What is the vital role of security management in an organization or in our community?

Security Staff Position Descriptions

The security management plan should contain a brief description of the activities performed by each job position of the security department. An option for this section of the plan could be to include the complete position descriptions in an appendix or attachment to the plan, and simply refer the reader to that document. In utilizing this option it may be useful to include an appendix for other areas of the plan, such as defining skill and competency levels of various positions, a listing of general activities/duties, and a listing or table of contents of security policies and procedures.

This section of the plan is also a good place to include the number of authorized full-time equivalent (FTE) staff for each position. In place of the number of staff for each position, an alternative could be the number of weekly hours required to staff and operate the program. Table 4-1 is an example of portraying staff requirements as an FTE count and the number of deployment hours.

Table 4-1. Security Department Authorized Staffing Level

Introduction

The security management plan is a major constituent of security strategies for organizations and entities. Security managers are responsible for the initiation and development of a security plan, and need to draw appropriate information from many sources to satisfy the security requirements to protect their organization's assets. A security plan will assess the security risks and security threats to an organization so that suitable strategies are applied to potential adversaries. The acquisition of information for risk and threat assessments is achieved through knowledge management, and the attainment and processing of the information is crucial for an effective security management plan.

The organization and dispersal of knowledge can be achieved through knowledge management, which develops knowledge bases, expert systems, knowledge repositories, and group decision support systems. Therefore, knowledge management assists in improved performance, competitive advantage, innovation, and integration of sources of knowledge. As a result, the development of knowledge management systems will be strategic assets that aid the effective distribution of information and knowledge among authorized groups. It is considered that knowledge management systems will enhance the ability of information and knowledge managers to better distribute knowledge to appropriate analysts and experts for production of intelligence.

Intelligence is a fundamental process in the domain of security management, and is a critical element in effective decision making for the protection of assets. Intelligence can support the security risk management and security threat assessment processes. As intelligence is both a product and a process, it determines how data and information are converted into useful knowledge (Clauser, 2008).

A form of data gathering in situations or on people is predictive profiling to identify suspicious behavior in specified environments. Predictive profiling attempts to identify suspicious indicators according to characteristics of particular adversarial methods of operation. That is, by observing the behavior of people in a security-sensitive location, an estimate of the threat level can be produced. Thus, predictive profiling can be applied to determine whether a person, object, or situation represents a major threat to an organization.

The management and processing of information are important processes in the protection of assets of an organization. By producing intelligence from data and information, and managing that knowledge, security outcomes will be enhanced. That is, the security of an organization is dependent on the quality of the knowledge derived from the relevant intelligence.

Knowledge and intelligence are distinct concepts, but both support organizational security. For example, knowledge may be considered an underlying concept that can encompass paper information (the traditional view), electronic information (the contemporary view), and individual and corporate information (explicit and tacit). Whereas, intelligence is a process to better use information to gain value and improve knowledge.

Where Should Security Report?

An expectation of The Joint Commission and the required Security Management Plan is to clearly specify the position that has the responsibility for security of the organization and has a clearly defined reporting level for this position. The hierarchical level in the organization to which security reports reflects the importance that the administrative team places on the security function and the organization’s responsibility of protecting persons and property. The important aspect of the security reporting level is it must provide the organizational authority necessary to properly carry out its mission. A practical consideration is security should report to an individual who has both the time and interest in the security function. In short, there must be proper administrative support for a security program to be effective and productive. A common reporting level for security is the vice president (or director) of facilities or the risk management administrator who, as a generality, seems to fit the foundation criteria for a successful program.

Conclusion

The application of security technology to the protection of assets depends on the requirements and conditions of the security management plan. That is, the function of security technology within a security protection strategy is to support the security management plan. Also, the application of security technology must be congruent with appropriate theories and principles for the protection of assets, and is required to be integrated with design and planning. The security principles of DiD and CPTED both support the application of security technology within the contexts of the principles of the protection of assets. An understanding of critical path analysis and EASI will allow security management to assess the quality of the security strategy in the protection of assets for their organization. The principles of universal element conceptual mapping are an advanced approach to understanding the reliability and validity of a security strategy, and provide security managers with the ability to extend their knowledge of a security system.

The necessity to detect the presence or activity of unauthorized persons in an area of interest requires appropriate sensors according to risk and the environment. Applications of sensors on barriers and in open ground are familiar technologies for the detection of unauthorized persons. However, the application of multibeamed laser intruder detections systems provides a technology to detect the presence of a person and analyze the reflected beams of the intruder to determine location, movement, and information about the intruder.

The testing of security technology is an important facet of a security plan and design in asset protection. Testing is necessary to determine the appropriateness of an item of equipment for a particular task in a security function. A testing model has been presented in this chapter to evaluate both the reliability and validity of security technology in the context of its application in a security strategy.

