Intrusion & Access Control

 

 

https://adminsm.asisonline.org/Pages/Multiple-Fatalities-In-Texas-School-Shooting.aspxMultiple Fatalities in Texas School ShootingGP0|#cd529cb2-129a-4422-a2d3-73680b0014d8;L0|#0cd529cb2-129a-4422-a2d3-73680b0014d8|Physical Security;GTSet|#8accba12-4830-47cd-9299-2b34a43444652018-05-18T04:00:00Zhttps://adminsm.asisonline.org/pages/megan-gates.aspx, Megan Gates<h4>​what we know<br></h4><ul><li><p>​​A shooter opened fire at Santa Fe High School in Santa Fe, Texas, at approximately 7:45 a.m. Friday morning.<br></p></li><li><p>Ten people were killed and 10 were injured in the shooting.</p></li><li><p>Police have a suspect in custody. He has been identified as Dimitrios Pagourtzis, 17.</p></li><li><p>The shooter was armed with a shotgun and a .38 revolver.</p></li><li><p>Explosive devices were found in the high school and the surrounding community. Local authorities are urging community members to report "suspicious packages" by calling 911.<br>​<br></p></li></ul><h4>Death toll rises to 10, Texas Governor Abbott Confirms</h4><p><strong>UPDATE 3:25 p.m. ET, May 18, 2018</strong></p><p>Ten people were killed and ten more injured in the Santa Fe High School shooting on Friday, Texas Governor Greg Abbott confirmed in a press conference this afternoon.</p><p>"We grieve for the victims who lost their lives at Santa Fe High School and we pray for the families that are suffering and the families that will continue to suffer in the days to come," Abbott said. </p><div class="ms-rtestate-read ms-rte-wpbox"><div class="ms-rtestate-notify ms-rtestate-read a7bd421a-4909-4cec-8cb4-303485e118ec" id="div_a7bd421a-4909-4cec-8cb4-303485e118ec"></div><div id="vid_a7bd421a-4909-4cec-8cb4-303485e118ec" style="display:none;"></div></div><p>He also confirmed more information about the suspected shooter, Dimitrios Pagourtzis, including that authorities have discovered evidence on his computer, phone, and in a notebook that he intended to carry out a shooting and commit suicide. Before he was able to commit suicide, however, Pagourtzis allegedly turned himself over to the authorities and was taken into custody.</p><p>To carry out the shooting, the gunman was armed with a shotgun and a .38 revolver. Abbott said the shooter took these firearms from his father, who had obtained them legally. There was no evidence at the time of the press conference that the father knew his son had taken the weapons.</p><p>Abbott also said that authorities were interviewing two people of interest, but declined to release any additional identifying information about them. </p><p>While those interviews are ongoing, authorities are continuing to sweep Santa Fe High School for explosive devices and are searching two residences and a vehicle associated with the gunman. Law enforcement is proceeding with caution, Abbott said, due to the risk of discovering additional explosive devices that could pose harm to investigators.</p><p>In addition to conducting a full investigation into the shooting--with the goal of prosecuting the gunman--Abbott said he will be working with the Texas legislature and other state officials to set up roundtable discussions. They will discuss "swift solutions to prevent tragedies like this from ever happening again," he explained. </p><p>Future actions could include taking legal action to keep guns out of the hands of those that pose an immediate danger, enhancing background checks, increasing resources for school security, and funding initiatives to address mental illness and gun violence. </p><p>Abbott said his goal is to work together to create laws that "protect Second Amendment rights but ensure that our communities, and our schools, are safer."</p><h4>Suspect in custody identified </h4><p><strong>UPDATE 2:55 p.m. ET, May 18, 2018</strong></p><p>An official briefed on the investigation <a href="https://www.usatoday.com/story/news/nation-now/2018/05/18/active-shooter-santa-fe-high-school-texas-galveston-county/622507002/" target="_blank">told USA TODAY </a>that the suspect in custody for the Santa Fe High School shooting is 17-year-old Dimitrios Pagourtzis. </p><p>"The suspect was armed with at least one rifle or shotgun, but the first official cautioned that there could be other weapons related to the incident, though not yet recovered," according to USA TODAY.