robbers are convenience stores and taxi drivers. It is not too hard to figure out why – both are easy to find and convenient to the crook. In fact, two recent suspects in Denver have called the taxis to their location in order to rob the driver. It doesn’t get much more convenient than that – the victim comes to the crook. These are examples of highly visible targets. Terrorists like visibility too, but in a slightly different way. They want a target that will generate a lot of publicity and garner their group the visibility and attention. Blowing up a bomb in the middle of the desert will not get that attention, as compared to blowing up a crowded nightclub or embassy.


2.     Visible – The target must be visible; crooks have to know it is there and an attack must generate the kind of visibility a terrorist wants. Schools, landmarks or crowded venues will offer that kind of media attention and visibility.

Of course, the crook must be able to achieve their nefarious goal or at least have a hope of it. The famous gold depository at Fort Knox would be an example of something that is highly visible, of high value, but with little chance of success. A terrorist might love to steal a missile from the military, but the chances of getting to it are nil. There is virtually no vulnerability.


3.     Vulnerable – The victim must be susceptible to attack to be a worthwhile target. That is why burglars look for homes with unlocked doors or muggers wait for victims in areas of poor lighting. There is easy access and the element of surprise to help the attacker. Terrorists also need targets that are open to attack. On 9-11, it was relatively easy for terrorists to hijack planes and fly them into the WTC. Today, many of the vulnerabilities that the terrorists exploited have been eliminated.


As an individual or responsible for protecting your business, keep the 3 V’s in mind – Value, Visible and Vulnerable. Evaluate the value that criminals may see in your business. Maintain low visibility when possible to minimize the chance of becoming a target. Last, use appropriate steps to reduce your risk or vulnerability to avoid being a victim.


Eric Smith, CPP is the leading authority on organizational self-defense.  He has extensive experience in law enforcement as well as security management.  Eric is available for staff education and security awareness training as well as business coaching to help organizations provide safe workplaces.  To learn more email eric@businesskarate.com.

 

 

If you would like to reprint this post, please contact Eric at eric@businesskarate.com. 

The Hidden Risk Menacing Businesses


Often, we know the risks facing us. That piece of cake tempting you is full of calories, posing a risk to your weight. Those French fries put your cholesterol at risk. Even at work, we do, or should, recognize various risks – lights out in the parking garage, for example, put employees at risk when they leave after dark.


However, there are those hidden threats that may not ever cross our minds and yet, are no less dangerous or damaging.


The World Economic Forum has released their annual report on global risks. The report looks at various challenges facing society around the world. Some examples have been concerns about water shortages, famine, price collapse, weather, political instability and severe storms. The last two years, the report highlights the threat of economic disparity, leading to social unrest, or dystopia (as in the opposite of utopia).


It is not hard to imagine. There have been riots in countries like Greece, based on economic fears. Adding to the fuel are the constant media reports mentioning the “one-percent” or the wealthiest 1% of the world’s population.
Greek riots - news photo


Throughout history, revolutions have often been based on exactly that kind of wealth imbalance. The French Revolution of the 18th Century is a classic example. There has been a breaking point, in which people oppressed have enough and step up to throw off the yoke and change their governments. Even the American Revolution was sparked by higher taxes to pay for benefits of a government far away.


What does this mean for businesses? If employees feel like they are being left behind, financially, with no raises or decreasing benefits, then there is the real risk of employee dissatisfaction and resentment. Especially if the company is growing or profitable and is not rewarding employees. Various news articles have shown that recent corporate profits, as a percentage of GDP have grown, while wages have stagnated.


This translates into poor morale and decrease in productivity and even elevates the risk of internal theft by some. There is a maxim amongst loss prevention professionals that 10% of people will never steal, 10% will always try to steal and 80% can be swayed either way. Employees who are frustrated with their company are more likely to use that as another way to justify dishonest behavior. That increases the risk that at least some of those employees in the 80% group will embezzle, cheat, steal or just chase away customers.
Aftermath of Greek riots - news photo


Depending on your business, there are lots of ways employees can sabotage you, whether intentionally or not. Poor customer service and poor quality control are some examples. Productivity may drop if employees no longer strive as hard. Employees may even be more prone to ‘sweetheart’ deals and give away product, even to strangers if they are not happy at work, such as giving away coffee at convenience stores.


Business leaders need to pay attention to the potential unrest and make rewarding employees a top priority when the company is successful. If not, you could send a message as Marie Antoinette did when she famously declared, “Let them eat cake” when told her citizens had no food to eat. And we know how that ended – at the guillotine!

 

Eric Smith, CPP is the leading authority on organizational self-defense.  He has extensive experience in law enforcement as well as security management.  Eric is available for staff education and security awareness training as well as business coaching to help organizations provide safe workplaces.  To learn more email eric@businesskarate.com.

 

 

If you would like to reprint this post, please contact Eric at eric@businesskarate.com. 

When Risk Becomes Real

Within the security world, too often crime is nothing more than a statistic, a number.  But behind each number or report there is a victim facing very real losses with very real consequences.
I was reminded recently of what that means, unfortunately, and not for the first time.  It started at 6:30 am on a Saturday morning.  The doorbell rang and my dog starting barking.  I stumbled half-awake to the door and saw a couple of my neighbors from down the street.  They asked if I owned a black Saturn and said that someone had hit it.
Friend or Foe?-
Learn how to deal with visitor access with this special report (click here).


