Tuesday, November 22, 2005

Security Technology - tools and trends

Religious Product News technology issue is out and with it a short article I put together..

I know the entire basis of my security philosophy is the "Security is what you do and not what you have," and it is. However, that is not to say that technology is some sort of evil that should be shunned. What can it do for you?

Technology cannot create exceptional security. It can make exceptional security easier, apparently seamless, and less noticeable. After all, we all want better security but we don't want to tilt the "Security v. Convenience" scale too far, right?

No one wants to be inconvenienced; least of all me. I'm a bear at the airport. Why? Because that security is an illusion. I've been inconvenienced at many facilities and, as annoying as it might have been, it was effective. I remember one jewelry manufacturer out West. No one told me it was a no-metal facility so I had to conduct my survey without a belt or any other bits of personal possessions. Losing the belt was particularly difficult since I had just lost a little weight and the pants were a from before that time. Effective security makes some things bearable, but illusionary stuff is just annoying.

So once you start with a well designed security program that's built around processes and engineering the environment the technology becomes a creature comfort. It makes the other stuff easier. Now you no longer need a guard at a door to identify you (or maybe you still do). Now you no longer need to patrol your property with a quality alarm and response system (and maybe you still do).

All this article is meant to do is provide a snapshot into where technology is right now and how some of that can be of help to you and your congregation. Creating a Safe Sanctuary should make "God's House" more secure and not turn it into "God's Fortress."

'tis the season... For evil holiday ELF's

This Washington Post article reminds of the radical environmentalists. Now that may not be a bad thing if you're a supporter of the movement, but the those who thought their house would be completed soon it's definitely a disappointment.

So there may be an active Earth Liberation Front (ELF) cell in the western Maryland area or maybe one that has migrated here. We'll just have to wait and see how the investigation progresses...

If you want a better idea why this sort of thing happens read this document, or at least the philosophy section at the beginning.


The Earth Liberation Front is the newest re-radicalization of the environmental movement. There's a nice little history piece here, and another piece here. I tend to lead folks back to my own paper on the topic because it's just not healthy to try and understand today's environmental movement separately from the animal liberation movement.

Back to this issue, though. The largest issue in dealing with the ELF, or Earth First! for that matter, is the anti-organization design of leaderless resistance. For those that don't know about it it works like this. Someone, or someones, write a set of guidelines, manifesto, rules, mission statement, or similar ideological document that spells out what is acceptable conduct. Sounds like any other organization right? Now it gets sticky. Then these someones say that anyone that does stuff (legal or otherwise) that forward the goals, while abiding their conditions on conduct, can claim to be members. That's it. No leader - just an ideology. Now there's quite a bit of discussion as to where this all started and some put the beginning with the white supremacists after the American Civil War. I don't know when it started but I know it is extremely popular now. Wanna know why? Consider this. The easier it is to track people and activities to establish criminal wrongdoing then the more likely a leader will be arrested, killed, or otherwise destroyed from a credibility standpoint. Once you take away the leader you eliminate two things. One, the "Cult of Personality" that tends to exist around this sort of movement. Once that personality is removed the movement crumbles - so no leader = no target - but an idea can live on and on and on. Especially, it seems, the bad ones. The second thing that is removed is a clear definition and understanding of the adversary. How big is it? Who is in it? Etcetera, etcetera... Poof! We now have the makings of an underground guerilla army, or at least a core cadre of high-energy folks that are able to present the image of a larger force.

You see this organizational model works well against a democracy (or a republic in our case) that prizes its freedom of speech, but despises criminal acts of property destruction. It works well because it allows the "aboveground activist" to talk the talk and make veiled threats while not committing any clear criminal act. The "underground activist" then carries out acts of destruction to follow-up on those threats. What makes this pretty neat is the real lack of direct communication between to the two elements. The abovegrounders tell us how morally reprehensible we are and the undergrounders attack us. Sound familiar? Anyone British here? Sounds far too much like the old Sein Fein - IRA (Irish Republican Army) model. Maybe it's time we called it what it is, the way it is.