</p><p>Authorities have detained another individual as they continue to investigate the shooting. However, more information about who that individual is has not been confirmed. </p><h4>explosive devices found near high school, surrounding area</h4><p><strong>UPDATE </strong>1:00 p.m. ET, May 18, 2018</p><p>The Santa Fe Independent School District announced that explosive devices were found in Santa Fe High School and the surrounding area.</p><p>"Because of the threat of explsive items, community members should be on the look-out for suspicious packages and anything that looks out of place," the district said via a statement to Twitter.</p><div class="ms-rtestate-read ms-rte-wpbox"><div class="ms-rtestate-notify ms-rtestate-read 9a07da69-b1fe-43c3-b3ad-03bc8d525366" id="div_9a07da69-b1fe-43c3-b3ad-03bc8d525366"></div><div id="vid_9a07da69-b1fe-43c3-b3ad-03bc8d525366" style="display:none;"></div></div><p>The district is urging anyone who sees something suspicious to call 911 and wait for authorities to respond. </p><p>Multiple authorities, including the FBI, ATF, Texas Department of Public Safety, and local law enforcement are on the ground responding to the situation.</p><h4>Trump Gives a statement on shooting</h4><p><strong>UPDATE 12:20 p.m. ET, May 18, 2018</strong></p><p>In an appearance at the White House this morning, U.S. President Donald Trump said he is monitoring the situation in Santa Fe, Texas, and reiterated that school safety is a top priority.</p><div class="ms-rtestate-read ms-rte-wpbox"><div class="ms-rtestate-notify ms-rtestate-read dafcca1a-ccdf-44fb-a8de-f6305bf275b7" id="div_dafcca1a-ccdf-44fb-a8de-f6305bf275b7"></div><div id="vid_dafcca1a-ccdf-44fb-a8de-f6305bf275b7" style="display:none;"></div></div><p>"My administration is determined to do everything in our power to protect our students, secure our schools, and keep weapons out of the hands of those who pose a threat to themselvs and to others," Trump said. "Everyone must work together at every level of government to keep our children safe."</p><h4>Multiple fatalities texas school shooting</h4><p><strong>UPDATE 11:30 a.m. ET, May 18, 2018</strong></p><p><br>A shooter at a Texas high school killed at least eight people and injured multiple others on Friday morning. Authorities have a suspect in custody, and said it is no longer an active shooter situation.</p><p> Police responded to shots fired at Santa Fe High School in Santa Fe, Texas, after a gunman opened fire around 7:45 a.m. when the school day was beginning. </p><p> “Witnesses described students running from the school as they heard gunshots; they also described hearing an alarm at the school, though the sequence of events wasn’t immediately clear,” <a href="https://www.cnn.com/2018/05/18/us/texas-school-shooting/index.html">according to CNN.</a></p><p> Authorities have not released the identity of the suspect in custody or of any of the victims. However, <em>The New York Times</em> reports that an officer working for the Santa Fe school district as a school resource officer was <a href="https://www.nytimes.com/2018/05/18/us/school-shooting-santa-fe-texas.html?action=Click&contentCollection=BreakingNews&contentID=66998236&pgtype=Homepage" target="_blank">injured during the shooting. </a></p><p> The shooting is the third school shooting in the past week, and the 22nd mass shooting in the United States since the beginning of 2018, CNN said.</p><p> Both the U.S. Bureau of Alcohol, Tobacco, Firearms, and Explosives, and the Harris County Sheriff’s Office are on the scene to investigate the incident. Security Management will continue to update this post as more information is confirmed.</p><p> In response to the incident, ASIS International has made soft target and active shooter <a href="https://www.asisonline.org/publications--resources/security-topics/active-shooter/" target="_blank">resources available for security professionals.</a> They include white papers, webinars, book excerpts, and recorded conference sessions designed to help deter, prevent, and minimize future attacks.</p><p><br> </p>

