Chapter 1

Introduction to Security Risk Assessments

Abstract

There are many names given to the term security risk assessment. In fact, the actual process of identifying security issues has been called physical security assessment, security survey, security audit, and risk assessment to name just a few. Generally speaking, it is a systematic on-site assessment and analysis of your current security measures, whether they are physical security measures, technology, operations, facilities, security management, policies, training, reports, or any other aspect of your security program or measures. This chapter will help to define the intent of an assessment, who will conduct it, and how to remain objective and unbiased throughout the project.

Keywords

Defining security risks; Physical security review; Security deficiencies or excesses; Security risk assessment; Security vulnerabilities

What Is a Security Risk Assessment?

There are many definitions given to the term security risk assessment. According to ASIS International’s manual, Protection of Assets: Physical Security, a security risk assessment is “a fundamental examination that can include review of documentation, policies, facilities, technology, protection strategies, staffing, training, and other key indicators to determine the present state of the protection program (security) in an effort to identify deficiencies and even excesses, in order to make recommendations for improvement based on proven methods.”1 In fact, the actual process of identifying security issues has been called many different things. Some of the more common names assigned to this subject have been security assessment, security survey, security audit, and risk assessment to name just a few. Generally speaking, it is a systematic on-site assessment and analysis of your current security measures, whether they are physical security measures, technology, operations, facilities, security management, policies, training, reports, or any other aspect of your security program or measures. Regardless of the title, they are all going after similar goals of identifying security weaknesses, risks, deficiencies, and even excesses, and then formulating a plan to address the findings with detailed recommendations based on industry accepted standards and best practices. Most professionals would agree that how you go about the process of the assessment should be a uniformed approach. However, if there is one thing certain in life regarding such processes, it is that everyone who conducts such assessments does so in a variety of different ways. Over the years, there have been numerous books that have covered different parts of a security assessment, so you would think that security practitioners would all be working from the same baseline. However, the opposite is true in many cases. Even among professional security consultants, all have different approaches and no two reports are the same. Case in point—upon review of numerous security assessment reports written by independent consultants, it became clear to me that there are vast differences in style and project methodology. Some reports are nothing more than a statement of facts as determined by the author, followed by an extensive list of recommendations, most of which are not easily correlated within the report, nor are they explained in detail showing the reader what the recommendations will bring to the table if implemented. So this begs the question: if the report does not fully identify the security risk, tell the reader how to address that risk, or provide the reader with a sense of what the change will look like if implemented, what is the purpose of the assessment? Quantitative and qualitative techniques are often used in an effort to measure and evaluate the security program’s effectiveness. The person conducting the assessment also needs to consider statistics when conducting a security risk assessment because the statistics are often the starting point in establishing a baseline of sorts for the program. You cannot effectively manage a security program if you do not track security incident reports and their outcomes. If the person doing the assessment (who will be referred to as the reviewer throughout this chapter) does not have information on historical security issues (e.g., past incident reports) to determine trends, he or she will be at a disadvantage and will likely be setting the baseline from scratch. Another part of the security assessment is the process of identifying and defining the threat, as well as identifying what the target of those threats may be. As we often find, no two industries are exactly the same, and the process of identifying and defining security risks and threats is often different depending on your organization. Take, for example, an organization that does research and development for high-end computer components and a retailer. The security threat for the research and development organization may be in the form of stolen trade secrets, products, or even patent infringements/violations. On the other hand, the security threats associated with the retail environment will often be theft of product or cash receipts. Therefore, in the case of a retail environment, you might be looking at implementing security measures that reduce the risk of robbery, burglary, shoplifting, or even embezzlement. As for the research and development company, security’s efforts may be more focused on preventing unauthorized access into research and development areas and unauthorized access to sensitive computer files. In both cases, security practitioners are often working in a proactive manner, which means they are trying to prevent an incident from occurring. As most security practitioners know, security programs often operate in a proactive posture, whereas it is often the goal of security to prevent incidents from occurring. Law enforcement, on the other hand, is often operating in the reactive mode, meaning that they respond to calls for service as a situation is occurring or after it occurs. To conduct a security risk assessment is often being proactive, as you are looking at your program to see where you can improve based on industry standards. As part of that assessment, the security practitioner must look at past incidents, known threats, and potential targets, which in essence is being both proactive and reactive. Today’s security practitioner must be flexible and must be able to not only look to the past but also plan for the future in their daily actions. The challenges of today’s security professionals are more complex than ever before. The industry in which you work has changed no matter what type of business it is. With the constant rise in workplace violence issues and threats, such as an active shooter, security professionals must adjust. This book will only minimally touch on information technology (IT), due to the fact that most security professionals do not manage the computer systems of their companies. However, it is possible that some security practitioners are performing IT oversight to some extent, because we know there is a trend in many large corporations to bring all security systems and operations under one person, such as a chief security officer (CSO). In most businesses, IT and security are separate, yet IT does play a role in security. IT protects the computer network systems, online presence, electronic records, and e-commerce, while the security department protects the corporate assets, which by nature of their responsibility, IT will fall under. If you are performing a security risk assessment at your organization and you are not considering your online presence or your computer network, you could be overlooking the most vulnerable portal into your organization. Although this book will address IT as it relates to the security assessment, it is not the focus and intent of this book to fully address all the security concerns associated with the corporation’s computer network. There are many resources available to fully address IT security, and we would suggest that security practitioners at a minimum have a basic understanding of their network systems. What sets the tone for most security programs can often be described as the probability of “risks.” When you are assessing for risks you are evaluating for potential incidents of undesirable events. Real or perceived risks are those key factors that are the basis for the level of security measures instituted. In simple terms, if you do not believe that your company has any security risks, it is likely that you have minimal to no security measures other than a lock on the door. Take, for example, a farmhouse in a very remote area. At this farmhouse, you are likely to find that the doors to the house and outbuildings are not locked, even when no one is on the property, and you may often find the car keys in the ignition. The owners believe that they have no real or perceived security risks, therefore they have no security. For them, this is a matter of choice. On the other hand, when you look in the inner cities you will often find homeowners who go to great measures to secure their property. Those security measures will include deadbolt locks, bars on the windows, alarm systems, fencing, guard dogs, security cameras, and many other protection measures. They often do so because of the risks associated with their environment or geographic area. Either they have been a victim of a crime or someone they know has. It could also be that they have educated themselves in the risks around them and they...