False alarms as a tool of the bad-guy
There are lots of reasons why physical security measures work, and are of great value. And we have often been assured by people that their premises are secure. While this may in general be true, it usually means that it is secure from normal attacks, not from well-planned attacks so unlikely that nobody has planned to counter them. It also usually means that premises are secure from specific individual threats. But what happens when there are multiple threats? At what point does your facility become vulnerable. We have heard of several cases where multiple threats occurred – generally a series of false alarms, coupled with real physical events, were enough to displace people enough for bad guys to get in and do damage.
As an example, let’s talk about data centers. When there is a fire in your premises, who stays in the fire area to guard your data center? And if there is a bomb threat, who stays in the threatened area to guard your data center. And if a package arrives at the data center, and, when it is opened, white powder spills out, who stays in the threatened area to guard your data center? And if there is a category 3 hurricane heading your way, who stays in the building to guard your data center? If a car alarm goes off in your parking lot will a guard leave a post uncovered to investigate?
Now let us assume that someone really wants to get into your data center, but not enough to actually kill people to do so (which is a different scenario). How many critical events need to be triggered to compromise the facility? If there is a fire and a bomb threat simultaneously, will that be enough to cause the area to be abandoned?
One way to reduce this problem is to actively think about how you would penetrate your own facility. What series of things would you need to do to get in and out. What if you were not afraid to cause some physical damage, like knocking down doors. And how about if you were willing to actually kill people? As you think of scenarios, see if your protective measures would deal with them, or whether you would be vulnerable.
Oh, by the bye, this approach can also be used for good, not just for evil. We recall the case of the French terrorist holed up in an apartment in Paris. The police had cleared the apartments above, below, and on the rest of the floor. All they needed was to get the terrorist to come out. They finally glued a cat to the wall in the hall. When the terrorist eventually came out to see why the cat was making such a racket, he was captured without incident.
The hero cat was carefully shaved off the wall, none the worse for wear.
