facility security design from conception …€¦ · ... (one goal is to minimize these ... •...

93
Session # 4212 September 25, 2017 – 2:00pm – 5:00pm FACILITY SECURITY DESIGN FROM CONCEPTION TO COMPLETION

Upload: phamtuyen

Post on 23-Aug-2018

214 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

1

Session # 4212

September 25, 2017 – 2:00pm – 5:00pm

FA C I L I T Y S E C U R I T Y D E S I G N F R O M C O N C E P T I O N T O C O M P L E T I O N

Page 2: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

2

S P E A K E R S :

Randy Atlas, President, Atlas Safety & Security Design Inc

Kenneth Herrle, Sr Engineer, Applied Research Associates, Inc

David Rickerson, Sr Project Manager, Guidepost Solutions, LLC

René Rieder Jr, Associate Principal, Arup

Mark Schreiber, Principal Consultant, Safeguards Consulting, Inc

Program developed by Security Architectural and Engineering Council

2

Page 3: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

3

SEC U R ITY D ESIG N PR O C ESS

Page 4: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

4

W H AT D O E S I T TA K E T O I M P L E M E N T A N E F F E C T I V E , E F F I C I E N T S E C U R I T Y P R O J E C T ?

• Analyze the situation (Pre-design Phase)

• Determine the needs the solution provides (Programming Phase)

• Design the means to the ends (Design Phase)

• Implement the pieces of the project (Construction)

• Activate the project/solution (Commissioning/Occupancy)

• Operate the system/solution (Post Occupancy)

Page 5: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

5

A N A LY Z E : T H E S I T E & T H E P R O J E C T

• Identify stakeholders

• Who has a vested interest in the project

• What will their roles will be in the project?

• Get stakeholder input as soon as possible

• Identify applicable security design criteria

• Identify assets to be protected

• Includes site, buildings, property in buildings, personnel, intellectual property, ability to operate, reputation

• Not all assets will be addressed

• Perform a risk analysis

• Include threats, vulnerability, & consequence/impact

Page 6: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

6

S TA K E H O L D E R A N A LY S I S

• Who is at risk of the threats?

• Who is behind the threats?

• Who else will be affected by the threat coming to fruition?

• Who else involved may place constraints on the project and/or the solution?

• Who will be affected by the possible solutions?

• Who is paying for the project?

• What are the lifecycle costs?

• Who will implement the project?

Page 7: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

7

R I S K A S S E S S M E N T

• Identify assets you are trying to protect

• Analyze & Document threats to each asset that you want to address (leave out things you are unable to address at this time)

• Analyze & Document the vulnerabilities of the assets to the corresponding threats (one goal is to minimize these vulnerabilities…the other is to reduce the probability of attack)

• Evaluate the probability and impact of each threat on each asset (this is quantification of risk)

Page 8: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

8

P L A N N I N G : T H E E N D S TAT E• Identify functional requirements of solutions

• What are you trying to accomplish?

• Think what would a “successful” solution provide? (not what IS a good solution)

• What are unacceptable outcomes? / What are the tradeoffs?

• Understand what/how a solution will reduce vulnerability and/or the probability of attack

• Identify a Rough Order of Magnitude (ROM) budget for the project

• Identify a timeline for the project

• Identify other major constraints on the projects (e.g., design codes & standards)

• Get key stakeholder buy-off on the goals of the project before the design

• Answer “What do THEY THINK is a successful design?”

• Identify families of solutions on the market that may satisfy the design requirements

Page 9: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

9

S T U D Y/ R E P O R T P H A S E D O C U M E N TAT I O N

• Functional Requirements Analysis

• Asset Definition

• Risk Analysis Results

• Conceptual Design

• Design Drawings

• Site Plan and Details• Building Plans, Elevations, and Details

• Specifications

• Cost Estimate (Rough Order of Magnitude)

• Design Analysis

Page 10: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

10

F U N C T I O N A L R E Q U I R E M E N T S A N A LY S I S

• Clearly defines the assets to be protected

• Delineates perceived or validated threats

• Evaluates specific vulnerabilities

• Ensures that the project is “bracketed” or “stays within the box”

• Identifies the risks

• Says what is needed but not how to implement it

Page 11: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

11

C O N C E P T UA L D E S I G N

• Ensures the selected solution is effective at mitigating real, specific vulnerabilities

• Provides a cost/benefit justification for final solution

• Identifies all elements and resources required for each solution

• Provides the groundwork for accurate and complete drawings and specifications used to procure and implement solutions

Page 12: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

12

D E S I G N : T H E M E A N S TO T H E E N D

• Review Design Criteria

• Preliminary Design

• Final Design Drawings & Specifications

• General provisions in the specifications outline what the contractor should know to do the job properly.