Annual Security Management Plan and Program Effectiveness Evaluation

On an annual basis there should be a formal review of the security program which addresses the objectives, scope, performance, and effectiveness of both the security management plan and the operational implementation of the plan. In short, how did the program measure up to expectations? In addition to the security management plan the periodic reports prepared throughout the year for the multidisciplinary review committee are the basic sources of information for the annual evaluation. The annual evaluation does not need to be on a calendar year basis; however, the calendar year is utilized by most healthcare security administrators. In the U.S., the annual security program effectiveness evaluation continues to be a requirement of TJC. Chapter 4 provides a detailed discussion on performance measurement as part of the security management planning process.

Perimeter Protection

Perimeter protection is effectively the first line of defense in a physical security plan for a facility. However, an examination of the threat assessment of the facility together with the risk management strategy will determine the role of the perimeter in the security management plan. Perimeter security can vary from such items as a white line painted on the ground, to sophisticated high-level perimeter configurations involving multiple barriers with numerous detection systems, permanent surveillance, and continuous patrols. Physical barriers will discourage an undetermined intruder, but will only delay a determined person. Thus, physical barriers must be combined with other security controls for an integrated security solution.

Fences are the usual form of perimeter barrier used to protect the assets of an organization. Fences are relatively cheap and rapid to build, surveillance can be conducted through the barrier, and fences can follow the barrier and be configured into different shapes, and may be enhanced with barbed wire, razor wire, or topped with anti-climbing devices (Figure 5.4).

However, fences are not flawless as physical barriers as they will not usually stop vehicle penetration. They are also susceptible to cutting, the nature of their construction assists scaling, and they can be tunneled under unless additional barriers such as plinths can be provided. Fences require a high level of maintenance and usually have a finite life depending on the environment.

Barbed wire can be installed over a chain-link fence by holding it on extension arms installed over the fence. Single-barbed wire can be installed outwards of the perimeter being protected, whereas double-barbed wire is installed on V-shaped extension arms. Barbed wire is installed to provide added difficulty for anyone attempting to scale a fence. For the same reason as barbed wire, concertina or spiral sharp edge wire is also installed on fence extension arms.

Evaluation of penetration times of chain-link fencing have been conducted by the U.S. Army Mobility Equipment Research and Development Command. Chain-link fences with extension poles installed have been subjected to climbing attacks by fit young men to estimate the effectiveness of fences as barriers against penetration. The 2.8ft (2.6m) fence with pole has been penetrated by a man with another man assisting without the use of aids in 4 seconds and the 2.8ft (2.6m) fence with 2.5ft (2.3m) pole was climbed by a man with three men assisting in 2.5 seconds; using carpet as an aid the fastest time was 7 seconds.

Again, a 2.2ft (2m) fence was climbed unassisted and without the use of aids in a time of 3 seconds, and with one man assisting without the use of aids was 1.5 seconds. Finally, a 2.5ft (2.3m) fence was penetrated by a man with one man assisting without the use of aids in 2 seconds. The fastest penetration time with one man assisting using canvas as an aid was 6 seconds (Knoke, 2004).

Chain-link fences with outriggers and barbed wire to increase the level of difficulty for scaling was penetrated with one man assisting without the use of aids in 4 seconds for a 2.5ft (2.3m) fence with barbed wire outrigger, and 5 seconds with one assistant. Also 2.5ft (2.3m) chain-link fences with a collapsible and a double outrigger with one man assisting were 4 seconds (Knoke, 2004).

A chain-link fence is neither crash rated nor intended to stop forcible entry, for example, entry by vehicle or physical cutting. In most cases, a chain-link fence can be easily penetrated by a normal passenger vehicle. As a consequence, target hardening must be installed for facilities where forcible vehicular entry is an issue. A chain-link fence may be enhanced with the aid of crash-rated tension wires threaded through the fence, or with concrete crash structures, or simply by digging a trench around the perimeter of the fence to stop vehicles from reaching the fence.

Conclusion

The security management plan provides a framework that incorporates all other functions of organizational security. The management plan organizes, staffs, leads, and controls corporate security, informing both internal security staff and external stakeholders such as the board, executives, and other managers of the security methodology. Security management plans are not explicit functions or “how-to” instructions; rather, they are an overarching process that integrates the many and diverse functions of security.

Security management takes a systems approach, which provides defined inputs, transformation in various security functions, and measurable outputs or deliverables. Inputs include tactical and strategic direction, leadership, governance, accountability, ethics, culture, and resilience. Transformations are the many functions of security, such as risk management, business continuity, personnel, physical, and technology security. In addition, functions should also include more general business and management functions, such as finance, budgeting, and performance management, to name a few.

