Fundamental Principles of Security

To be most effective, security measures must be consistent with the agency’s primary mission and be:

• Thoughtfully designed
• Generally used and tolerated by end users, if not totally accepted by them
• Properly installed
• Properly maintained
• Regularly reevaluated

These principles apply equally well to standoff attacks: attacks that are initiated off the property, but that are directed at the facility or its occupants. Such attacks could include attacks on information handling and processing systems, telecommunications systems, and so forth.

Deterrence is better than detection and apprehension. While security systems can help law enforcement detect and apprehend attackers, the systems should be designed principally for deterrence and prevention.

When designing a security system, you should:

• Use measures that force the unwanted intruder (attacker or thief, for instance) to spend an unacceptably long time at the target. Measures that force attackers to spend a long time at the target plus a quick response by security responders equal deterrence and prevention.
  
  
• Use measures that force intruders to leave their comfort zone and cross an uncomfortable distance to reach their intended target. Make the attackers feel as lonely as if they were standing in an open field while wearing a bright neon sign.
  
  
• Use measures that put unforeseen barriers between intruders and their intended targets. Few things are more disconcerting to attackers who believe they have a flawless attack plan than to encounter a significant unforeseen obstacle. For example, thieves who believe they can simply break a window, grab the contents of the window display, and leave in a matter of seconds will become distracted and somewhat disoriented if glass that appeared to be ordinary window glass turns out to be laminated safety glass.

Security responders must provide an appropriate and timely response to every apparent or real security breach or threat. Physical security measures (such as locks, alarms, barriers, video, etc.) do not protect, although vendors like to use that word. Physical security measures delay or deny access to intruders, provide warnings, and may capture wonderful images of the intrusion, but they do not protect. Trained humans who respond to alarms provide the protection. Responses must be timely and consistent. Competent attackers know how to initiate nuisance alarms (often incorrectly called false alarms) that wear down responders’ will to continue responding. Once the responders stop responding, the attackers walk in.

Physical security measures must complement one another. It would be foolish to pay $75 for a mortise lock that is highly resistant to attack by a pick and drill if the thief can bypass the lock simply by shimming the bolt on an improperly installed latchset. Attackers know how to spot weaknesses and how to exploit them.