• Engineer’s Cost Estimate

• Bid Requirements

• Contract Forms

• Contract Conditions

Page 13: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

13

S E C U R I T Y D E S I G N P R O C E S S S C H E M AT I C

Page 14: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

14

I N T E G R AT E : L O O K I N G AT T H E B I G P I C T U R E

• Integration Objectives:

• Ensure protection of life

• Balance asset utilization with risk of loss

• Provide proactive risk management

• Ensure effective project management

• Systems and equipment are considered subordinate to policies and procedures

• Similar to a sanity check, verifying that the solution to be implemented will work as planned

Page 15: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

15

I M P L E M E N T: P R O C U R E & I N S TA L L

• Success comes when vendor, designer, purchaser, and user work together.

• Communication is even more crucial to mitigate gaps in the project.

• Management of changes and surprises is crucial now to ensure that last-minute changes will not cause huge problems.

• Thorough testing, training and quality control inspection is always part of installation.

Page 16: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

16

O P E R AT E : T U R N V I S I O N I N TO R E A L I T Y

• It’s Worth repeating: “Systems and equipment are considered subordinate to policies and procedures”

• The Security Department must be integrated into all aspects of business operation

• Flexibility is key to ensuring the system continues to meet needs

• Plan on updating systems as time passes

Page 17: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

17

R ISK A SSESSM EN T

Page 18: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

18

W H E R E I T F I T S I N T H E P R O C E S S

• Perform a risk assessment

• Analyzing the situation (Pre-Design Phase)

• Include assets, threats, vulnerability, risks

• Identify assets to be protected

• Includes site, buildings, property in buildings, personnel, intellectual property, ability to operate, reputation

• Not all assets will be addressed

Page 19: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

19

W H AT I S A R I S K A S S E S S M E N T ?

• Risk assessment is the identification, analysis, and evaluation of uncertainties to objectives and outcomes.

• It provides a comparison between the desired/undesired outcomes and expected rewards/losses of organizational objectives.

• The risk assessment is conducted in order to determine whether if, how, and to what extent the organization’s objectives, desired outcomes, and assets may be impacted.

• A risk assessment is tailored to the context in which the organization operates.

Page 20: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

20

Page 21: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

21

Q UA L I TAT I V E V S . Q UA N T I TAT I V E R I S K A N A LY S I S

• Qualitative Analysis Factors

• Hours of operation

• Staffing levels

• Types of services provided

• Types of clientele served

• Crime data

• Environmental factors and crime magnets

• Direct and indirect costs for security and losses due to crime.

• Quantitative Analysis Factors

• Calculating probability of risk and criticality of consequences of an incident or loss

• Probability factors:

• Physical environment

• Social environment

• Political environment

• Historical environment

• Procedures and processes

• Criminal state

• Risk is presented in a matrix from very high to very low

Page 22: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

22

R I S K WAT E R FA L L D I A G R A M

Page 23: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

23

A S S E T VA LU E A S S E S S M E N T

• Asset value is a characteristic of the building, equipment, staff, etc

• It is an impact on the stakeholders in the event an asset is destroyed or unavailable

• Asset value typically come from Owner/Operator, Government source or who will benefit from use of the asset

• Asset value is quantitative – building repair, loss of revenue, loss of product

• Asset value should include subjective “values”

Page 24: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

24

V U L N E R A B I L I T Y A S S E S S M E N T

• Vulnerability is a weakness that can be exploited by an adversary

• Vulnerability assessment process involves:

• Understanding the Layers of Defense

• Understanding Redundancy Factors

• Understanding Interactions Among Physical and Organizational Components

• Conducting the Site Inspection

• Preparing a Vulnerability Portfolio

• Determining the Vulnerability Rating

Page 25: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

25

W H AT I S A T H R E AT ?

