Honor Systems

Monitoring: Monitor the comings/goings and the time of said comings/goings

Log Books: Here is a very basic simple tool which is easily implemented and simple to administer but unfortunately it has numerous inherent flaws and exploits. For example those with malicious intent can simply ignore the log book and you would have no record of them or their activities.

Punch-Clocks: Here is a system which most people who have worked in a large factory environment will be very familiar with. It is simple and consists of a timing device, a time notification mechanism and a medium; such as punch cards, on which to record the time data.

The worker would take their card from a holder located adjacent to the timer/punch card device, insert it into the timer/punch card device which would place a time signature on the card and when done the worker would put their card back into the card holder.

This system was soon found to have some fatal flaws in that there was no way of identifying the authenticity of the person inserting the card into the punch mechanism. One person could sequentially punch in or out a whole bunch of cards even for persons who were not physically present.

The vindictive could also remove other individual's punch cards and so their record of attendance was lost. Very distressing for a worker to have worked all week and not to get paid because the pay office had no punch card records to work on. The same was true for using this system as a means of identifying comings and goings.

Not to be outdone companies simply required the worker to carry their punch card with them. This did reduce the vindictive down-side some what but it was still open to fraudulent use. One individual could still insert a "friend"s card' for them. Not to be out done the employers now manned their time/punch devices and the officer manning the device retained all punch cards.

Unfortunately; for a small consideration, some punch card operators could be enticed to falsely use their systems and so absent employees were still getting paid. Employers once again responded by introducing measures such as rotating punch card staff. But no matter what they did there were still abuses of the system.

The point of all of this is to show that the honor system has too many fatal flaws to work efficiently and effectively in any situation where large numbers of individuals are involved. It has always been very easy to get lost in a crowd.

Over the years these systems have evolved with the times and today we still use honor systems in one form or another. It is only since the advent of biometrics that most of the abuse of these systems has been effectively curtailed. It is very inconvenient to give somebody your eye-ball to clock into work while you go to the big game.

Human Presence Surveillance

Monitoring - Designed to monitor the comings/goings and the time of said comings/goings

Manned Sign-In/Sign-Out Registers - This system is far more reliable than the honor system above. A log book or register is maintained for signing in and another separate log book/register is maintained for sign-out. Both are manned by different personal who counter-sign every entry to validate authenticity and the accuracy of the time entries.

Identifiers - Proof of identity should always be required even when the person is well known to the security personal. This is to ensure that only those who are meant to be present are in fact the only ones present.

Rosters -It is also common practice for the security personal to have a rooster style checklist detailing those who are to be expected to be coming and going and the times of said comings and goings are also generally included on the checklist as well.

Reliability - Systems such as these do provide a more reliable mechanism for maintaining accurate records of who goes in and out and when. They are also easy to implement, maintain administer and update. Unfortunately this type of system also has inherent flaws and drawbacks. One being the staffing requirements and the costs associated with this.

Flaws - Others being corrupted personal manning the monitoring points, human lackadaisicalness and courtesy - such as making occasional exceptions when known authorised personal have "forgotten" to bring their ID with them today. It may well be that they have lost it or it has been stolen and the speed with which any access privileges are withdrawn from such IDs is of paramount importance.

Video Surveillance

Affordable - I did say that the majority of the mechanisms that will be listed here are affordable and video surveillance even if only in the form of a web camera is definitely well within reach of the average organisation and in deed the average citizen today.

Placement - Video surveillance equipment needs to be thoughtfully and carefully placed to make avoidance, tampering and/or disabling it difficult. The placement of the equipment should also provide a good clear and unobstructed view of persons entering and leaving. The capacity to take still pictures at bottlenecked check points is also an advantage as this ensures that only one person at a time will pass and their photo is taken both solely and collectively if they are coming and going as a group.

Video is not the end all be all and should always be used in conjunction with other mechanisms (logs etc)

Cost - It does help provide 24/7 monitoring at low cost

Triggers - Trigger events can be predefined and the system can automatically notify those designated members of the chain of notification should a trigger event occur along with basic details concerning the nature of the trigger event. Fire would be one such identifiable trigger event.