Maybe we are all too afraid of sounding callous and insensitive. Are we? If so, we as a society will ultimately lose. We must be prepared to say that regardless of how much we might like to see the environment left the hell along, it is wrong to commit acts of property destruction. Period. End of story. If we were all so environmentally concerned then we would donate tons of money to groups to buy the land that we won't protected. Maybe PeTA would have been better off not spending nearly $50,000 dollars on the criminal defense of Rod Coronado (Earth First! and ALF operator) rather than on showing people better ways to care for animals. There I said it. I'm a security guy by trade and by belief. If you don't think homes should be built somewhere then get out there and generate support and take legal action. If an eighteen year-old can be elected Mayor by write-in vote then many well intentioned activists can stop a construction project.

I'll step off the soapbox now. It's important to understand how these groups work as well as what they really want from you. Americans like the rebel, but this is the wrong rebel to cheer.

Monday, November 14, 2005

Bad (domestic) Intelligence

Let me begin by saying that from this article we just can't know the whole story, but it certainly sounds bad for the FBI. For those of you that haven't been around this blog before I've posted on both (here, here, and here) and operations (here). I have also presented a background piece on Eco-terrorism in the U.S. that discusses the philosophy of the environmental and animal liberation movements and traces their development and tactics over the years. If you're more interested in Intelligence then I have a paper for you as well that discusses intelligence operations in the private sector.

Since these topics are near and dear to me let's discuss this a little. The FBI arrested the wrong person, released him, and will be paying for their mistake. There must be more to the argument, because it's generally rare that damages are paid when the wrong person is arrested. Why it sounds as though they may not have had probable cause. So how then did they decide that this was the right person to apprehend? I generally do not criticize law enforcement if I wasn't right there (I dislike those that tend to second-guess my efforts without realizing they weren't there); however this doesn't seem to be a decision that had to be made in the heat of the moment - so why the mistake?

It looks like the error was with bad intelligence or at least a poor interpretation of the available intelligence. Concerns from civil liberties groups over the Patriot Act and domestic intelligence gathering have been on-going for many years. These concerns predate the Patriot Act with the COINTEL (Counter-Intelligence) activities of the FBI from years past. We in the U.S. do not take too kindly to being spied on by our own government; however it is necessary whether we like it or not. Another recent episode in this matter deals with the Denver PD intelligence files which were found to have a couple of serious flaws. First they were never purged - that's right files were maintained for indefinite periods of time, and second they information on activities that are protected under the first amendment - things like legal protests.

One may have thought that an important lesson was learned from the COINTEL days... Maintaining extensive dossiers is inefficient and often counter-productive. I know from a very limited experiment. These files are cumbersome, time-consuming, and just don't provide much predictive information. Sure you feel like you 'know' your target, but you really don't know them. Anyway, it appears that a decision may have been made based on a similar "belief of knowledge."

So the FBI screwed up. Is there a threat posed by the Eco and animal liberators? Absolutely. Read my paper on the movement. The important thing to remember is that each new generation builds their beliefs where the last generation left off. What this means is that the Sierra Club wanted to preserve park land, but today's Earth First! and Earth Liberation Front want to restore the world to how it looked before the industrial revolution. While I find it intriguing to consider a time when we lived in greater harmony with the environment, I recognize that without excess agricultural capacity and the ability to store and preserve this excess we would be living one year to the next - just like the real old days. Regardless of my own beliefs on environmental impact, I find the use of violence, or the threat of violence, to reach one's goals to be reprehensible, and worthy of our efforts to defeat it. Will mistakes be made? No doubt. Should remuneration be made? When it is appropriate. Why?

To answer that we need to consider the writings of Carlos Marighella's Mini-Manual of the Urban Guerilla." While avoiding a discussion on why his techniques ultimately fail, it is important to understand one very important concept. The insurgents act against the government only. The government, being unable to discern between guerilla and general population, cracks down on the general population. This in turn drives support to the insurgent movement. Rinse and repeat! Eventually the government's oppressive actions destroy their legitimacy with the population. So will mistakes be made? Yes. Should the government try to make those wrongfully caught up in the process whole again? Yes. We as a population must not forget that the target is, and must always be, those that use violence or the threat of violence to attempt to achieve their goals.