• Threat is defined as the capability and intention of an adversary to undertake actions that have consequences detrimental to an organization or enterprise.

• Robbery is a threat for taking of money or valuable items. The assets are the items of value, people, information, or property.

Page 26: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

26

R E A L T H R E AT S

Page 27: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

27

R I S K A S S E S S M E N T – S P E C I F I C TO S I T E

• Risk assessment analyzes the threat/hazard, asset value and vulnerability to ascertain the level of risk for each critical asset against each applicable threat or natural hazard.

• Risk assessment process involves the following:

• Preparing the risk assessment matrices

• Determining the risk ratings

• Prioritizing observations in the Building Vulnerability Assessment Checklist

Page 28: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

28

L I K E L I H O O D O F O C C U R R E N C E

• Determining risk rating

• Risk is the potential for a loss or damage to an asset

• Calculated based upon the value of the asset and the likelihood of the threat/hazard occurring and the consequences of the occurrence

• Risk assessment provides designers with a relative risk profile that defines which assets are at the greatest risk against specific threats or natural disasters

• Numerous methodologies and technologies for conducting a risk assessment

• Risk = Asset Value x Threat Rating x Vulnerability Rating

Page 29: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

29

L I K E L I H O O D O F O C C U R R E N C E – S A M P L E M AT R I X

Page 30: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

30

M I T I G AT I O N O P T I O N S

• Assessments are used to calculate the potential for some unwanted event to occur

• Assessments are a function of threat, vulnerability, and consequences, which is defined as adverse effects from the loss of an asset.

• Mitigation options involves the following:

• Identifying preliminary mitigation options

• Reviewing mitigation options

• Identifying the levels of protection

• Selecting, prioritizing, and integrating mitigation measures

• Estimating cost

Page 31: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

31

P R E V E N T I N G , D E L AY I N G , M I T I G AT I N G

• Preventing an attack

• Implement measures create challenge attack scenarios

• Making the target appear to be of low value in terms of the amount of sensation

• Delaying the attack

• Designed landscape or architectural features to delay attack

• Development of a buffer/stand-off zone

• Provide security forces time to mobilize and respond to attack

• Mitigating the effects of the attack

• Structural protection

• Life safety systems

Page 32: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

32

C H O I C E S A N D D E C I S I O N S• Regulatory measures

• Legal and other regulatory instruments that governments use to prevent, reduce, or prepare for the losses associated with manmade hazard events that affect commercial buildings

• Repair and strengthening of existing buildings

• Structural and non-structural modifications of existing buildings and infrastructure facilities

• Existing buildings may be at higher risk because they were constructed without the appropriate safety measures to withstand potential terrorist attacks

• Protective and control measures

• Potential terrorist attack is prevented or pre-empted through intelligence measures

• Deception may be used to make the facility appear to be a more protected or lower-risk facility

Page 33: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

33

R E F E R E N C E S• ANSI/ASIS/RIMS RA.1-2015 – Risk Assessment Standard

• ANSI/ASIS SPC.1-2009 – Organizational Resilience: Security, Preparedness and Continuity Management Systems – Requirements with Guidance for Use

• ISO 31000:2009 – Risk Management – Principles and Guidelines

• ASIS General Security Risk Assessment Guidelines 2012

• FEMA 452. Risk Assessment July 2010

• FM 3-19.30 Physical Security. Dept. of the Army August 2010

• ISC Physical Security Criteria for Federal Facilities. Interagency Security Committee Standard.

• Unified Facilities Criteria. DoD Minimum Anti-terrorism Standards for Buildings. October 1, 2013

Page 34: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

34

S U M M A R Y

• Risk Assessment involves:

• Asset Identification

• Threat Analysis

• Vulnerability Assessment

• Mitigation options

• Feasibility of implementation

• Effectiveness

Page 35: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

35

D E S I G N B A S I S :

F U N C T I O N A L R E Q U I R E M E N T S

Page 36: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

36

W H E R E I T F I T S I N T H E P R O C E S S - P R E -D E S I G N W O R K

• Design Basis is made up of functional requirements of the solutions that would be used to reduce the vulnerability and the associated risk of the defined asset.

