Client organisations will regularly test their evacuation procedures, fire scenarios and general emergency drills, so why is it that the efficiency of the on-site security provision - be it in-house or contract - at preventing breaches is rarely subject to the same arrangements? Terry O'Neil explains why regular penetration testing is vital, and outlines a new solution for both clients and contractors.
Picture the scene... The clock is ticking towards 3.00 am on Sunday 18 December 2005 in London's West End, and hordes of revellers are beginning to vacate some of the Capital's more fashionable nightspots. The security officer tasked with Reception duties at one of the prestigious blue chip buildings just off Piccadilly ventures outside to stretch his legs and benefit from some fresh air. It has been a long night, and he's beginning to feel sleepy.
A couple of girls passing by on their way home engage him in conversation and, naturally, the officer is flattered by their attentions. Momentarily, he forgets his responsibilities to both employer and client, and the front door he has left ajar. The officer doesn't notice The Silver Fox Auditor slip into the building on the ‘blind side' because he's facing the other way. Anyway, that is the last thing on his mind at this moment in time!
Of course, the officer concerned has now compromised on-site security, let down his shift and the assignment team.
Imagine another scenario... It's 11.00 pm on Friday 23 December. A Silver Fox Auditor has been watching vehicles come and go through the main vehicular entrance of a major public building in Manchester for the past hour. He has seen the ‘dual officer' post reduced to single manning at 10.30 pm. The Auditor is waiting for a chance to ‘infiltrate' when a high-sided vehicle draws up and the lone officer on duty is forced to stop and make a note of the vehicle's registration details before discussing with the driver the nature of his visit.
That is the moment The Silver Fox Auditor will seize in order to ‘strike'. Using the cover of darkness and the blind side of the vehicle as protection, he will slip into the building unnoticed. Security will be totally compromised, which isn't good news at all...
Finally, we are back in London. It is Holiday Tuesday 27 December. The time is 10.00 am. The demolition team at the building site are up against the clock. They have a larger squad than normal on duty despite the fact that it is Christmas. The security officer stationed at the site's entrance looks somewhat disinterested. Why shouldn't he? After all, he's seen it all before over the past six months.
Dressed casually, but also wearing a regulation white hard hat and high visibility jacket, The Silver Fox Auditor has kept the site under surveillance for the past 30 minutes. This should be an easy assignment compared with some of the other audits carried out already that day and, besides, he has manufactured a very impressive false site pass for himself - albeit with the face of a famous actress on the front rather than his own!
As The Silver Fox Auditor approaches, sure enough the security officer asks to see his pass. At this juncture The Silver Fox Auditor reveals his true identity, congratulates the officer on his professionalism and presents him with The Silver Fox Tie-Pin before seeking out the site supervisor and completing the remainder of the audit. On this occasion, the security officer has passed with flying colours.
Auditing over three stages
The Security Watchdog's Silver Fox Audit Team carried out almost 100 audits over the 2005 Christmas period. The examples cited here demonstrate the fine line between success and failure. Drop your guard - no pun intended! - and The Silver Fox Auditor will expose any on-site negligence in relation to security.
What comprises a Silver Fox Audit, then, and who benefits from them? The Silver Fox Audit is divided into three stages. Stage 1: Attempted Entry is the vital part of the audit, determining whether or not the duty shift gains a Pass or Fail. In essence - and at a given moment in time - the audit tests the alertness of a duty officer in protecting your premises. It could be the officer on duty at reception, at the main gates or in the loading bay. As the examples have shown, the attempt at unauthorised entry could take place at any time of the day or night, during an ordinary working day, at the weekend or on a Bank Holiday. The Audit Team operates 365 days per year.
A given Silver Fox Auditor is also eager to assess the duty officer's attitude, degree of training for the task(s) at hand and, more specifically, their duties at the point of attempted entry.
Stage 2: The Team Check embraces the whole duty shift in that The Silver Fox Auditor examines the ID cards of each member of the shift - which will, come 20 March, be replaced by Security Industry Authority (SIA) licences - and comments generally on the presentation of the team at the time of the audit. The impression that team would give to an outsider is, of course, all-important.
Stage 3: The Operational Check then involves the selection of two items from an operational menu consisting of the following: management visits (in the past calendar month), the state of the Key Register, the Daily Occurrence Book (often referred to as The Red Book), incident reports (follow-up actions taken in the past two months), on-site training during the last three months, the effectiveness of the CCTV operation and the efficiency of the Check-Call system in operation. It's worth noting here that Stages 2 and 3 are for the benefit of the senior management of the contractor and/or the client, and will not play a part in determining a Pass or Fail outcome. This is decided solely on the performance level achieved at Stage 1.
In exceptional cases there may be a Special Commendation wherever an individual has performed well above average at Stage 1.
The great strength of Silver Fox Audits is that they are totally independent - in other words, the results can never be massaged - and they are conducted without warning at any time of the day or night. Quite simply, as client or contractor you will be told what is the actual state of service being provided at that particular moment. The result might not be either what you expected or hoped!
High state of alertness at all times
Security guarding can be something of a mind-boggling task. Everyone expects the security officer to be smart, efficient and alert throughout their 12-hour shift. A standard day for any officer could involve a number of one or two-hour shifts at the entrance to the car park or in reception, or patrolling the site (the latter of which can be very uncomfortable if it's the middle of winter and there are sub-zero temperatures). This pattern can be repeated day after day after day. Little wonder that, on occasion, the attention span of a typical duty officer is inclined to wander a little.