Thanks for persevering to the end.



Weak Assumptions + Overconfidence = Poor Security

Here's an article that I found recently that illustrates an interesting point.

Security is a process; not a product. Our security is determined by what we do and how we do it much more so than what we have.

September 11th is another example - and a very painful one at that - the airport screeners were not required to identify and remove small knives. We all know what this resulted in. We failed to manage the threat, and recognize that a hijacker, or hijackers, might seek alternate methods beyond a firearm or bomb.

We must manage our threats and not simply operate equipment if we are seeking real security.

Incidentally, if anyone is offended by the article topic, I apologize, it's merely an example to illustrate a point.


Tuesday, August 30, 2005

Harry Potter and the half-assed security

In the latest Harry Potter book, we see Hogwarts implementing security precautions in order to safeguard its students and faculty.

One step that was taken was that all the students were searched – wanded, in fact – to detect any harmful magic. In addition, all mail coming in or out was checked for harmful magic.

In spite of these precautions, two students are nearly killed by cursed items.

One of the items was a poisoned bottle of mead, which made it onto school grounds and into a professor's office.

It turned out that packages sent from various addresses in the nearby town were not checked. The addresses were trusted, and anything received from them was considered safe. When a key person was compromised (in this case, by a mind-control spell), the trusted address was no longer trustworthy, and a gaping hole in security was created.

Of course, since everyone knew everything was checked on its way into the school, no one felt the need to take any special precautions.

The moral of the story is, inadequate security can be worse than no security at all.





The last statement is important. We failed to build appropriate countermeasures for the threat on 9/11 and the results were disasterous. When we accept that our security today is adequate for the threat tomorrow then we create opportunities for our adversaries. We must continually question our own methods, countermeasure effectiveness, and what our threats actually are, if we wish to create real security.

Enough said for now...


Friday, November 11, 2005

Veteran's Day 2005

Please take a moment and consider the sacrafices over the years that have secured our blessings of liberty.

Here are a few interesting links in no particular order:

From the Department of Veteran's Affairs

From Wikipedia

Voice of America

Information from the Census Bureau

From the U.S. Army

From About.com

Veteran's Day 2005

Please take a moment and consider the sacrafices over the years that have secured our blessings of liberty.

Here are a few interesting links in no particular order:

From the Department of Veteran's Affairs

From Wikipedia

Voice of America

Information from the Census Bureau

From the U.S. Army

From About.com

Tuesday, November 8, 2005

Hurricanes, earthquakes, mudslides, flooding - Natural Disasters - and contingency planning

Mother Nature has a nasty, nasty temper as was clearly demonstrated by the last few months around the world. So what does all this mean for security? Business Continuity Planning? General preparedness? LOTS!!!


We, that is our industry (and probably most every business planner), learned a lot about how mass evacuations - or the lack thereof - affect BCP and Disaster Recovery (DR) plans. Your plan might have been great, right until it ran into everyone else's plan (and the odd hundred thousand without a plan).

Fundamentally speaking, it's no longer good enough to have a plan, rehearse the plan, improve the plan, and keep it current. Now you have to coordinate your plan with the plans of the local and state governments. Will you still try to shelter in place? Or, will you shift operations to another regional center and just pack up and go as early as possible. It's all about cost, right? Well consider the cost of if you tried to stay in New Orleans. It took quite some time before fuel and food arrived... How much do you plan to store? How will you deal with any looters and vandals that might remain behind?

It may just be better to contract the services of a remote hotsite provider such as Recovery Point Services. There are many others and there other options similar to this as well. In some instances, funds permitting, it may just be best to "get out of Dodge." Other times it may not be possible to do so - or to continue operations remotely. Then it may just be best to be sure your Business Interruption insurance is up to date and that you have coverage for natural disasters; not to mention how much coverage that actually is.

