Insight
3 Simple Ways to Harden Soft Targets
Dr. Jennifer Hesterman, Colonel, US Air Force (retired) is security consultant to ABS Group. She is a counterterrorism and target hardening expert. With more than 36 years of experience in national and homeland security, Dr. Hesterman helps public locations and events identify and lessen their vulnerability to violent attack. She authored “Soft Target Hardening: Protecting People from Attack,” the ASIS Security Industry Book of the Year for 2019.
Security is growing in complexity with the ongoing implementation of biometrics, sophisticated artificial intelligence, robots and drones. In his 1999 essay A Plea for Simplicity, renowned security expert Bruce Schneier warned “complexity is the worst enemy of security” and predicted that as systems grew more complex, security would deteriorate. His foresight was accurate; complexity is now viewed as an increasing risk factor in security programs, as leaders struggle to manage a growing portfolio of technical tools and services for both physical and cybersecurity.
Companies with a mature security posture master not only the complex, but simple components of security. These “101” elements can make or break our efforts to protect people, buildings and operations. Let’s investigate three straightforward and inexpensive ways to immediately raise the security posture of organizations of any mission or size.
1- Signage and Security
One of the first things visitors (and bad actors) see when they visit your property is signage. Signs are communication tools, so be purposeful with their placement and message.
Remove unnecessary signage to “lower the heat.” When living and traveling in the Middle East for two years, I noticed a general absence of signage around public spaces like hospitals, schools and hotels. Conversely, the U.S. has a proliferation of unnecessary signage, sometimes providing the vulnerability “bull’s eye” for nefarious actors. For instance, some school campuses have signs on the kindergarten and elementary school building - the places with the most vulnerable population. Inside office buildings, signage needlessly guides employees to conference rooms and the cafeteria. In hospitals, signs point to Intensive Care and the nursery.
Occasionally, businesses, schools and churches use outdoor signage to transmit political, religious or environmental messages; these are optional signs and could trigger an angry passerby. Why unnecessarily bring danger to the doorstep? There are other ways to engage in causes and movements.
Walk around your property today and take a critical look at signage. For each sign, ask - is it necessary? Is there an alternative method to transmit information to our visitors? Are we unintentionally painting a target on a facility, room, operation or group of people for a would-be bad actor?
Add security signage. On the other hand, security-related signage is an inexpensive form of hardening and deterrence. I once conducted a vulnerability assessment at a large call center and arrived early, parking in the massive lot. I immediately noticed unaffiliated people using the property as a short cut to a bus stop, weaving between employee vehicles. I also witnessed a drug deal. What I didn’t see what any type of signage to deter this activity or roving patrols to serve as a deterrent.
Signs act as a proxy when we are not physically there to engage. Strongly and clearly convey security messages in green spaces and parking areas: Private property; No Loitering; This area is under 24/7 surveillance; Lot regularly patrolled by local authorities. Carefully consider sign placement and remember, security doesn’t start at the front door. Work outward from the building and build layers of defense, tripwires to detect and deter criminal activity. Several recent shootings started in a parking lot and moved into the building - so it is wise to invest in protecting the perimeter. Counties may have laws regarding the maximum amount of signs allowed on the property, as well as the distance requirements from the primary building, public pathways and roads. Research local ordinances and ask for assistance, if needed.
2- Online Presence and Vulnerability
After addressing property signage, shift to your organization’s online presence. How might information on the Internet inform target selection - or fail to deter an attack?
Bad actors gather target information online. Sophisticated actors are planners and the Internet can yield rich information about a target. Here are three examples for your consideration.
Web applications with satellite photos provide a three-dimensional view of facilities, with the ability to zoom in and examine surrounding avenues of approach, wooded areas, fencing, loading docks and entrances. The street-level view provides even more detailed information, such as camera locations. Criminals often use these photos, for instance, to plan warehouse heists.
I once assisted a company with analyzing what they thought was a credible bomb threat. The caller accurately described furniture and plants in the lobby when explaining where he placed the device. Authorities later learned the perpetrator was actually in another country and used photos of the facility and office space posted on the company’s website.
Pulse Nightclub shooter Omar Mateen’s intended target was the Disney Springs shopping area, and on the night of his assault, he surveilled the property. Smartphone photos and property video indicate he was deterred by a robust armed security presence. After returning to his vehicle, he started searching online for a new target. It was now after midnight, and nightclubs were the only places still open for business. He searched for "downtown Orlando nightclubs." Two results returned: EVE Orlando and the Pulse nightclub. He asked a map application for directions to EVE and drove by around 12:55 a.m. Likely seeing the substantial security presence at the EVE entrance, Mateen did another online search. This time he received directions to Pulse, where he arrived at 1:12 a.m. He was there, observing and driving around the property for 15 minutes. He accomplished the same online search and received directions again to EVE; he started driving there, but then turned around and went back to Pulse and commenced his operation at 2 a.m.
Learn and adjust. As with all plots and attacks, these case studies inform our security practice. Research publicly available satellite and street-level maps of your facility and adjust your property’s security posture accordingly. Avoid posting excessive photos of indoor spaces, the exterior of buildings and surrounding property online. There are many security lessons learned from the Pulse nightclub attack, but it all started with an Internet search. Would language about an armed security presence, metal detectors and bag checks on the EVE and Pulse websites deter Omar Mateen from surveilling the locations in person? Possibly. Adding strong security language to a website is a free hardening tactic. Also, your visitors want to feel safe, so this language won’t deter, but pull them in.
3- Ask Questions
The final simple tactic to enhance the security posture requires leaders to be open to feedback. We’ve all been in public facilities, perhaps a mall, theater, or hotel, and encountered a space that didn’t feel safe – yet there was no mechanism to report concerns. Ask your site visitors if they feel safe on your property – on the perimeter, in parking areas and inside the facility. Walk with them through the places where they feel unsafe and solicit ideas for improvements. We are often too close to our own operation to be objective and this type of feedback provides a more holistic view of security challenges. Partnering is a powerful tool and makes visitor force multipliers, our eyes and ear.
Finally, ask managers what keeps them up at night when it comes to security. Their answers may surprise you! Create a culture where staff can come forward with security and safety concerns and encourage them to provide suggestions for improvement.
Signage, website language and insights from visitors and employees are important pieces of the overall security puzzle. In a sea of complexity, remember how simple, basic security activities can enhance your efforts to keep people and assets safe.