1. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 1 Introduction to corporate security Teemupekka Virtanen Helsinki University of Technology Telecommunication Software and Multimedia Laboratory teemupekka.virtanen@hut.fi

2. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 2 5. Lecture – Physical security Physical security as a part of corporate security Physical security methods Physical security in practise

3. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 3

4. 4 Security in corporations

5. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 5 Security domains

6. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 6 The goals People in a domain can work without disturbance from outside There are only trusted people inside People don’t have to watch each others Security does not prevent or disturb legal access Optimization of security work Few routes to monitor Automation and special staff

7. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 7 A passive prevention A wall, door, fence, safe Remarkable Time to break Devices required

8. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 8 A passive prevention

9. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 9 Monitoring Proximity monitoring Area monitoring Remarkable Delay time Number of false alarms

10. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 10 Monitoring

11. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 11 Reaction Guard Remarkable Delay in reaction Travelling time The amount of force

12. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 12 Reaction

13. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 13 A threat analysis Different threats require different level of preparation Intruders Ordinary trespassers Hell’s Angels Greenpeace Green barets Fire Accidents Different assets require different protection methods

14. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 14 Risk management Pros Prevention of losses of valuable assets No disturbance in working processes Feeling of security Cons Costs of passive measures Security staff salaries Feeling of police state Risk management is optimizing pros and cons

15. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 15 Level of physical security Σ(Tp + Tg) – Td > Ta + Tt Tp = Time to pass a physical barrier Tg = Time to go to the next barrier Td = Monitoring delay Ta = Reaction delay Tt = Traveling delay

16. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 16 Generalization Intruder Fire Accident Computer security

17. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 17 Information security Availability is often important Destroyed, not stolen Reaction itself can be a threat It is possible to copy Knowing is enough Nothing has to be carried away Breaking information security is a way to break other protection

18. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 18 Fences Flagging the area Giving a sign that an area is restricted Shows people where they are assumed to move and enter Makes the monitoring easier Usually are for honest people only Really effective fences are too dangerous for people Visual image of a city

19. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 19 Walls and doors In general, walls are a good protection Doors and windows are easier targets Protection of two lowest level of a building Not possible to open windows Protection against breaking Monitoring doors Keeping doors closed Access control

20. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 20 Access control A shows honest people the way they are expected to use Not against real intruders Alarm systems A balance between usability and security Too preventive systems generate other ways Possibility to log makes it possible to switch from prevention to reaction

21. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 21 Safes Have to be selected according the threat Intruders vs. fire Protection time is usually a few hours With time every safe can be open Must be kept closed to get any security Key management is an important issue

22. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 22 Monitoring devices On a perimeter Touch, pressure, laser, glass break, micro switch (doors, windows) Finds out if a perimeter is broken illegally In an area Infrared, radars, laser, pressure, camera Finds out if there is somebody in the protected are

23. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 23 Cameras Cameras can be monitoring devices as the others Is there somebody in a place where should not Cameras can be used to check alarms given by other devices Second opinion Identification Active monitoring Recording

24. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 24 Guarding Preventive operation A guard in sight prevents intrusion Reaction to a situation A guard comes to a place and stops intrusion Monitoring A guard works in a monitoring center giving guidence and orders

25. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 25 Differences between a guard and receptionist Authorization Guards must be accepted by officials Education There is a mandatory courses for guards Power A receptionist has only the same priviledges than any citizen Appearance Guards must have a uniform Many receptionist have that, too

26. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 26 A receptionist Visibility A receptionist is always present Can prevent intrusion without any special methods Immediate reaction Denying access Alarm Other services Visitors management A good receptionist makes security by service

27. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 27 A guard Crime prevention A difference between a receptionist and a guard is like an access control and an alarm system Must still balance the security between entities

28. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 28 Organizing physical security Own staff More permanent people Better knowledge of local arrangements Can be cheaper For example in a factory Buying service Easy Better knowledge of security Easy to modify

29. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 29 A monitoring center In a monitoring center all the monitoring systems and alarms are monitored Cameras Intrusion detection Access control The situation is calculated and the response is defined

30. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 30 The location of a monitoring center On site Short distances Better local knowledge Easier communication arrangements In a center More efficient Staff common with other sites

31. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 31 Arrangements in a monitoring center Usability The number of monitors Changing tasks during a shift How to keep the reaction delay as short as possible Logging How to supervise supervisors Logging the alarms Logging the responses Reports to the customers

32. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 32 Alarms When noticing an intrusion the staff in monitoring center reacts according what has agreed with the customer A guard can be sent to the customer’s premises Everything can be taped for evidences The guard can be instructed from the center

33. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 33 Reporting A report is usually delivered to a customer including Alarms and reactions they caused Other incidents Other remarks pOpen doors, printers This reporting is part of administrative discussion between parties

34. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 34 Patrolling guards Instead of staying in alarm center or one point in premises guards can move from place to place Check certain important places There should be no timetable Intervals should be shorter than break in time Possible other duties in the same Locking doors Shut down devices Advantages in patrolling Larger area is covered

35. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 35 Access control systems Centralized management of locking Key cards are easier to manage than keys Is meant to guide own people Intruder alarms are for outsiders Can have other services Time stamping, info for telephone, cafeteria

36. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 36 Advantages of an access control system Key management is easier Access can be granted for doors needed Revocation of missing keys are easy Access can be granted according time Logging is easy System is easy to expand Doors, users, groups

37. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 37 A typical access control system 50 – 5 000 users 10 – 300 doors Integrated time stamping Automatic connections to the HR and telephone

38. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 38 A structure of an access control system Central unit A standard computer Readers Concentrators Network A general IP network for management A general or proprietary network for readers Workstations General workstations For management and reporting

39. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 39 Central unit Basic information Users and doors Access information For whom access is granted at which time and which door How the working hours are calculated for each employee Decision making Instructs doors to open and close Information storage Logging Reports

40. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 40 Concentrators A concentrator can be just a communication HUB Makes connecting devices easier in proprietary network Eg IP to RS232 transformation An intelligent concentrator can duplicate the central unit temporarily Buffer user and door information Can make decisions for accessing Buffer log information Supervises readers Polling

41. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 41 Example of access control

42. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 42 Readers Authentication of users using key cards Usually wireless Sends user information to the central unit Instructs a lock to open and close according decision got from the central unit One unit can include several logical readers One for each side of a door Other functionalities Monitoring door status, alarms

43. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 43 Example of a door

44. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 44 An access control project Must be planned carefully Different groups, access needed, routes Must be instructed and educated The system should not make working more difficult Must be used only for access control / time stamping purposes Avoid back office power Should make moving easier and give more flexibilities Incidents can be investigated afterwards using logs

45. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 45 Cameras Pros Don’t require any operation of people who work in the premises Automatic collection of information Possibility for distant monitoring Cons A camera doesn’t safe anyone Too eager supervision –feeling Can easily be used in a wrong way Not for security but managing It is often difficult to get accurate information

46. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 46 Cameras Monitoring an empty area or perimeter It is easy to see a movement It is difficult to identify a person in a large area Color images give more information than BW Good images can be got in a dim light

47. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 47 Location of cameras Outside along the walls It is easy to notice people if there should not be any One camera can cover a long wall Inside in the walking routes In small areas identification can be done Logging Suspicious behavior Halls are difficult for automatic logging Privacy must be considered

48. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 48 Recording Used to be based on tapes, now hard discs are used Several cameras are MUXed to one feed to save space Eg every Nth picture is stored for each camera It is possible that something happens between two stored images Policies are important and must be planned beforehand Who can view the recording, for which purpose and using which procedure

49. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 49 Facts Helsinki (and Finland) is one of the most imaged place in the world The number of cameras is very high Almost any place can be monitored or at least checked from logs Cameras do not increase the feeling of security They don’t prevent anything Active response must exist

50. MINISTRY OF SOCIAL AFFAIRS AND HEALTH 50 Questions ?