Email Notifications - The capacity to notify various select personal via email is an option that is gaining rapid adoption in the general community as we are all becoming ever oblivious to the continual presence of video surveillance systems.

Security Updates - Matters concerning the monitoring equipment should be discussed amongst the security team members at regularly irregular weekly team meetings

Recordings - Many video monitoring systems that are used in the public arena are operated by or through the auspices of a statutory body such as the police, or transit authorities. In their case legislation has been enacted that prescribes the manner in which they make video recordings (usually of public places), how they store them, for how long they must be retained and so on.

When it comes to the private arena things become somewhat muddied. We do or will have Privacy Legislation that does at least in part provide guidelines and in the case of the more extensive Privacy Legislations legally binding statutes that dictate; to one degree or another, the manner(s) in which private individuals and organisations should behave in this area.

Remember not all States in Australia have consistent Privacy Laws so you will need to check what is relevant to you. I will be discussing Privacy in another article and will let you know when I have found a home for it.

Part 5 of the IT Security Guide will continue with Part 4 of the Physical Security Guide series and will cover the following topics:

• Physical Location and Placement
• Wiring Closets
• Infrastructure Cabling and Cabling in General
• Mission Critical Systems
• Rack Mounted Systems
• Servers

So until next time enjoy!!!

Physical Intrusion Detection, Prevention and Deterrents

• Man the Premises

  Armed guards do provide a strong deterrent but as with most human reliant systems has its flaws. The guard goes to the toilet, falls asleep, is corrupted and the cost to name but a few. This is a costly exercise for after-hours security when nobody is on site. It is not uncommon for business to employ armed guards during normal working hours and then only a skeleton night-shift of guards for the after-hours period.

• Guard Dogs

  Guard dogs do provide a very good deterrent. Most of us do have in innate fear of being eaten alive. Still using guard dogs does have its flaws. Although; cheaper than human, guards guard dogs do not come cheap. So the extra cost as opposed to doing nothing, the continued on-going cost and inconvenience are the three that rate highest as the disadvantages of this system.

• Security Patrols 

  Intermittent visits by security guards can be a helpful deterrent. Obvious flaws here include the simple fact that the guard is not present 100% of the time. If the security company uses a schedule to inspect customer's premises then villains can observe and identify the pattern and exploit any weaknesses. Although; cheaper than in situ guards, there are still additional and on-going cost imposed on business.

• Alarms

  This category of devices act in cohesion with numerous electronic detection devices and upon an event triggering one or more of these electronic detection and monitoring devices the alarm will begin its wailing complaint. Alarms that are perceived to be perpetually triggering or are false alarms become ignored by monitoring staff over time.

The main costs associated with alarm systems are the initial outlay for the equipment and its installation. If you want to use an alarm monitoring and response service such as those provided by the likes of Amourguard®, Brinks®, Wormalds® and the like there will be continuing on-going cost that will be incurred.

Auto-Dialers 

Expand the alarm to the next level in that rather than just an alarm making a lot of noise upon the occurrence of a trigger event they will dial a preset number; usually to the police and/or a private security company.

The notified parties will then endeavour to attend the physical location as promptly as possible. Most thieves know this and deliberately limit their activities to as short a time span as possible. They don't want to be caught in the act so as to speak and they need time to make a clear get-away.

Once again the main costs associated with auto-dial alarm systems are the initial outlay for the equipment and its installation. If you want to use a third party alarm monitoring, call/incident taking and response service such as those provided by the likes of Amourguard®, Brinks®, Wormalds® and the like there will be continuing on-going cost that will be incurred. I must say that these services become very attractive if you are the one that must respond to a trigger event at 2 AM. Don't forget the telephony charges either.

Silent Alarms 

The idea here is that upon the occurrence of a trigger event the auto-dialer will do its thing but because there is no loud alarm the would-be thieves may think that there is no alarm system at all. The result is that they; the thieves, may prolong their stay longer than normal and so get “caught in the act”.

Costs for this type of service include the initial outlay for the equipment and its installation, the call-out response fee charged by the contracted incident responder or their agent and the on-going service and maintenance fees along with the charges incurred by the telephone company.