• To identify the functional requirements that are desired you need to ask:

• What are you trying to accomplish?

• Think “what would a successful solution provide? “

• What are the tradeoffs?

• What are the unacceptable outcomes?

• Are you clear on what or how a solution will reduce vulnerability and/or the probability of attack?

Page 37: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

37

W H Y H AV E A D E S I G N B A S I S ?

• Establishment of a Design Basis (i.e., Functional Requirements)

• is the initial phase of the security program development process,

• where the security user identifies system objectives, functional requirements, and initial system definition to counter a defined threat to specific assets, and reduce vulnerabilities.

• The design basis is the cornerstone of a sound security program.

Page 38: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

38

B E N E F I T S O F A C O N C I S E D E S I G N B A S I S

• Provides a clear plan towards effective security

• Aids in communication of the security needs

• Makes it easier to alter a solution in response to environmental or other project-related changes

• Can serve as a basis for “negotiating” incremental security measures with management

• Developing functional requirements is the established process for determining & justifying security recommendations

Page 39: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

39

B E N E F I T S O F A C O N C I S E D E S I G N B A S I S

• The Concentration is on Asset Protection and Risk Control

• Establishes Simple, Sound Foundation for Design Solutions

• Ensures Singular Design Team Focus

• Allows for Smooth, Logical Transition to Countermeasures and Concept as Design Basis

• Ensures Proactive Approach & Return on Investment

Page 40: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

40

Q U E S T I O N S F O R P R E PA R I N G A D E S I G N B A S I S

• What assets are to be protected?

• Protected against what or whom?

• What is the consequence of loss?

• What is the desired level of protection?

• Are there other specific requirements?

• What type of protection could work in this scenario?

• What are the protection solution constraints?

• Is there a need for an integrated system and/or response?

Page 41: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

41

W H AT A R E F U N C T I O N A L R E Q U I R E M E N T S ?

• Statements of Security Objectives

• What are required protective measures?

• Requirements are keyed to assets and threats

• Requirements address facility vulnerabilities

• The functional requirements includes the level of protection

• The functional requirements serve as a design guidance tool

Page 42: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

42

F U N C T I O N A L R E Q U I R E M E N T: E X A M P L E 1

• Vulnerability:

• Access to Facility is not controlled

• Level of risk/protection: High

• Functional requirement:

• Limit facility access to authorized employees with a high probability of identification

Page 43: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

43

F U N C T I O N A L R E Q U I R E M E N T: E X A M P L E 2

• Vulnerability:

• No detection or delay of forced entry to finished product storage area.

• Level of risk/protection: High

• Functional requirement:

• Provide immediate detection of forced entry attempts into finished product storage area to ensure response intercept of threat source and provide delay after detection to exceed response time.

Page 44: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

44

O T H E R F U N C T I O N A L R E Q U I R E M E N T S TAT E M E N TE X A M P L E S

• Provide perimeter monitoring of exterior site and entrances/exits

• Provide computer software to record employee pictures/profiles accessible by code

• Maximize natural surveillance by maintaining line of sight through pruned landscaping

• Ensure separation of Executive Area in terms of facility controls through physical and electronic security methods

• Restrict vendor access to the following locations facilities based on demonstrated need

• Maintain awareness of the organization’s mission importance and sensitivity through formal employee oriented awareness and prevention programs

Page 45: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

45

U S I N G F U N C T I O N A L R E Q U I R E M E N T S

Page 46: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

46

T Y I N G F U N C T I O N A L R E Q U I R E M E N T S TO S O LU T I O N S

• Deter

• Signs

• Barriers

• Presence

• Delineation

• Delay/Deny

• Barrier

• Architectural feature

• Natural feature

• Automated response

• Detect

• Interior

• Exterior

• Control

• Restricted access/egress

• Card ID

Page 47: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

47

T Y I N G F U N C T I O N A L R E Q U I R E M E N T S TO S O LU T I O N S

• Assess/Surveillance

• Human

• CCTV

• Display

• Display

• Alarms

• Transactions

• Size/Color/ Touch Flat Screen

• Monitor

• Visual/ audible

• Exception only

• Communicate

• Voice/Radio

• Hardwire

• Copper/coax/fiber

• Radio frequency

• Coordinate

• Security/safety

• Command

• Personnel

• Supervision

• Person/tech interface/console

Page 48: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

48

T Y I N G F U N C T I O N A L R E Q U I R E M E N T S TO S O LU T I O N S

• Service/Respond

• Dispatch

• Standards/Policies

• Intervene

• Response

• Procedure

• Defeat

• Automated

• Armed/unarmed

• Record

• Report(s)

