Sunday, July 6, 2008

Update - Security News and Views

A plague of breaches Can security breaches be blocked with methods used to fight human plagues? Investment banker Andrew Stewart and Microsoft strategist Adam Shostack, writing in Information Week this month, suggest as much in their lengthy joint essay: The Case for Disclosing Security Breach Data Calling the jury Think you are anonymous when you sit in judgment on a jury? Think again. Ken Ritter of the Associated Press reports that an employee of a printer in Las Vegas, working on mailing jury summons copied names, social security numbers, and addresses of potential jurors into a personal e-mail file and kept it there until it was discovered by the owner. Still under investigation ...

Tom Goff

Saturday, July 5, 2008

Surveillance Cameras - When is a good idea mandatory?

Security management advisers frequently get asked about the relative merits of one protective strategy over another. Some clients even can't resist asking for detailed, technical advice, perhaps seeking validation for money already spent than for actual insight to inform a decision. Now, it seems one ambitious local politician is offering to relieve both security advisers and their retail clients of the burden of making that kind of decision -- at least for Broward County.

Here is the story: Miami Herald: Security Camera Mandate?

The county commissioner proposing this requirement faced an understandable degree of frustration. Had there been protective lighting and surveillance camera coverage of a parking lot where a sheriff's sergeant was shot, the crime could have been deterred. If not, then the camera footage could have assisted with bringing the shooter to justice. But is a mandate the right way to go?

No. Once public officials start dictating intallation of security devices to business owners, it won't be long before they also start telling them how long to keep the video and what kind of coverage to have. Next will follow orders on what to buy and from which vendor. This is a recipe for trading one disaster for another. Why? Apart from the almost inevitable invitation for abuse whereby a politician can't resist steering business to any vendor other than his idiot nephew who can't otherwise find work, there are other problems as well. Who decides what represents enough and proper video coverage? I have seen camera deployments where the sales executives won their Hawaiian vacations by selling a naive customer legions of cameras placed to look at each other more than at site vulnerabilities and operating on a perpetual scan pattern, known as an automated tour. The only purpose of this tour was to wear out the camera motor in 90 days, in order to force the customer to face maintenance charges. But wait, there is more.

Security cameras need a well conceived design to contribute meaningfully to the protection of people and assets. Otherwise, they generate unnecessary liability, giving people within their field of view a false impression of protection. At the very least there has to be an up front decision about whether a camera is there to prevent undesirable activity or only to assist in post-event incident investigations. If prevention is the goal, then there must be some kind of response tied in with it, whether a person monitoring the camera view in a control room or smart technology, including dual sensors and annunciators, that alert a response force or initiate some kind of protective action upon detecting a threat.

Before the good commissioner rushes to compel retail shopkeepers to install cameras in parking lots, he owes it to himself and his constituents to think the matter through a little more. Will he or the county defend the shopkeeper sued by crime victims who claim they never would have been in the area at night but for the security cameras which made them think someone was actively looking out for them? Hardly, or at least nor more than once. Nor will the county want to get in the business of telling the skateboard shop owner that his Radio Shack camera is inferior to the one of the Target Store across the street. (It will be, of course, as Target takes security cameras very seriously. But that is beside the point for this illustration.) Does the county want to subsidize the smaller businessman to bring his security video cameras up to the capability of a larger corporate neighbor? Again, there is only a one-case learning curve for this kind of challenge.

So what makes security cameras viable in the absence of a mandate? The same thing that turned electric lighting and telephones from a luxury into a necessity. They must prove their worth in an old-fashioned business case. When the business owner can clearly see that it costs more to do without them than to incorporate security cameras into part of a larger asset protection program, then and only then is the case made better than in any mandate.

And what can Broward County do in the meanwhile? Tread lightly and avoid any hasty mandates that will deplete county coffers through lawsuits.

- Nick Catrantzos