Systems theory provides an underlying methodology for the design and application of a security management plan. Systems theory considers an organization as a whole and its interrelated parts, rather than discrete silo-formed departments that have little interaction. There are many benefits of a systems approach, in particular for security, such as promoting the security plan outside of the security department, common lexicon, integration of common business and management practices, flexibility in operations, a strategic approach, and the effective allocation of resources.

Security management plans can be designed, operated, and managed within four discrete types, depending on an organizational type, culture, and expectation. These four types of methodology take a risk-based, quality assurance, governance, or strategic security framework approach. These frameworks are modular in form and should be designed to meet the organization and its operating environment.

Resilience has become a core concept in security management that security can strive toward. Resilience is a common capacity possessed by individuals, groups, or communities that allow them to prevent, minimize, or prevail in the face of adversity. Nevertheless, the application of resilience is still vague and is better considered a philosophy rather than a plan or framework. However, there are clear characteristics that support organizational resilience. These include the need for a top-down culture with strong and aware leadership, as well as bottom-up functions with devolution of responsibilities, reduced silos, robust financial support, and efficacy in risk management and business continuity.

A security manager is first a business manager, and second a security manager. Therefore, beyond the many security functions, there are other functions that a security manager should practice, such as governance, performance management, corporate risk management, succession planning, education and awareness, cost-benefit analysis, and setting budgets.

Important parts of security management include policy and procedures, ethical behavior for themselves and their staff, understanding the principles of security, and being aware of security decay. Ethics has to be high on the list of a security manager, as ethics lead to positive and effective leadership. Finally, security decay is the understanding that all systems will fail if there is not appropriate and directed feedback to maintain the system at its commissioning level or aligned to dynamic threats.

Federal Information Security Management Act

At the U.S. federal level, the National Institute of Standards and Technology (NIST) has specified guidelines for implementing the Federal Information Security Management Act (FISMA). This act aims to provide the following standards shown in Figure 3.1.

The “Federal Information Security Management Framework Recommended by NIST”1 sidebar describes the risk management framework as specified in FISMA. The activities specified in this framework are paramount in implementing an IT security management plan. Although specified for the federal government, this framework can be used as a guideline by any organization.

Federal Information Security Management Framework Recommended by NIST

1 Information Security Management Standards

A range of standards are specified by various industry bodies. Although they are specific to an industry, these standards can be used by any organization and adapted to its goals. Here we discuss the main organizations that set standards related to information security management.1

Federal Information Security Management Act

At the US federal level, the National Institute of Standards and Technology (NIST) has specified guidelines for implementing the Federal Information Security Management Act (FISMA). This act aims to provide the standards shown in Fig. e27.1.

Figure e27.1. Specifications in the Federal Information Security Management Act.

The “Federal Information Security Management Framework Recommended by the National Institute of Standards and Technology” sidebar describes the risk management framework specified in FISMA. The activities specified in this framework are paramount in implementing an information technology (IT) security management plan. Although specified for the federal government, this framework can be used as a guideline by any organization.

International Standards Organization

Other influential international bodies, the International Standards Organization (ISO) and International Electrotechnical

Federal Information Security Management Framework Recommended by the National Institute of Standards and Technology

Step 1: Categorize

In this step, information systems and internal information should be categorized based on their impact.

Step 2: Select

Use the categorization in the first step to select an initial set of security controls for the information system and apply tailoring guidance as appropriate to obtain a starting point for required controls.

Step 3: Supplement

Assess the risk and local conditions, including the security requirements, specific threat information, and cost–benefit analyses or special circumstances. Supplement the initial set of security controls with the supplement analyses.

Step 4: Document

The original set of security controls and the supplements should be documented.

Step 5: Implement

The security controls you identified and supplemented should be implemented in the organization's information systems.

Step 6: Assess

The security controls should be assessed to determine whether the controls are implemented correctly, are operating as intended, and are producing the desired outcome with respect to meeting the security requirements for the system.

Step 7: Authorize

Upon determining the risk to organizational operations, organizational assets, or individuals resulting from their operation, authorize the information systems.

Step 8: Monitor

Monitor and assess selected security controls in the information system on a continuous basis, including documenting changes to the system.

Commission (IEC), published ISO/IEC 17799:2005.2These standards establish guidelines and general principles for initiating, implementing, maintaining, and improving information security management in an organization. The objectives outlined provide general guidance on the commonly accepted goals of information security management. The standards consist of best practices of control objectives and controls in the areas of information security management, shown in Fig. e27.2.

Figure e27.2. International Standards Organization best-practice areas.

These objectives and controls are intended to be implemented to meet the requirements identified by a risk assessment.

6.2 Security and Privacy—HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is U.S. law primarily concerned with portability of health insurance coverage when people change jobs. It also establishes standards for healthcare transactions. Where it is of interest from the point of view of software development is the intent of the HIPAA to protect the privacy of patients and the integrity and privacy of their medical records.