• 27Nov

    Is It Time for Real Security in Our Schools? Part 2

    Access Control, Alarms, General No Comments

    Access Control Systems can do much more than just control access to our schools. Side benefits include: 

    1) Keeping Attendance automatically (each time the student’s card is used the time and place it was used is recorded) 

    2) Serve as positive photo identification - replacing student ID Cards 

    3) Lock and unlock schools buildings and classrooms automatically on schedule 

    4) Disarm and arm alarm systems automatically and when authorized cards are used- eliminating false alarms and the subsequent fees- which in some districts could pay for the system alone.    

     

  • 22Nov

    Law Enforcement and Amateur Video

    CCTV, Digital Video, General No Comments

    The recent and seemingly continual spate of incidents revolving around the “public’s” video recording of law enforcement actions would seem a major problem for law enforcement officials.

    While undoubtedly some of these incidents are beyond policy and outrageous, it would also appear many may be staged either for publicity or to set up cause for legal action. Indeed, the UCLA incident where an Iranian student was tazered because he refused to present ID and leave the library has some earmarks of a possible setup due to the fact that UCLA police regularly checked everyone’s ID after 11pm.

    Maybe the most effective way for law enforcement to combat these video recordings is to simply record themselves. The new solid state video camcorders could easily be deployed to police, security, and law enforcement. When the police came upon a potentially unusual situation they would then record it from the beginning.

    Once this procedure is common knowledge, and the law enforcement video showed the entire story, it would probably have the effect of negating amateur video and ensuing publicity while simultaneously keeping law enforcement actions within policy.

  • 21Nov

    Is It Time for Real Security in Our Schools? Part 1

    Access Control, General No Comments

    The only practical way to secure our schools is with electronic access control. The very same technology that has been used in commercial building for years can have a significant positive impact on school safety. By securing all school entrances and controlling them via electronic “key” cards issued to students and teachers, we can instantly deny access by pedophiles, mentally unstable thrill seekers, kidnappers, and estranged parents who wish to kidnap their own children. 

    Suspended and expelled students can be immediately deactivated from card access systems – without having their physical card- and thereby denied return access into school buildings.  Part 2- Other uses for card access in schools. 

  • 16Nov

    Bank Security Q&A

    Alarms, General No Comments

    Exclusive Q&A: National City’s CSO Gareth Webley on Protecting Today’s Bank How the U.S.’s eighth largest bank is solving modern challenges and converging security 

    http://www.securityinfowatch.com/online/The-Latest/Exclusive-Q-and-A–National-Citys-CSO-Gareth-Webley-on-Protecting-Todays-Bank/9898SIW306 

    Geoff Kohl, editor
    SecurityInfoWatch.com  SecurityInfoWatch.com recently caught up with Gareth Webley, the CSO for National City, the eight largest financial services company in the U.S. As Webley puts it, “We’re the biggest bank you’ve never heard of.” National City has close to 1,600 branches in eight states, and with its brokerage and mortgage divisions, the company has a virtual national presence, despite the fact that the Ohio-based bank is still somewhat regional in focus. 

    SIW: It seems that when we go through the risks you mention - network attacks, phishing attacks, robberies, life-safety of employees - they still silo out to either network security or physical security. Is that the case, or can you treat the risk group areas in a converged manner? We are actually in the process of designing and building a new command center where we will treat alarms or alerts from both worlds in the same way. There will be a security operator in our security command center which will be manned 24/7. They will be looking at alerts from burglar alarms, robbery, and tuned things coming off our networks IDS’s. It will also be making sure that those IP-enabled security devices (alarm panels, DVRs) are network accessible. 

    We now view it as an even more critical need. We believe that if we’ve got an alarm panel out there, it needs to be able to communicate through the network. We’ll also have a redundant dial system. We’re starting to see more and more devices that are IP enabled. For example, if you have a door lock that is controlled by IP traffic, and someone is able to spoof that contact or cause that device through an electronic hack to open, or at the same time interrupt a video service, then someone could perhaps pick that lock, and gain access to the facility. We’re really starting to see that as more security devices get IP enabled, attacks against organizations are going to start to converge as well. Some of the romanticized views of crimes in the movies are actually going to become more real as people get more sophisticated. We’ve also seen a shift from network attacks done by what we call “strip kitties” (people just doing it for the glory) to it being backed by organized crime. And eventually, I think those investments by organized crime are going to be made and they’ll have skills to attack network controls and network security devices as well as the old brute force through the door. 

    SIW: This is a very progressive idea, this idea of the converged command center. You’ll have alerts coming in on intrusion alarms, alerts on network attacks, and maybe they’ll have different priorities, but they’ll be coming into one view. Can you tell us more about how this will operate? Our command center will be monitored 24/7. Our geeks that monitor our firewalls, phishing alerts and all those sorts of things typically work during the day. They need to go home at night. So a lot of these alerts would be set to go to pagers or e-mail queues, and there pagers are going off so much that they tend to get desensitized to that. So for us, it’s important to have a security officer that we can train to look at these alerts and ask, “Should I get the firewall engineer out of bed?” So we’re thinking very hard about that so we can have work flows and queues that they can set up to be reviewed by a subject matter expert the next day if they feel this is a medium priority. But having someone who can watch the trending happen is a tremendous benefit, and it’s a better use of the resources. 

    It’s very exciting to think through and design it. And hopefully by the end of 2007 we will have it up and running, at least in its pilot stages. 