Plan carefully and make sure your plan blends with those around you.

Don't neglect to also develop a return to normal operations plan. How will you go about getting back to your old location, or when will you start looking for a new one? What has to moved first and when is the best time to do that? Etc. ad nausium.

Good luck.

Sunday, November 6, 2005

CRASH!!! - Auto accidents

Just a little deviation from the normal sorts of posts.

On Saturday night I, once again, witnesses a car accident. Not a bad one in terms of injuries, but an accident. My wife and I had just left a restaurant and were in the upper left section of a "T" intersection preparing to turn right - down the "T". The car in front of us turned right but the vertical section of the "T" had three lanes, two heading toward the intersection (up the T) and one heading away (down the T). The car in front of us turned into the middle lane, which is the left-hand turn lane, and hit a car coming toward the intersection head-on. I parked on the shoulder and got out to help. So here are a few thoughts on handling vehicle accidents...

First, it is important to follow your local laws and the direction of your insurance company's and/or attorney's direction and guidance. With that said remember that personal injury and health are the most important issue immediately after the accident. Make sure you are ok, and then worry about others. Keep yourself safe whenever you attempt to check-on or help others. It's the same way with professional rescuers - there's no point in getting yourself hurt and making yourself another casualty. So assess the situation quickly and determine if anyone is hurt and call for help. Try to get the contact information from not only the others involved parties but witnesses as well before they wander away - and no doubt they will.

Anyway, keep a few key things in your car like flares, a first aid kit, a disposable camera, pen/pencil and paper, insurance card, and any seasonal items that are appropriate - like a blanket in winter. As for the disposable camera, don't hold back; if you have 26 exposures then use 26 exposures. It's not like you want you vacation on that roll too.

If you're a witness - and you're civic-minded - make sure everyone is ok, get the tag numbers as quick as possible (and tag numbers of vehicles that have stopped briefly before leaving), call for help if no one else has, and then offer your assistance. Keep in mind that the involved parties probably have no idea what to do - take the lead. Offer to lay flares, get names and contact information, and take pictures.

Just a few thoughts on something off the beaten path.

Rob
/

Thursday, November 3, 2005

When surveillance may be necessary

http://www.thedailyitemoflynn.com/news/view.bg?articleid=10246

http://www.thejewishadvocate.com/this_weeks_issue/news/?content_id=447

It looks like someone, or someones, may have a problem with the Jewish congregation of Chabad Lubavitch. First vandalism and then a little arson – I’d say they have a problem.

Preventing these attacks may be difficult at best since the miscreant is willing to target materials outside the facility and to increase the destructiveness of the effort. You just can’t protect everything. No doubt the doors are now locked, being the access point for the first attack, but how can you protect vehicles and other items on the outside?

Regular patrols (police, contact security, or congregation members) through the property can be both a deterrent and a method of detection. It may also be worthwhile to get in tough with a local investigator with strong surveillance capabilities to arrange surveillance of the property. It won’t be cheap but if someone does come back, and how can you expect this person to stay away, there should be video. Not just video but video that can be used to ensure a conviction.

Just a thought…..

Rob
/

Sticky fingers, or something like that anyway.

http://www.nydailynews.com/front/story/359770p-306402c.html

Come on. This is pretty ridiculous.

A literally sticky-fingered bandit who used a stick and double-sided tape to fish cash out of an upper East Side church collection box was busted by a cop posing as a parishioner, authorities said yesterday.
Police believe Gilbert Alicea, 41, was ripping off the St. Vincent Ferrer Church for months before a 19th Precinct plainclothes cop nabbed him on Oct. 19, sources said.
Since the summer, Alicea spent hours at the Lexington Ave. church, kneeling in prayer and schmoozing with priests, while his female accomplice pretended to pray the rosary and act as a lookout, sources said.
When the church was relatively empty, Alicea dipped a stick with double-sided tape into the donation box slot - labeled "For the Poor" - and snared cash, authorities said.