Motion Detectors 

At one time this class of intrusion detectors was mainly comprised of microwave enabled devices and worked on the same basic localized radar-like functionality as their bigger brothers do. Once motion is detected in an area where no motion should currently be taking place an alarm process is triggered. Ultra-Sound devices were and still are used as motion detectors.

Computerized Motion Detectors 

Today however; with the advances in computer technologies, we have systems for detecting motion that are comprised of video cameras and computer pattern matching software. Web cameras are being used in this role more and more.

Basically the camera records its field of view and transmits this information to a computer which stores the image on both the hard drive and into memory. At specified intervals; or in the event of a trigger event taking place, the video camera sends more pictures to the computer. The computer then compares the new image against the reference image and if it finds that the two pictures are not identical it initiates an alarm sequence.

• Pressure Pads 

  Most commonly found where ever the public has limited free access to an area containing valuable assets. An example would be a counter top display or some of the exhibits in museums and art galleries around the world. The asset is placed upon a pressure pad. If the asset is removed from the pressure pad an alarm event is triggered.

• Micro-Chips

  A micro-chip is embedded into the asset and if it is misplaced or stolen it can be readily identified. Micro-chips are even planted into the ears of thorough-bred animals as a strong deterrent and as a means of identifying the asset in the future.

• Security Coatings

  Many different superficial materials can be applied to an asset in very much the same way as you would apply a coat of paint. The coating may be magnetically polarised.

Other security coatings will absorb Electro-Magnetic Radiation (EMR). This property has the effect of reducing the leakage of radio frequency signals and hence the capacity for would be intruders located outside your premises from eavesdropping your Wireless Local Area Network (WLAN). They also help in reducing the number of external free-loaders from accessing your wireless network and using it as a means for Internet connectivity. This can have dramatic effects upon the bandwidth and data through-put available for authorised personal.

Wireless Access Point (WAP) 

A WAP acts pretty much like a hub in that the total bandwidth capacity of the WAP is divided among the users currently using it. So if your WAP has a maximum available bandwidth of say 11Mbit/sec and two users are concurrently accessing it each user would have about 5½Mbit/sec of transmission bandwidth. If three additional users begin to access the WAP making a total of five concurrent users the WAP will be able to devote only 2.2Mbit/sec to each user.

Now consider an external free-loader playing an online game and consuming 3Mbit/sec in the process. In this case each of your five legitimate users would at best be able to access 1.8333Mbit/sec. If the freeloader is able to dedicate the entire 3Mbit/sec that they are using only 8Mbit/sec will be available to your wireless network's legitimate users. This works out to be 1.6Mbit/sec to each of the legitimate users.

Preventing this scenario from occurring; through the use of coatings that absorb radio frequency and microwave EMR is truly beneficial to the owner of the bandwidth. It also helps to address the issues of maintaining the confidentiality of any data that is transmitted over the wireless network.

Impact Resistant Film for Glass

Applying a transparent or smoked impact resistant film sheet to the inside of external glass panels means that would be intruders are going to have to do more than throwing a brick at the window. They will generally be required to strike the glass a good many times before they will be able to force the pane in and so gain access. It is also a good idea to do the same with display cases in which the transparent variety is more attractive.

Lighting 

Night lights play an important role in allowing window shoppers to view those products which you have on display. Night lights also serve to give security a clear view of the premises. If an observer (guard) knows that nobody should be inside and they catch a glimpse of somebody the guard can take the appropriate action.

Being clearly observable by passers-by is a very strong deterrent to thieves particularly when another nearby target does not have night lights. Good planned lighting used in conjunction with video surveillance systems also serve to ensure that pictures of the perpetrators are able to produce quality images that clearly identify said perpetrators.

Red Eye Detectors 

This category of devices is set to determine threshold crossing. It is basically a source of infrared or more commonly today a laser source and a detector. Both devices are installed where there is a completely unobstructed line of sight between the devices as they work in conjunction with each other and never individually. This line of sight is typically across a human access point.

Whenever the line of sight becomes obstructed; by somebody passing through the line of sight from one side to the other such as when entering or leaving a building the detector recognises the interruption in its receipt of the signal from the transmitter and sounds an alarm (typically a bell or chime).

