By Luann Edwards

Security professionals: You might not realize this, but you have a superpower. It helps you predict the future, enhance physical security, and generate return on investment. It’s your data, and with it you can demonstrate and deliver measurable value for your organization.

At GSX+ on Wednesday 23 September, Louis Boulgarides of Ollivier Corporation and Jonathan Moore of AMAG Technology presented The real story of how analytics affect physical security. This session looked at security systems data, the capabilities of new analytics technology, and how insights from these can deliver organizational ROI. (If you missed the session, you can watch it on demand here until December 31^st.)

“Data analytics take sources from multiple systems in the organization and analyzes behavior and other trends to yield important information.”

Moore set the stage by outlining the sources of data that exist within the security function:  access control, video surveillance, alarm management, and incident management systems are just a few. Analytics have grown increasingly sophisticated in this space. They give today’s security professional the ability to analyze the past, predict the future, and help you identify ways to solve problems you might not have realized even existed.

“Security tech is helping educate the larger business on how to analyze and become more proactive for better decision making,” shared Kristin Lennardson, protective intelligence programs with the Association of International Risk Intelligence Professionals.

As I attended this session, two important themes became clear: Security systems data can paint a complete picture that benefits the entire organization. And, it is critical that you build relationships with leaders across departments to understand their needs and challenges to identify where your own data can help.

Consider this hypothetical scenario: You’re in a Zoom meeting with your counterparts from across the organization, and you note that more employees are entering your building each week per data from your building access system. Your facilities management team takes this information to identify where they need to increase cleaning protocols in high-traffic areas due to COVID-19. Your IT colleagues can factor this in as they ensure that their cyber security efforts and connectivity levels align with the number of remote workers versus those in-house. And if an employee is accessing the building at times that are outside of his normal routine, it might give human resources an indication that he’s considering leaving the company. One data insight, multiple applications.

Not surprisingly, the information that your colleagues can share with you can inform your own program. With strong relationships and communication across departments, you can understand your colleagues’ unique challenges and motivations and create real value through aggregated data. This shift changes the view of the security function from one of overhead to that of a strategic partner. The speakers outlined the likely needs of key players in an organization to help you visualize how this collaboration might look.

One of the greatest opportunities for security technology and data is presented through this “new normal” of COVID-19, as Boulgarides explained. Security professionals are now creating “security, safety and health programs – the scope has broadened a great deal.”

Social distancing, monitoring the number of people in a location, contact tracing, and assessing mask-wearing compliance tend to be manual tasks, but those with the technology in place will be able to automate some of those activities. Think about a turnstyle or an access control system that can also count how many people enter or exit.

“Security is still viewed as a grudge purchase, especially in the economic times like we find ourselves in now.” Edward Baes, head of security consulting at BUROHAPPOLD, shared with ASIS recently.

When security systems provide data that saves an organization money and automates processes in addition to its security objectives, the value is right there in the analytics.

Luann Edwards is a social media marketing consultant and blogger. She is the founder of Socially Professional, a social media marketing consultancy, based in Providence, Rhode Island, USA.

by Randall Rosenbaum, Executive Director, Rhode Island State Council on the Arts

I’m the director of the Rhode Island State Council on the Arts, and as such, the director of public art for the State of Rhode Island. In September, I “attended” a Global Security Exchange Plus (GSX+) virtual presentation by Art Hushen, the President of the National Institute of Crime Prevention in Tampa, FL. Art was going to talk about “Corporate and Public Art as a CPTED Strategy”.

Since my degree is in music education I had to first discover what CPTED stood for, what it meant, and how public art applied to Crime Prevention Through Environmental Design.

Art did a masterful job connecting the dots for me as an arts professional and advocate for public art in our community. We advocate for public art as a way to enhance and enliven a community, and so does Art. What Art adds to the conversation are all the arguments that we should be using in convincing people to support the inclusion of art – in all its forms – into and around their buildings and communities. As budgets grow tighter, the resistance to art increases. The added benefits of art, as explained by Mr. Hushen, may help those who don’t entirely “get” art, and may not be enthusiastic about spending money from their budget to commission work.

I understand the concept of “Territorial Reinforcement” (although never by that name), and how art can and should be a reflection of the community in which it resides. I never in a million years would have thought about “Natural Surveillance” as a benefit of public art, and the way that art, strategically placed, can help focus people’s attention so that it focuses attention – even of passersby – and helps promote a safe environment.

