Physical Security 101

When a business organizes all of these security measures to work together, it creates a physical security program. A good program looks to balance the costs of the methods it implements against the actual risks faced by a particular organization. For example, the correct security at a federal prison is going to look different than security at a grocery store.

Why Physical Security Is Important

You will see many benefits to applying good physical security. Not only will you better manage the threats faced by your organization, but you’ll prevent unnecessary costs from eating into your bottom line. 

Good physical security will protect your business and employees from emergencies. It will also protect against day-to-day risks like theft and negligence while helping you control access to valuable assets and manage who is in your facility.

1. Plan

To get the most value from a physical security purchase, you need to define your desired outcomes. What is your organization looking to gain from this purchase:

• Improved safety?
• Better compliance?
• Alignment of security operations with strategic goals?

You need to do a few things to answer that question accurately:

Identify Stakeholders

Stakeholders are the people inside and outside your organization who care about how your new physical security system will operate. Internal stakeholders could be from your security team, physical plant team, or IT department. External stakeholders could be local law enforcement or business partners.

Understand Their Expectations

Seek input from your stakeholders about what outcomes they want to see from this new system installation. Do they have any particular concerns about how it will be installed and used?

Determine How to Assess Performance

What key indicators will determine how effectively your new system does its job? For example, if you’re considering purchasing a key control system, you might want to track the number of lost keys reported in your business to see if that number goes down. Or you might decide to use the number of rekeyings your business has to do each quarter as a measure of security breaches.

These operations need to work together as part of an overall program if they are going to thoroughly protect your organization.

Let’s go over some of the major technical solutions an organization should consider. Some are designed to support one specific operation. Others do a little bit of everything.

1. Access Control

Access control solutions manage the flow of traffic through entryways and access points in your facility. They can be used to restrict access for different types of employees and visitors.

Although security guards and other personnel can perform access control when needed, in most cases, it is more cost-effective to use a technical access control solution. Those technical solutions can include:

Electronic Access Control

These systems connect to a central database where employee access privileges are recorded. When an employee authenticates themselves at an access point, the system verifies whether they are allowed through and opens the access point accordingly.

Employees authenticate themselves using a token, such as:

• Swipe cards: Identification data is stored on a magnetic strip, like on a credit card. The card is swiped at a reader to authenticate the holder.
• RFID fobs: Radio frequency identification keychain tokens that communicate over short-range wireless. The fob is waved near a reader to authenticate.
• Prox cards: Flat cards that are pressed against readers to authenticate the holder. Newer prox cards use embedded RFID antennas to transmit credentials.
• Mobile phone apps: A secure app on a user’s phone identifies them when they approach access points. Phones authenticate the holder by transmitting their identity over Bluetooth or NFC, short-range wireless antennas common in mobile devices.

Electronic access controls are very secure, but they can be expensive. Most organizations only deploy electronic access control at their most sensitive access points.

Mechanical Access Control

Given the high cost of electronic access control, most doors and other access points continue to be secured by mechanical lock-and-key systems. Mechanical access control is cost-effective for managing access points with routine levels of security.

The major downside to using mechanical controls is that they lack built-in tracking and accountability. Because electronic systems communicate with a central computer system for every access request, they generate a complete access log in real time. Mechanical keys don’t have this capability by themselves.

Key Management Systems

Combining mechanical access controls with an electronic key management system is one model that many organizations employ as a cost-effective alternative to electronic access control. At their core, key management systems are secure cabinets with electronic access control terminals attached. 

Users authenticate themselves at the terminal and specify which key ring they want to sign out. The request is logged, and the key management system unlocks only the keyring selected.

Key management systems can also automate many useful but time-consuming administrative tasks. Managers can set curfews on key sign-outs or limit the number of keys a single employee can have in their possession. If an employee misses a curfew or does not return their keys at the end of their shift, the key management system can send alerts to the employee’s supervisor.

Asset Management Systems

As with keys, many businesses find it beneficial to control access to sensitive or expensive equipment. Like key management systems, asset management systems use a combination of secure cabinets, access control terminals, and smart sensor technology to control who uses assets, as well as when and how assets are used.

Content surveillance sensors inside locker compartments can identify assets when they’re signed out or returned for better accountability and inventory tracking. Curfews and alerts also help prevent unnecessary losses and ensure vital equipment is ready when employees need it.

2. Surveillance

Surveillance is the process of gathering information relevant to an organization’s physical security. That information commonly includes the locations of potential threats, personnel, and valuable equipment moving through your facility, as well as the activities of security personnel.

Video Surveillance

Traditionally, video surveillance systems had to be actively monitored by security personnel to identify threats on screen. Either that or they were just used to collect footage for review if a security incident occurred.

More modern security systems use video analytics software that is capable of detecting potential threats on its own. This software can recognize cars entering a secured lot after hours, or even the motion of an attacker swinging a punch. When a potential threat is identified, the analytics system automatically notifies human security personnel so they can respond.

Alarms

Whereas video surveillance systems record what is happening inside a particular location, alarm systems monitor for attempts in access to unattended sites. Different kinds of sensors are employed for different alarm functions.

Motion sensors detect movement in low light or dark environments. Perimeter sensors detect when a door or other access point is breached. Glass break sensors detect the unique frequency of glass breaking.

These are some of the most common sensor types. All of them notify security personnel to respond when a breach is detected.

Develop a Full Physical Security Program

Tackling security challenges one issue at a time is not efficient in the long run. It's like closing the windows out back while waiting for a reason to lock your front door.

A full physical security program is a much more efficient approach. Physical security programs are made up of people, processes, technology, and documentation. They also include the performance data you collect on how those elements function.

In a good physical security program, all of these elements will be designed and measured against a recognized security framework. Doing so allows you to benchmark and evaluate your performance and apply changes to your program according to established best practices. Professional or industry-specific standards are available to guide these decisions, such as ISO 27001 and NIST PE-3.

Designing a Secure Facility

• Keep signage for high-security facilities to a minimum. Don’t help attackers by enhancing the facility’s visibility.
• During design, invest in fireproofed doors, walls, and ceilings.
• Remove all non-essential flammable materials from high-security spaces.
• Have two entryways at most.
• Reduce the size of windows so they can’t be used to gain access.
• Train personnel authorized for these facilities in emergency evacuation and lockdown procedures.  

Protecting Business Equipment

• Identify which equipment is general use and which is essential. Store and manage each type separately.
• Store equipment away from doors, windows, and HVAC systems, like air conditioning vents and radiators.
• Secure loose cabling away from high foot traffic areas.
• Maintain records for all essential equipment, including model numbers, serial numbers, and warranty information.
• Before maintenance is needed, identify internal or external technicians certified to repair essential equipment.
• Create an equipment damage policy that outlines the behavior you expect employees to follow and explains how damages should be handled.

Evaluate each consultant and service provider you work with. Are they able to customize services to your particular business and facility needs? What kind of ongoing support do they offer? Will they be available when a critical system needs attention?

It takes hard work and focus, but the end result will be a customized physical security program that prevents unnecessary losses and improves efficiency at your organization.