What more can be said. It can happen to you. I’ve known individuals that could use tape and a pen to steal bills through holes not much bigger than the pen in tamper-evident bags. That would be those bags that seal up for one-time use, typically for bank deposits from commercial locations.

Since these poor boxes are generally not accounted for at the time of collection this type of theft would be relatively hard to detect. So be aware.

Rob
/

An even better Embezzlement story…

http://cbs13.com/topstories/local_story_306200258.html

A fiction writer would be creative to come up with this one…

So the Pastor forged documents and sold the church without anyone knowing. Where do you start with this one?

Expansile Significance - "The Tip of the Iceberg" and how solving large losses often means addressing the insignificant ones

What the hell is Expansile Significance you ask? So did I, though the problem wasn’t with the term but with the fact that our industry never bothered to create one for a time honored concept. To better explain it consider combining the idea of the “tip of the iceberg” and the “Broken Window” Theory (here, here, and here, with dissenting view here).

We’ve all seen it – in one way or another. In my retail days it was not uncommon to ‘interview’ a sales associate about a minor policy violation, say ringing their own transaction or giving their discount to a friend (aka employee discount abuse). And for those familiar with interview techniques (I started with Wicklander-Zulawski – which competes with Reid and LSI) you know you approach these interviews similarly to a known loss (theft) interview anyway. So there you are going through you doing your spiel with you realize that this person has done much more than you knew – on one occasion I went from one missing gift certificate to four felony theft cases.

In the world of law enforcement, former NYC Mayor Rudi Giuliani encapsulated it with through enhanced enforcement based on the “Broken Window” Theory. You know, by showing that minor violations won’t be accepted you decrease the appearance that more serious deviance is acceptable. I don’t intend to try and prove the efficacy of NYC’s efforts now. Instead keep in mind that if a violation is the time of enforcement then it’s worth the time to do it right.

Embezzlement – or any other form of stealing from an employer – is a great example of this. It is HIGHLY unlikely that you, or any other investigator, will catch someone on their first theft. Maybe their first theft using that method; however there have probably been other losses that they have caused. I recall from my W-Z training that a thief probably will not remember every individual theft, but will remember the first act and the most recent. Then you can work out some mathematical averages to estimate the total loss (which should then be used to help identify further evidence to corroborate or support this estimate). With this in mind it is important to explore all avenues of loss in an investigation – that is if you want to try and find the most accurate estimate and maybe get some hints for improving your internal controls.

Anyway take the time to conduct investigations properly. Be thorough and don’t arbitrarily assume you have the answers. I know that in the real-world time often is the biggest constraint so at least recognize what you may be missing – and work on ways to evaluate this more efficiently.

Rob
/

Embezzlement – just a little more (no pun intended)

http://www.gmtoday.com/news/local_stories/2005/October_05/10262005_01.asp

In a recent story out of Wisconsin a church business manager was convicted for theft from the church. Here are a couple of germane quotes from the article:

Anderson was the business manager of the church from 1986 to 2003, the last three years of which she wrote checks to herself from church coffers, a criminal complaint said.

Other documents chronicling her history showed that she received a $450,000 inheritance after her mother died in 1998, but it was gone in two years as her family’s debt mounted. Anderson and her family took annual skiing trips to Colorado and annual golfing trips to Florida, the documents showed.

There are a few key things that clearly were not done in this situation.

First, the position of Business Manager at this church clearly had too much power. There can be no argument to this when someone was able to write checks to them self from a corporate account – period. The person authorizing disbursements should not be the person that signs the check. Dual control and effective auditing is essential to all financial controls

Second, only one person was “minding the store” and that’s just unacceptable. Forget the concern about theft (only for the next sentence). Accounting errors are all too common. So having a second person review records periodically is not just to avoid theft, although it’s a great by-product of the effort, but to prevent mistakes. These mistakes can be costly. How long would it take to find out that a vendor had been overpaid? How willing are they going to be to returning funds two or three years later? I know, I know, where is their ethical obligation in this, but that’s not the point and arguments can be made all around on the whole returning money after a year or two.