This indicates to staff that somebody has entered into the space isolated by the line of sight detection system and they should put down the coffee cup and attend to the customer. In the case of securing your server room this system works best when the access point line of sight occurs prior to the actual door to the server room.

For example: the system could be installed at some point in the server room access path or a hallway leading to the server room's entrance.

These devices are often used in conjunction with video surveillance equipment (which I shall discuss a little later). In this case when the line of sight system is triggered video cameras aimed at a spot a bit further down the server room's access way start to record. In this way all those entering the proximity of the server room facility are video-taped coming and going.

Break-Glass Detectors 

These devices are used to detect incidents where glass is broken. They work best when impact resistant materials have not been fixed to the glass.

Pin Droppers

This group of devices works on the simple principle of current flow/current flow interrupted and are typically installed to windows and doors.

A metal pin is placed into the top of the door frame so as that when the door is closed the pin is pushed up into a recess. Here a current is passed from one side of the recess to the other using the metal pin as its transmission medium. Whenever the door is opened the pin will drop and the circuit will be broken and the alarm sounded or any other preferred action will be initiated.

Mercury-Magneto Devices

Similar to pin droppers but are usually located on the floor. A plate across the bottom of the door is used to complete an electrical circuit or in the newer models a magnetic field. Once again whenever the door is opened the circuit is broken or the magnetic field is altered and the alarm or other desired actions are initiated. Once again these devices can be teamed up with video camera recording systems.

Passive Infrared 

These devices are commonly referred to as heat detectors; which in a sense they are, because infrared Electro-Magnetic Radiation (EMR) is what we call heat.

The twist here however; is that these devices simply monitor variations in the levels of infrared energy in their immediate local environment that they are being exposed to. Any dramatic increase in the “normal” range of fluctuating infrared levels is assumed to be due to the presence of an infrared source coming into close proximity of the device.

Generally speaking the assumption is made that increases above a certain threshold in an area that is meant to be devoid of humans should be attributed to the presence of an intruder and so the trigger sequence is initiated.

Proximity Detectors 

Function using the same types of assumptions that the passive infrared detectors use.

Particle Detectors

Based primarily upon the properties of light transmission through a sample medium which in this case is a sample of the air from the detectors immediate environment. The presence of particles usually attributed to smoke which is assumed to be the resultant by-product of a fire. Smoke detectors are a classic example of particle detectors currently in use today.

Remote Controlled Locking Systems

Such as those currently used in detention centers, prisons, holding areas or bank vaults are also used by larger organisations.

Time Locks

Automated locking and releasing mechanisms that all who have watched a few movies; particularly ones about bank robberies, will undoubtedly be familiar. The basic principle involved is that a timing mechanism external to the lock controls the functional state of the lock.

These locks are deemed to have only two states - open or closed. This is a bit like the thermionic gates that are at the heart of modern computers. Whenever the timer reaches a programmable threshold it causes the state of the lock to change. This type of access control mechanism is very resistant to tampering and so it is commonly used whenever and wherever quantities of valuables are housed.

Door Bells and Noise-Makers

Entry-way noise makers are a very cheap and cost effective solution for the smaller enterprise or individual. They can be self-installed and are very cheap to purchase. If all you require is notification of the entry or exit of persons then you may do well to consider this option as a viable alternative to high-tech solutions.

Many smaller stores; particularly convenience stores and those operated by the Chinese community, make liberal use of door-chimes in this way. Most customers think that they are just "lucky-charms" and hanging door chimes; which in a way they are, since you won't be able to sneak in and remove items unheard.

Biometrics

Numerous biological factors that are unique to an individual can also be used to control and regulate the passage of humans.

Costs 

In general you will need to pay for the actual detectors and possibly their installation. In cases where the detectors are part of a more expansive monitoring and alarm system particularly when trigger event monitoring, notification and or response services are involved you may have no option but to use a licensed installer. In fact in many areas this is a regulatory requirement. As always research your options thoroughly.

Part 4 of the IT Security Guide will continue with Part 3 of the Physical Security Guide series and will cover the following topics:

• Honor Systems
• Manned Surveillance Systems
• Video Surveillance Systems
• Monitoring and Recording Systems