• Archive/Manage

• Recover

• Contingency plan

• Instill

• Awareness

• Responsibility for asset protection

Page 49: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

49

REMEMBER…

• Functional Design Requirements communicate what a proposed solution MUST DO, Not WHAT IT IS!

• The Functional Requirements should be statements with verbs and prepositional phrases such as:

• Illuminate the parking area

• Secure the door such that only authorized personnel have the means to enter

• The collection of these requirements is referred to as the Design Basis.

• Functional requirements are critical to a sound security program.

• Functional requirements and the conceptual design provide a clear plan to effective security.

• Functional requirements is the basis of design and for negotiating incremental security measures.

Page 50: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

50

B R E A K :

- 15 minute break

- Coming up next:

- Building Level Security

- SecureTek Workshop Exercise

Page 51: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

51

B U I L D I N G L E V E L S E C U R I T Y:

D E S I G N I N G TO T H E F U N C T I O N A L

R E Q U I R E M E N T S

Page 52: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

52

B U I L D I N G L E V E L S E C U R I T Y B A S I C S

• Perimeter Protection and Standoff

• Building Structure and Wall Construction

• Door Construction

• Window Construction

• Access Restrictions

• Interior Space Security

• CBRNE Protection

Page 53: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

53

H A R D E N I N G O U R B U I L D I N G S

• Varies based on facility type/function and owner/user requirements

• Dependent on standoff distance & explosive weight

• Varies with level of protection

• Exterior components and building frame

• Building frame (includes progressive/disproportionate collapse)

• Walls & Roof

• Doors

• Windows

Page 54: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

54

P R E PA R E D

• Jakarta Embassy Bombing – Australian Embassy Undamaged because it was reinforced.

Page 55: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

55

N O T P R E PA R E D

• British Embassy severely damaged by bomb attack next door to Australian Embassy

Page 56: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

56

C L E A R Z O N E / S TA N D - O F F

Page 57: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

57

P E R I M E T E R P R O T E C T I O N

• Controlled access locations?

• Fencing (various types)

• Barriers (bollards, walls, benches, etc.)

• Active and Passive Systems

• Crash Rated vs. Non-Crash Rated Systems

• Below-ground conditions (soil conditions, utilities, etc.)

• Aesthetic requirements

Page 58: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

58

B U I L D I N G WA L L C O N S T R U C T I O N

• Walls have to be designed to withstand many types of forces

• Design considerations

• Load-bearing (structural) vs. infill (non-structural)

• Brittle vs. ductile materials

• Seismic and wind loads

• Reinforcing structural connections and anchors

• Blast resistance (internal vs. external threats)

• Bullet/ballistic resistance

• Forced entry protection

• Retrofit technologies are not appropriate for new design

Page 59: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

59

W I N D O W A N D D O O R C O N S T R U C T I O N

• Balanced design goal

• Walls have to be strong enough to handle the blast that is holding the “blast-resistant proof windows” and blast reactions from these windows.

• Anchoring into wall system

• Connection points must all be designed of equal or progressive strength.

• Pre-plan conduit to opening if required

• Type of glazing and framing

• Type of hardware

• Design for monitoring of integrity

• Retrofit technologies are not appropriate for new design

Page 60: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

60

W I N D O W S

Categories of resistance for glazing

• Forced Entry

• Blast Resistant

• Security rated

• Bullet/Ballistic Resistance

• Hurricane Rated

Page 61: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

61

C B R P R O T E C T I O N

CBR: Chemical, Biological, Radiological

Page 62: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

62

B U I L D I N G S A R E AT T R A C T I V E C B R TA R G E T S

• CBR agents can remain concentrated for long periods of time

• Mechanical and ventilation systems can effectively distribute CBR agents increasing exposure and intensifying contamination