  • 13Nov

    HIPAA Physical Safeguards

    Access Control, General No Comments

    The Security Rule defines physical safeguards as “physical measures,  policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment, from natural  and environmental hazards, and unauthorized intrusion.” The standards are another line of defense (adding to the Security Rule’s administrative  and technical safeguards) for protecting EPHI. 

    􀀹 Are procedures developed and implemented to control and validate a person’s access to facilities based on their role or function, including visitor control,  and control of access to software programs for testing and revision? 

    􀀹 Do the procedures identify the methods for controlling and validating an employee’s access to facilities, such as the use of guards, identification  badges, or entry devices such as key cards? 

    􀀹 Do the procedures also identify visitor controls, such as requiring them to sign in, wear visitor badges and be escorted by an authorized person? 

    􀀹 Do the procedures identify individuals, roles or job functions that are  authorized to access software programs for the purpose of testing and revision in order to reduce errors? 

    􀀹 Does management regularly review the lists of individuals with physical  access to sensitive facilities?  

  • 09Nov

    Sarbanes-Oxley

    Access Control, Alarms, CCTV, Digital Video, General No Comments

    QUESTION: 

    What elements of a corporate physical security program would fall under Sarbanes-Oxley? For example, does Sarbanes-Oxley require certain levels of physical security controls in a data center or similar facility? If yes, under what section does this reference fall? 

     

    ANSWER : 

    Physical security does fall under the Sarbanes-Oxley requirements. It is a critical component of the infosec program as well as general computer controls. It falls within sections 302 and 404, which require that management evaluate and assert that the internal controls are operating effectively. 

     

    Fiona Williams, who is responsible for Deloitte & Touche’s security services practice for North America, answers questions about the Sarbanes-Oxley Act.

  • 08Nov

    School Security and Access Control

    Access Control No Comments

    Protecting Schools with Advanced Access Control Systems
    How to understand the needs of your school and secure it with advanced technology

    Beverly Vigue, VP, IR Education Solutions Special to
    SecurityInfoWatch.com
    Today, locks and keys alone aren’t enough to keep a school’s perimeter secure against unwanted or uncontrolled visitors. From problems with non-custodial parents in a grade school to unauthorized residence hall guests on a college campus, controlling access with greater certainty is the first line of defense to keep a facility secure.
    Schools and colleges of all types and sizes are becoming more aware of the security risks posed by unauthorized access and are taking proactive steps to prevent a broad range of potentially threatening or dangerous incidents.
    In the K-12 field alone, each of the more than 100,000 public and private schools may have between eight and 20 doors that require perimeter security.

    http://www.simon-net.com/index.jsp

    http://www.lulu.com/content/479272
     

  • 05Nov

    Alarm Monitoring

    Alarms No Comments

    Once the intrusion system is installed it is usually monitored by some outside party. While you could simply just sound a siren or ring a bell upon an alarm, it is pretty clear this wouldn’t accomplish much unless you have neighbors that are present 24 hours a day and willing to call the police. The police themselves almost never accept alarms directly, so the only alternative is to contract with a central monitoring station. Usually, the alarm company that installs and services your alarm will monitor it. In some cases they may contract it out to a third party. 

      

    In any case, the monitoring company is obviously critically important. Your security ultimately depends on their action or inaction. When an alarm is received at the central station, an operator must interpret it and take the appropriate action- such as notifying the police.

    http://www.lulu.com/content/479272

  • 02Nov

    Loss Prevention Techniques

    Access Control, Alarms, CCTV, Digital Video, General No Comments

    POS Exception monitoring systems can help reduce employee theft and shrink which can account for 87% of business loss!

    For more information check out our guide to security and loss prevention

    http://www.lulu.com/content/479272

  • 02Nov

    Employee Theft 2006

    CCTV, Digital Video, General No Comments

    “As Shoplifters Use High-Tech Scams, Retail Losses Rise”
    Wall Street Journal (10/25/06) P. A1 ; Zimmerman, Ann 

    Retail crime has become much more sophisticated as criminals take advantage of new technology that enables them to scam retailers for long periods of time before being caught. For example, one thief used counterfeit bar codes to methodically steal $600,000 worth of pricey Lego toy sets from dozens of retailers in no fewer than five states. The counterfeit bar codes enabled the thief to purchase $100 toy sets for as little as $19; the thief then sold the toy sets to toy collectors on the Internet. Employee theft accounts for 48 percent of retail crime, according to a 2005 University of Florida study, but sophisticated professional thieves also account for a large percentage of retail losses. Several years ago, theft rings were targeting items like baby formula and teeth whiteners, but these thieves are now using more sophisticated methods to target $1,000 plasma TVs, $400 power saws, and $300 Dyson vacuum cleaners. One theft ring stole $100,000 of merchandise by using a computer to scan bar codes of inexpensive items, print copies of the bar codes, and place the copies onto higher-priced items. Unless cashiers notice that something is wrong, they will ring the merchandise up at the lower price, but retailers like Target are trying to stop barcode scams by examining sales reports for unusual trends and patterns. When an unusual trend like Lego sets being sold at discount prices is discovered, loss investigators can then examine store surveillance tapes and deploy a security system that alerts in-store workers when Lego sets are sold. Thieves are being enabled by software available on the Internet, such as the $25 Barcode Magic program. 

« Previous Entries