I was particularly taken with Art’s examples of work that helps extend the footprint and designate entrances to buildings (“Celebrated Entryways” and “Focal Points”) while at the same time promoting a safe and secure environment. And his examples of the placement of human-like sculptural pieces and murals that mimic an apartment house façade with people looking out the windows, all designed to discourage “bad behavior” from unruly folks, was particularly enlightening. It made me long for statistics that measure the decline in police activity around areas where such artwork is located.

I came away from Art’s presentation with a new vocabulary to use in my work, one borrowed from a field that is highly respected and different from the fields in which I operate. I can’t wait to employ this language in my next meeting with a potential public art client.

Much has been made of generational differences and their effects on the workplace. Few generations have not found fault with those who came before or followed after, but the acceleration of technology and services has forced many organizations to contend quickly with the need to recruit and retain a digital native workforce. Security is no exception.

Here, Security Management connected with Angela J. Osborne, PCI, PSP, regional director for Guidepost Solutions and an advisor to the ASIS Young Professionals Community, to discuss multigenerational management and how recruiting a diverse workforce can benefit security departments and organizations—as well as some pitfalls to avoid.

Want to learn more about this issue? Hear more from Osborne, plus Jairo Borja and Michael Brzozowski, in their session How to Recruit and Retain Gen Z in Security Organizations on Monday, 21 September, at GSX+.

Security Management. How does having multigenerational talent—Generation Z in particular—bring value to an organization?

Angela Osborne. Having multigenerational talent in security departments is highly useful as we bring distinct perspectives based on our shared experiences as members of different generations. Our baby boomer colleagues often bring institutional memory, experience in working in the field, and an understanding in how to get things done within an organization.  These individuals often know where the landmines are placed and the past interactions with different departments and stakeholders.

Gen X is a bridge between baby boomers and millennials, and GenXers often have the ability to translate baby boomer expectations and explain the rationale behind the department’s structure, the method of working, and the means to navigate the entity.

For millennials, they bring a diversity of live experience, savviness with technology, and understanding of perceptions on how security guidance can be understood by millennials and Generation Z colleagues. Gen Z, in particular, is known for its openness, focus on practicality and fiscal responsibility, and digital nativism.

A strong team will focus on having representatives across these groups due to the fact that our organizations and client bases are made up of these different groups.  In security, much of our work is on training and awareness, gaining compliance on security protocols, and achieving buy-in to security culture. We need to present guidance and plans for our organizations by considering these distinct groups, keeping in mind that people are individuals, and we cannot assume things about people solely based on their generational range as well.

Security Management. What strategies have you seen succeed in attracting and retaining multigenerational talent?

Angela Osborne. Often in the security field, recruitment takes place based on people’s professional networks, as our work focuses on trust and integrity. The challenge with this is that we are limiting ourselves to our own pool of contacts. We will tend to attract people like ourselves with similar backgrounds and life experiences. Here are three best strategies that I have seen:

• Reach out to college and university career centers. Universities often have career posting pages to allow potential employers to promote new positions for recent graduates.
• Consider engaging interns. It is important to reach out to Gen Z early for internships as well. From personal experience, I joined the Archer Daniels Midland Corporate security team as an intern when I was in college.  It had a tremendous impact on my life.  Prior to this, I did not realize the diverse careers in private sector security.  We have to get the word out about the careers in our sector to attract key talent.  We want to identify people early in their careers.
• Engage the ASIS Communities and LinkedIn. I recommend reaching out to the ASIS Young Professionals Community leadership and posting about positions in Communities and on LinkedIn.
• Connect with high performers and ask for recommendations. It is a good idea to talk with high performers from the security department and from other departments to identify potential candidates.
• Place new joiners with supportive managers. The next recommendation is to match up the new joiner with a supportive manager. Studies show that people, particularly Gen Y and Gen Z, leave jobs because of bad managers. This is a critical element, and a check-in process must take place with both the manager and the new employee.

Security Management. How can a security leader successfully manage someone transitioning into or beginning their career in security?  

Angela Osborne. First and foremost, it is important to be clear about expectations. People transitioning into this field need to know what is expected of them, and I try to put these expectations in very clear terms for people.

The next step that goes hand-in-hand with clear expectations is to communicate continually, and don’t assume people will interpret your tasks and direction in the way that you would. We have to maintain open lines of communication, so if people have questions, we can address them early on in the process. The communication should take the form of phone calls or virtual meetings, email, and messaging to cover the bases.