• CBR agents can be delivered in building covertly through mail or water systems, or exterior air intakes

• Contaminants can be difficult to identify by occupants

• Buildings can be difficult to restore after a CBR attack

Page 63: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

63

G E N E R A L C B R D E S I G N S T R AT E G Y

• Prevent agents from being carried/delivered into the building through entry points

• Prevent agents released at entry and delivery points from circulating through the rest of the building

• Prevent agents released outside of the building from entering the building

Page 64: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

64

H VA C S Y S T E M S A R E V U L N E R A B L E TO AT TA C K

• Prevent easy, unobstructed access to outdoor air (OA) intakes

Page 65: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

65

H VA C C O N T R O L O P T I O N S F O R C B R

• System shutdown

• Zone pressurization

• Air purge (e.g. 100% OA if internal release)

• Specialized exhaust for some areas

• Pressurized egress routes (may already exist)

• Procedures & training incorporated into building’s emergency response plan

• Do you want to shelter in place or have people evacuate the building?

• Can the AC system be shut down in zones or entirely?

Page 66: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

66

I N T E R I O R S PA C E S E C U R I T Y

• Access control system

• Badge identification system

• Employee access control

• Visitor access control

• Perimeter doors and locks

• Key control system

• Segmentation by function

• Limit building entry points

• Video surveillance system

• Regulatory signage

• Occupant screening

• Visitor screening

• Duress Alarm

• Separation of critical spaces

• Hardening of unscreened spaces

Page 67: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

67

S E C U R E B U I L D I N G S E R V I C E S

• Mechanical and electrical spaces are critical infrastructure zones and need to be protected from unauthorized access.

• Restrict access to Telecommunication and IT rooms

• Restrict access to roof

• Control of deliveries and mail services

Page 68: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

68

I N T E R I O R S E C U R I T Y T E C H N O L O G I E S

• Sensors

• Capacitance

• Passive Infrared

• Microwave

• Photoelectric Beam

• Ultrasonic

• Vibration / Shock

• Glass Break - Audio / Shock

• Video Motion Detection

• Monitoring

Page 69: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

69

D O O R & P O R TA L C O N T R O L

• Card readers

• Electric lockset/strike

• REX sensor

• Door controller (mounted on secure side of the door)

• Intercom for communication

• Integration of multiple systems

• Fail Safe or Fail Secure

Page 70: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

70

D O O R & P O R TA L H I G H S E C U R I T Y

• Biometrics • Anti-tailgating systems

Page 71: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

71

E G R E S S D O O R S

• Emergency exit doors – All facilities shall secure emergency exit doors using an automatic door closer and exit hardware that are complaint with applicable life safety codes and standards.

• Delayed Egress - In low security facilities no special measures are required, but for high security facilities they should use delayed egress hardware at emergency exits from critical or sensitive areas, if fire code allows.

Page 72: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

72

I N T E G R AT E D S Y S T E M S

• Physical security merged with camera, intercom and access control.

Page 73: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

73

SEC U R ETEK

Security Program Development

Page 74: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

74

S E C U R E T E K B U S I N E S S P R O F I L E

• SecureTek is an incredibly successful and highly profitable technology-based firm that has been the darling of Wall Street since it went public eight years ago. Its annual sales for the most recent year was in the neighborhood of $1.5 billion owing to its acknowledged edge in communications and laser technology. It currently employs over 1,200 people worldwide with about 550 at this headquarters location. SecureTek sells its products to major multi-national corporations and a variety of related high-tech firms with which it collaborates on integrated projects.

Page 75: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

75

B U S I N E S S P R O F I L EW H Y D I D T H E Y H I R E A C O N S U LTA N T ?

• The firm has just learned that a senior-level engineer (who was one of the founding employees along with the CEO) has defected to a French firm with virtually all of SecureTek’s R&D on a leading edge project (Project 2020)

• Board has directed that the Headquarters facility is to be effectively secured and a capability to audit access and egress to various “secure areas” should be installed.

• Money is not an issue.