Third, background checks should be done ROUTINELY on individuals in positions of trust and not just upon hiring. There is nothing wrong with asking for consent to get a credit report on an annual basis. If this feels inappropriate (and I can understand your thinking if it feels that way) then you have got to tighten your controls way down. Lots of “dual control” throughout the process to ensure that one person is not able to manipulate the entire system. And a little more on this… Everyone talks to each other in a workplace. Salaries are known (at least the general ballpark usually is) so you just have to wonder where all the money comes from and how it goes. Living beyond their means is a COMMON cause of embezzlement. Let me say that one more time. Living beyond their means should be a key indicator of employee theft. They steal, and learn a new level of comfort, and then they have to steal to support this new level. No doubt they rationalize it with the thought that they’ll pay it back but it’s still gone.

Fourth, these thefts went on for years. Where was the auditing? Were checks matched to expenses, vouchers reviewed, and so on? Not likely, but if so then their auditor is practically negligent for not raising questions about cash disbursements to employees.

If you’re unsure whether your controls are adequate then contact AP Innovations, but at least speak with someone experienced in these loss opportunities.

Rob
/

Expansile Significance - "The Tip of the Iceberg" and how solving large losses often means addressing the insignificant ones

What the hell is Expansile Significance you ask? So did I, though the problem wasn’t with the term but with the fact that our industry never bothered to create one for a time honored concept. To better explain it consider combining the idea of the “tip of the iceberg” and the “Broken Window” Theory (here, here, and here, with dissenting view here).
We’ve all seen it – in one way or another. In my retail days it was not uncommon to ‘interview’ a sales associate about a minor policy violation, say ringing their own transaction or giving their discount to a friend (aka employee discount abuse). And for those familiar with interview techniques (I started with Wicklander-Zulawski – which competes with Reid and LSI) you know you approach these interviews similarly to a known loss (theft) interview anyway. So there you are going through you doing your spiel with you realize that this person has done much more than you knew – on one occasion I went from one missing gift certificate to four felony theft cases.

In the world of law enforcement, former NYC Mayor Rudi Giuliani encapsulated it with through enhanced enforcement based on the “Broken Window” Theory. You know, by showing that minor violations won’t be accepted you decrease the appearance that more serious deviance is acceptable. I don’t intend to try and prove the efficacy of NYC’s efforts now. Instead keep in mind that if a violation is the time of enforcement then it’s worth the time to do it right.

Embezzlement – or any other form of stealing from an employer – is a great example of this. It is HIGHLY unlikely that you, or any other investigator, will catch someone on their first theft. Maybe their first theft using that method; however there have probably been other losses that they have caused. I recall from my W-Z training that a thief probably will not remember every individual theft, but will remember the first act and the most recent. Then you can work out some mathematical averages to estimate the total loss (which should then be used to help identify further evidence to corroborate or support this estimate). With this in mind it is important to explore all avenues of loss in an investigation – that is if you want to try and find the most accurate estimate and maybe get some hints for improving your internal controls.

Anyway take the time to conduct investigations properly. Be thorough and don’t arbitrarily assume you have the answers. I know that in the real-world time often is the biggest constraint so at least recognize what you may be missing – and work on ways to evaluate this more efficiently.

Rob
/

Tuesday, November 1, 2005

The Latest - Congress and the "SHAC" attack on the NYSE

For the best on the current high-profile happenings in the Animal Rights/Liberation head to Animal Crackers.

Here's the short version... Huntingdon Life Sciences has been trying to be listed on the NYSE. On the eve of this listing the President of the NYSE blocked the listing, after being targeted by SHAC and friends. As a result, the U.S. Senate has had more hearings on Eco-terrorism including a guest appearence from Dr. Jerry Vlasik. There's some great video from this. The saga continues...


Once again, for more background information on Eco-terrorism, including Animal Rights/Liberation and the Environmental Movement try this.