As an example, when I first joined TAQA in the UAE, I reported to a manager based in The Netherlands. Our communication was all virtual for my first summer. This person was very engaged in ISO terminology and put everything in terms of ISO. He asked me to submit a deliverable plan. I submitted a list of goals in the SMART format in order to meet this requirement. We had a very circular conversation after this list, and I realized that we were not speaking the same language. He was looking for me to put my content in MS Project and to use ISO terminology. Once we clarified the terminology, we were able to work together in a more productive manner.

We also have to recognize that among generations we are likely to see things differently based on our life experiences. We should be able to express ourselves but to be mindful that not everyone will agree with us and some topics are not appropriate or productive for the workplace. I encourage teams to avoid discussing politics, religion, and controversial topics in the workplace. We should focus on our entity and department values and use these to guide our interactions. Our societies have a number of exceedingly divisive issues, but our teams must be able to function effectively without alienating people. This is why training and awareness on diversity and inclusion is needed.

We also cannot make assumptions that people joining an entity for the first time or joining a security department for the first time have the same understanding of ethical responsibilities—for instance reporting improprieties. We must stress the importance of acting in ethical manners and reporting concerns, and this should be communicated not just to full-time employees but also contractors and part-time employees. Security departments depend on their reputations, and the team members must hold each other to a higher standard to maintain stakeholder trust.

By Scott Briscoe

We’ll call him the prescient Mr. Gundry. In an article for Security Management’s Security Technology supplement entitled Building the Control Room of Tomorrow, Dan Gundry wrote: “Enterprise organizations relay on their SOC [Security Operations Center] for business operations. In times of an emergency, and as risks become more severe, a complete situational picture is necessary.”

Gundry is director of national control room sales at Vistacom, and he will be speaking on a panel at GSX+ on Monday, 21 September on The GSOC of the Future: What’s Next?

If ever there was a time of heightened emergency and severe risk for global organizations, 2020 defines it, giving organizations with high-functioning global security operations centers, or GSOCs, a chance to shine. Asurion, a leading provider of insurance, warranty, and support services for electronics, has offices on five continents. The company was featured in a write-up in the Nashville Business Journal early on in the pandemic. Very early on, as in 6 March. In the article, Kevin Wilson, senior director of global security for Asurion, is quoted: “Our differentiator is we have these security operation centers on both sides of the world that covers this on a 24-hour basis that gives us a level of awareness some might not have. Adhering to guidelines so that you don’t underreact or overreact has been key.” As was the information backbone that was able to be mined because the company had established SOCs and used them in their risk mitigation strategies.

Wilson is one of the panelists in the GSX+ discussion, along with Rob Hile, general manager at GC&E Systems in Florida, and Ryan Schonfeld, founder and CEO of RAS Watch.

For even more on operations center and the pandemic, and because you can never add too many letters to existing acronyms, be sure check out this article on Microsoft’s VGSOC (the “V” is for virtual), now COVID-19 tested and approved.

By Scott Briscoe

There’s only so much time security managers can devote to planning for the future as they ensure the present risk, safety, and security needs are being addressed. That time likely dwindled significantly as the COVID-19 pandemic unfolded.

Despite the near-term need to deal with organizational changes brought on by the pandemic, there remains a need for security managers to consider how their organizational environment is changing, and how that will affect risk management and security. Security Management recently caught up with David Feeney, CPP, CISSP, PMP, to discuss emerging trends affecting the security sector.

Feeney is a Deloitte risk and financial advisory manager in cyber and strategic risk. Feeney serves on the ASIS Standards & Guidelines Commission and has previously chaired the ASIS Physical Security Community and the ASIS ESRM Guideline Committee. He will also be leading a The New NIST Privacy Framework session at GSX+ on Thursday, 24 September. A recap of our trends conversation is below.

Foresight and Preparation

Security professionals should ask themselves which type of security professional they want to be:

• The reactive type: The person who waits until her or she is asked about something new only to then scramble to get an answer for use in later follow-up. (Don’t be this person!)
• The prepared type: The person who is ready with an answer before an inevitable question is asked about something new. (Better.)
• The proactive type: The person who learns something new and brings it to stakeholders before questions are ever asked. (Bingo!)

The sooner security professionals learn about emerging trends, the further along that spectrum they can operate and the more value they can bring to their stakeholders.

1. Automation

One emerging trend is the next generation of automation, which includes robotic process automation, artificial intelligence, and machine learning. It is important for security professionals to understand these concepts and how they differ because each provides significant security value if used properly.