• Committee reporting to the Chairman has been established to fast track a design/build security program to implement the requisite security program

Page 76: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

76

S I T E D E S C R I P T I O N

• Site is located on 100 acres

• Perimeter of the site is adjacent to a public housing project noted by local police for drug trafficking, domestic violence, and periodic crimes of violence

• No access control to the perimeter of any type, and lighting is minimal in parking areas and walkways

• Day care facility on the first floor, a fitness room in the basement and a cafeteria on the second floor

• SecureTek has been selected by the Department of Defense to provide the Government with Top Secret communications and laser technology that will be used to hunt down Terrorist Operations throughout the world

Page 77: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

77

S I T E P L A N

Page 78: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

78

F I R S T F L O O R

Page 79: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

79

S E C O N D F L O O R

Page 80: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

80

T H I R D F L O O R

Page 81: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

81

R I S K A S S E S S M E N T

• Identify Assets

• Define and List Threats

• Define and List Vulnerabilities

• Establish Level of Protection

Page 82: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

82

Assets Threats Vulnerabilities Level of Protection

Page 83: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

83

Assets Threats Vulnerabilities Level of Protection

Government DoD contractsStaff leaving firm with TS information

Employee protection;Employee moral

High

R&D for high tech equipmentStolen equipment;Stolen TS plans

Mixed use facility – difficult to control access;Limited access control use

High

Executive Level StaffCoerce/bribery;Abduction/ransom

No ExecProtection plan in place;Executives travel internationally with unsecured laptops

High

Day Care FacilityChild abduction;Brute force attack

Limited access control;Ground level access

Low

Building

Brute force attack;Local Neighborhood;Natural events (weather, earthquake)

Limited access control;Poor perimeter lighting;No defined perimeter boundary

Medium

Big Bucks BankRobbery;Brute force attack;Tenant within the building

Attacks additional threat actors to the site

High

Page 84: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

84

F U N C T I O N A L R E Q U I R E M E N T S

Page 85: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

85

F U N C T I O N A L R E Q U I R E M E N T S

• Provide method to control access to the facility.

• Create a defined and monitored site perimeter.

• Restrict access to areas where Top Secret documents are stored/viewed.

• Identify and account for all individuals within the SecureTek spaces

Page 86: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

86

S E C U R I T Y S Y S T E M S O LU T I O N S

Page 87: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

87

S E C U R I T Y S Y S T E M S O LU T I O N S

• Access Control System

• Video Surveillance System

• Turnstiles

• LED Site Lighting

• Perimeter Fencing with security signage

• Visitor Management System

Page 88: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

88

Functional Requirement System Solution

Page 89: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

89

Functional Requirement System Solution

Control access & secure facility Access Control System with Biometrics;Vehicle Gate Control System

Identify and account for all individuals within the SecureTekspaces

Access Control System with Biometrics; Turnstiles in the Building Lobby;Visitor Management System;Elevator Controls

Create a defined and monitored site perimeter

Perimeter fence; Shrubs with clear zone from the fence;PIDS along the perimeter;Cameras along the fence line;Bollards in front of building entry doors

Page 90: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

90

S O H O W D O E S T H I S A L L C O M E TO G E T H E R ?

Risk Assessment Functional Requirement Security System Solution

Page 91: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

91

Risk Assessment Functional Requirement

Security System Solution

Mixed use facility –difficult to control access;Limited access control use

Control access to the facility;Identify and account for all individuals within the SecureTekspaces

Access Control System with Biometrics; Turnstiles in the Building Lobby;Visitor Management System;Elevator ControlsVehicle Gate Control System

Employee protection;Employee moral

Control access & secure facility

PIDS along the perimeter;Cameras along the fence line;Bollards in front of building entry doors

Page 92: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

92

Page 93: FACILITY SECURITY DESIGN FROM CONCEPTION …€¦ · ... (one goal is to minimize these ... • ASIS General Security Risk Assessment Guidelines 2012 ... DoD Minimum Anti-terrorism

93

S E C U R I T Y A R C H I T E C T U R A L A N D E N G I N E E R I N G C O U N C I L I N F O R M AT I O N

• Serves as a resource to ASIS members, other individuals, and agencies on security architecture, engineering, and technical integration design issues related to protection of assets within the built environment.

• Membership information – Edward Layo –[email protected]