In our view, the only way to ensure a consistently high level of alertness is to institute an effective award system recognising every level in the process. For its part, The Silver Fox Award is designed to instil an attitude whereby the duty security officer never wants to let down the duty shift. In turn, the shift does not want to let down the assignment team. Finally, that team doesn't wish to embarrass either the client or the incumbent contractor. As a result, and as discussed previously, we award the security officer who successfully thwarts The Silver Fox Auditor with a Silver Fox Tie-Pin and, if appropriate under the circumstances, we'll then ask the duty supervisor to make the presentation on the spot at the shift debriefing session.
In today’s commercial and political climate, it’s imperative that clients are regularly and independently testing their security solutions at all times of the day and night, and without warning
Arwyn Hughes, director of security (UK operations), Glaxosmithkline
If the on-site assignment is successful at thwarting our Silver Fox Auditors on a minimum of nine occasions out of the 12 attempts that we try to gain entry, the team members are presented with a Silver Fox Certificate. Finally, any client or contractor committing to a substantial programme of Silver Fox Audits during a given calendar year is rewarded in a similar fashion.
What do the clients think?
"In today's commercial and political climate, it's imperative that clients are regularly and independently testing their security solutions at all times of the day and night, and without warning," states Arwyn Hughes, the director of security for UK operations at GlaxoSmithKline. "The Silver Fox Award provides quality auditing to satisfy this need. Of particular importance is the way in which it recognises security success stories at every level by rewarding those who consistently thwart the Silver Fox Audit Team. It should be an excellent catalyst for helping to build team spirit on any assignment."
It's necessary to afford all participants in the scheme comfort in respect of the quality and commitment of all members of The Silver Fox Audit Team. Commenting on their commitment, it is probably sufficient to say that, as a team, they don't encounter too many independent inspectors - particularly at night and during weekends - when going about their business. That fact tells its own story.
What, then, is the ‘standard profile' of a Silver Fox Auditor? As we've already seen, he or she must be prepared to carry out audits at short notice, and at any time of the day or night. It is almost certain that our chosen Silver Fox Auditor will have retired from full-time employment, and be very experienced in the security guarding sector - having served as a client or as a senior manager in a contract guarding company. A comprehensive understanding of the industry as a whole is vital as The Silver Fox Auditor will need to know what a given security officer - or an assignment team - is capable of achieving on site during any 12-hour shift.
All Silver Fox Auditors deployed to site by The Security Watchdog are trained in specific techniques such that they can spot opportunities when they might gain unauthorised entry to premises by using deception and distraction methods, tailgating employees, passing through doors and/or gates which should have been closed or locked and, of course, offering identification papers to gain entry that are clearly falsified. This list is by no means exhaustive. However, The Silver Fox Audit Team will not use ‘gung-ho' tactics like scaling walls or climbing ladders.
All Silver Fox Auditors will have been screened to industry standards, while many of them will be former senior police officers or from a military background, and will have ‘grown up' in a security environment.
The Silver Fox Audit Team members are in no doubt that if the security officer(s) on duty at the point of entry are doing their job properly then they'll have no trouble in spotting - and preventing - any attempts at unauthorised entry. That said, when talking about The Silver Fox Audit Team members it's important to stress that these are experienced security professionals who will carry out a full reconnaissance of the assignment prior to deciding which is the weakest point (for entry). They will most likely try to realise a breach of security at that same point.
If The Silver Fox Auditor is successful in gaining entry, they'll revisit that point and ask to see the site supervisor to conduct the debrief. Stages 2 and 3 then follow.
Silver Fox Audits in context
Can you be sure that your security regime is able to meet the risks your company faces? Surely you need to test that regime on a regular basis in order to be able to sleep well at night?
Historically, organisations have either provided their own security guarding or bought-in the service, but in both cases its efficiency is rarely put to the test. It seems illogical that we regularly test our fire prevention systems, our First Aid cover and our emergency systems, and yet we choose to ignore the security guarding cover.
At The Security Watchdog, we firmly believe that The Silver Fox Award Scheme offers a solution for all parties. We recognise that, as is the case with all such services, price is so often the deciding factor. With this in mind, we have pitched the scheme at such a level that price cannot be offered as an excuse for not taking part. Whether the site audits take place in London, Edinburgh, Lands End or John O'Groats, the cost remains static (see box panel ‘The Silver Fox Award Scheme: eligibility, criteria, cost'), including up to 12 Silver Fox Tie-Pins and a framed Certificate if the guarding team meets the requisite number of successes.
The contract security guarding industry is undergoing a huge sea change in 2006. It's highly likely that the only ‘kite mark' required as an absolute necessity is that companies must be part of the Approved Contractor Scheme (ACS) being run by the SIA. The problem for the industry is: ‘Where will the differentiators be?' There must be a real risk that, with the ACS in place, price will remain the only significant differentiator. If that is the case, the industry will suffer as never before.
The Silver Fox Audit Programme is a genuine differentiator in a licensed security world. Clients and contractors ignore it at their peril.
• Terry O'Neil is managing director of The Security Watchdog (www.securitywatchdog.org.uk)
• In support of the 2006 Security Excellence Awards organised by SMT, Security Installer and Platform, The Silver Fox Audit Team has agreed to carry out an independent audit on all of those companies shortlisted in the Best Guarding Company category
Source
SMT
No comments yet