• Robotic process automation (RPA) is basic automation that repeats a scripted process. It is ideal for repetitive processes that require no logic or decision making, but involve the same multi-step process being repeated cyclically. RPA adds value when it essentially scripts labor-intensive, repetitious processes to enable security professionals to use their time for more strategic efforts. Think “enter URL, scroll down, click button, click another button, close page, and repeat” – over and over. Such processes are ripe for RPA.
• Artificial intelligence (AI) adds logic. It is “smarter” than RPA in that it relies on logic to determine next steps. Unlike RPA, AI does involve decision making based on that logic. Also unlike RPA, there is more than one possible series of tasks to be completed. It is the logic that determines those tasks.
• Machine learning (ML) adds the ability to learn. It is an even “smarter” type of AI that enables its logic to evolve based on lessons that it essentially “learns” through experience.

All three of these tools provide value by allowing security professionals to spend more time on cognitive work of strategic value to the organization. The further along the RPA-to-ML spectrum an organization goes, the more tasks it can automate, and the more human talent is made available for other work.

2. Data Privacy and Protection

Another emerging trend that security professionals should understand—yes, even physical security folks—is data privacy and protection. There are many aspects to this, but one that has dominated headlines is protection of personally identifiable information (PII). The rapid increase in number and severity of private and public sector data breaches has given rise to a rapid increase in data privacy laws from various global regions, countries, and states. The European Union’s General Data Protection Regulation (GDPR) and the U.S. California Consumer Privacy Act (CCPA) may be among the most well-known, but other laws and regulations are affecting how organizations host consumer and other data. As new ones hit the books, the complexity of reconciling sometimes conflicting guidance only increases.

To try and offset that complexity, the U.S. National Institute of Standards and Technology (NIST) has released its Privacy Framework this year. The framework helps an organization document its current privacy risk posture and identify a path to its desired future state through a gap analysis and roadmap creation. It doesn’t directly provide an understanding of privacy laws, but it does map out what a comprehensive data privacy and protection should include.

Finally, facial recognition software has recently been put under the microscope due to concerns with privacy. While we may sometimes think that security and privacy are always complementary, they can be at odds with each other. Balancing these will become a narrower path as time goes on and privacy incidents continue to increase.

3. Security Convergence

One other trend that is continuing to emerge is security convergence. Specifically, two specific changes are gaining popularity:

1. Integrating physical access control systems with security incident and event management (SIEM) systems. SIEMs act as central hubs to many integrated subsystems, though these subsystems have traditionally been other cyber systems. In recent months and years things have changed, most recently the integration of physical access control data. Part of the credit for the increase in popularity is disruption caused by the COVID-19 pandemic, as access control data gives cyber analysts an indication of how many people are walking through specific areas. Pairing this data with other data sets from Wi-Fi access points and other sources can help identify overcrowded in-person gatherings or physical locations.
2. Reorganizing security silos so that the CSO/physical security lead reports to the CISO/information security lead. While a role reversal from what some of our tenured security folks may have experienced shortly after 9/11, this organizational alignment of physical and cybersecurity under information security has been making sense for an increasing number of organizations lately. If your organization follows this path, it will be important to understand the priorities, strategy, and language of both physical and cyber security.

By Steven Reinharz and Mark Folmer, CPP

Innovation should be viewed as the application of better solutions that meet new requirements, unarticulated needs, or existing market needs.

Put simply, innovators win. Innovators provide superior solutions at greater value than their competitors, and they manage an organization’s risk better. On both the security officer side and the integration side of the security service industry, there are many pain points, everything from pricing and compliance stress to staff engagement headaches and low perceived added value. To innovators, pain points are opportunities.

The best way to innovate in the sector is by asking 3 questions as you consider the assets that are being protected.

1. Can the function be automated? Evaluate if a standalone device could do the initial assessment and sort between issues and nonissues?
2. Can it be remote? Be sure to challenge yourself when answering this question! If we learned anything from the current pandemic, with predetermined workflows, much triage can be based offsite.
3. What else can the service do and how should it get done? Consider the delivery of the service, making it nonconfrontational, unbiased, and scalable.

Try something new. You may be able to provide superior value to your organisation. Automation will put your security team on the map, optimize your resource deployment and do so efficiently.

Steven Reinharz is the founder and CEO of Robotic Assistance Devices, and Mark Folmer, CPP, is vice president, security and industry. Folmer will be leading a GSX+ session on Tuesday, 22 September on How Top Technologies that Enabled Digital Transformation Affect Security.