When I went outside, there was a Chevy Blazer parked where my car had been.  The driver was sitting behind the wheel crying.  I asked where my car was and my wife pointed down the street – into the next block.  There was my car sitting in a neighbor’s front lawn.

While waiting for the police to respond, I started to talk to the other driver.  He was really upset because he was driving his mom’s car – only because he had totaled his car when he hit another parked car the morning before a couple of blocks away.  He said that he had started a new job and was tired.  I assumed he was working nights and was surprised to find out that he worked days, which prompted the question of why he was going home at 6:30 am. 
The police arrived and immediately recognized him from the previous accident.  While they began their investigation, I called my insurance company.  Soon there were several more police officers on scene and I saw them going through roadsides with the driver and ultimately arrested him.  He had signs of using meth and admitted to it as well. 
My car would not start and looked like it was going to be totaled.  I tried to get suggestions from the insurance company on what to do with my car.  To make matters worse, we were getting ready to head out of town for almost three weeks.  What a stressful way to start out on vacation.
Accidents like this are an everyday occurrence.  No one was injured and was only a property damage accident.  Even so, it is a real loss and a real headache.  It meant trying to deal with two insurance companies and impound lots while out of town with limited email and cell phone access.  It also meant dealing with replacing my car.  I did not expect a car payment for another couple of years and it was not in the plan or budget.
There is a lesson to all security professionals dealing with crime risks – each statistic has a victim, a person behind the number.  Don’t overlook the human factor when planning and assessing risk and the impact on others.  Even on issues that are seemingly trivial or routine – because they are not to those affected directly.
PS – there is a silver lining.  I now have a new car parked in our driveway (not in the street!), one with better gas mileage and a bit more exciting than a 12-year old Saturn (RIP).

Eric Smith, CPP is the leading authority on organizational self-defense.  He has extensive experience in law enforcement as well as security management.  Eric is available for staff education and security awareness training as well as business coaching to help organizations provide safe workplaces.  To learn more visit http://www.businesskarate.com. 



If you would like to reprint this post, please contact Eric at eric@businesskarate.com. 

What risks do you face?

Risk can take many forms.  I had a reminder the other day while doing some mild off-roading in the Rocky Mountains.  We were driving on an unplowed road at dusk with strong gusts of blowing snow and temperatures below 0, reaching -11 degrees without the wind chill factor.  Well, of course, the truck got stuck at one point in a snow bank on the side of a very narrow path.  It took about 40 minutes to get out.  I knew that was a potential risk taking a road like that in those conditions, but on the plus side, I had also tried to prepare for it by having some basic equipment with me to help get out.  And truth be told, it added some fun, or at least suspense to the day and made it more of an adventure than a Sunday drive. 
We like our security and safety, but sometimes risk can even be appealing as in the risks associated with extreme sports.  In those cases, it is the risk or danger that makes something interesting.  After all, most people don’t go sky-diving for the view.  But typically, businesses don’t like risk or the unknown.  Too much risk makes it very difficult to create plans, budgets or decisions about operations. 
So how does risk affect businesses?  Every piece of your core business model has some exposure to risk or dangers.  Some may be security-related such as the cost of crime or loss due to theft.  Other risks could be completely unrelated to security, but could be just or more threatening.
Look at all the parts of a business and your core business model.  You probably have all or most of the following to some degree or another.
1.      Human Resources
2.     Accounting
3.     Management
4.     Proprietary Information
5.     Supply Chain
6.     Vendors
7.      Customers/visitors
8.     Facilities/physical locations
9.     Manufacturing
Any one of these areas has different risks or threats associated with it.  HR may be concerned with the risk of employee turnover, or complaints of harassment or biased treatment.  Accounting may be concerned about the number of days of cash on hand or perhaps the worry about the costs of fraud or increased unemployment taxes.  Management poses a different set of risks and could be the risk themselves.  For example, the wrong strategic response to competition or poor decision-making could severely damage the company.  Proprietary information is obviously a huge potential source of advantage over the competition and loss of key info could give competitors an edge, or create a new source of competition from copy cat products.  Proprietary info may include contracts with pricing or bid information.  And, of course, as technology keeps developing and memory storage gets more advanced, it makes it that much harder to protect key information – just look at the recent Wikileaks scandal and how that information was obtained.
Supply chains and vendors are critical for many businesses, especially if that is the vital source of services or items used to give customers the product.  If a provider in the supply chain becomes unavailable, such as a supplier going bankrupt, or a dock strike overseas, your manufacturing supplies could dry up.  Do you have a back up source so you don’t suffer delays?
Customers and visitors could pose a risk themselves or be part of your overall risk assessment.  In retail, some percentage of customers will actually be shoplifters, taking a cut of your profit.  A bigger concern for any organization is that the customers will go elsewhere for one reason or another.  Are they unable to spend on your product or service due to their own difficult financial situation?  Are there other options in the market place that they might find a better value than yours? 
Traditional risk management focuses on avoiding risk (not building in a flood zone), transferring risk (buy insurance) or accepting risk (“let’s hope that doesn’t happen").  To really understand risk, an analysis should look at each part of the core business model and also the related risk.  Every situation and every organization will be different.  A full enterprise risk analysis should look at the potential problems from a financial perspective, operational view, market risk viewpoint and also security concerns.
Remember to think about what keeps you up at night and more importantly, what should keep you up at night.  Then you can take the right steps to deal with the risks that most threaten your organization.