Intrusion & Access Control

 

 

https://adminsm.asisonline.org/Pages/Multiple-Fatalities-In-Texas-School-Shooting.aspx2018-05-18T04:00:00ZMultiple Fatalities in Texas School Shooting
https://adminsm.asisonline.org/Pages/Personnel Peril.aspx2018-04-01T04:00:00ZPersonnel Peril
https://adminsm.asisonline.org/Pages/Take-No-Chances.aspx2018-04-01T04:00:00ZTake No Chances
https://adminsm.asisonline.org/Pages/Florida-Governor-Unveils-Major-School-Security-Plan-In-Wake-Of-Shooting.aspx2018-02-23T05:00:00ZFlorida Governor Unveils Major School Security Plan In Wake Of Shooting
https://adminsm.asisonline.org/Pages/Find-the-Fire.aspx2018-01-01T05:00:00ZFind the Fire
https://adminsm.asisonline.org/Pages/Call-for-Help.aspx2017-12-01T05:00:00ZCall for Help
https://adminsm.asisonline.org/Pages/ENDURECE-BLANCOS-SUAVES-CON-PSIM.aspx2017-11-21T05:00:00ZENDURECE BLANCOS SUAVES CON PSIM
https://adminsm.asisonline.org/Pages/What's-New-in-Access-Control.aspx2017-11-20T05:00:00ZWhat's New in Access Control?
https://adminsm.asisonline.org/Pages/School-Lockdown-Procedure-Prevented-Tragedy-in-Rancho-Tehama.aspx2017-11-16T05:00:00ZSchool Lockdown Procedure Prevented Tragedy in Rancho Tehama
https://adminsm.asisonline.org/Pages/Harden-Soft-Targets-with-PSIM.aspx2017-10-23T04:00:00ZHarden Soft Targets with PSIM
https://adminsm.asisonline.org/Pages/Safety-in-Shared-Spaces.aspx2017-09-01T04:00:00ZSafety in Shared Spaces
https://adminsm.asisonline.org/Pages/Book-Review---Biosecurity.aspx2017-08-01T04:00:00ZBook Review: Biosecurity
https://adminsm.asisonline.org/Pages/Identify-the-Solution.aspx2017-08-01T04:00:00ZIdentify the Solution
https://adminsm.asisonline.org/Pages/Healthy-and-Secure.aspx2017-07-01T04:00:00ZHealthy and Secure
https://adminsm.asisonline.org/Pages/Accesos-Bajo-Control.aspx2017-06-01T04:00:00ZAccesos bajo Control
https://adminsm.asisonline.org/Pages/On-Site-and-Cloud-Access-Control-Systems.aspx2017-05-22T04:00:00ZOn-Site and Cloud Access Control Systems
https://adminsm.asisonline.org/Pages/Message-to-the-Masses.aspx2017-03-01T05:00:00ZMessage to the Masses
https://adminsm.asisonline.org/Pages/Yale-Opens-Doors.aspx2016-12-01T05:00:00ZYale Opens Doors
https://adminsm.asisonline.org/Pages/Sounding-the-Alarm-at-Lone-Star.aspx2016-08-01T04:00:00ZSounding the Alarm at Lone Star
https://adminsm.asisonline.org/Pages/Cannabis-Cash.aspx2016-07-01T04:00:00ZQ&A: Cannabis Cash

 You May Also Like...

 

 

https://adminsm.asisonline.org/Pages/A-Cyber-Pipeline.aspxA Cyber Pipeline<p>​​It was a tense moment. Twenty minutes before taking the stage at the 2016 RSA Conference in San Francisco, U.S. Secretary of Defense Ash Carter had signed an agreement to create the first U.S. government bug bounty program.</p><p>"I was sitting in the front row there, just shaking my head and praying everything would work out the way it was supposed to," says Lisa Wiswell, former U.S. Department of Defense (DoD) bureaucracy hacker who oversaw the bug bounty program.</p><p>And work, it did. Dubbed "Hack the Pentagon," the program allowed 1,400 security researchers to hunt down vulnerabilities on designated public-facing DoD websites. More than 250 researchers found and reported those vulnerabilities to the DoD, which paid them a total of $150,000 for their efforts.</p><p>"It's not a small sum, but if we had gone through the normal process of hiring an outside firm to do a security audit and vulnerability assessment, which is what we usually do, it would have cost us more than $1 million," Carter said in a statement. </p><p>Based on the program's success, the DoD launched "Hack the Army" in 2016, followed by "Hack the Air Force" in 2017, to continue to address security vulnerabilities in its systems. This method of crowdsourcing cyber­security is one that many organizations are turning to as they continue to struggle to recruit and retain cyber talent.</p><p>According to the most recent Global Information Workforce Study, the cybersecurity workforce gap is on pace to increase 20 percent from 2015—leaving 1.8 million unfilled positions by 2020.</p><p>"Workers cite a variety of reasons why there are too few information security workers, and these reasons vary regionally; however, globally the most common reason for the worker shortage is a lack of qualified personnel," according to the report's findings. "Nowhere is this trend more common than in North America, where 68 percent of professionals believe there are too few cybersecurity workers in their department, and a majority believes that it is a result of a lack of qualified personnel."</p><p>To help address this issue, study respondents reported that more than one-third of hiring managers globally are planning to increase the size of their departments by 15 percent or more. However, the report found that historically, demand for cybersecurity talent has outpaced the supply—which will continue to exacerbate the current workforce gap if the trend continues.</p><p>"It is clear, as evidenced by the growing number of professionals who feel that there are too few workers in their field, that traditional recruitment channels are not meeting the demand for cybersecurity workers around the world," the report explained. "Hiring managers must, therefore, begin to explore new recruitment channels and find unconventional strategies and techniques to fill the worker gap."</p><p>One technique to fill the worker gap is being used by the FBI, which has a long history of workforce training and development to keep agents—and Bureau staff—at the top of their game to further its mission.</p><p>In an appearance at ASIS 2017, FBI Director Christopher Wray explained that the Bureau has created a training program to identify individuals with cyber aptitude and train them so they have the skills necessary to identify and investigate cybercrime.</p><p>"We can't prevent every attack or punish every hacker, but we can build our capabilities," Wray said. "We're improving the way we do business, blending traditional techniques, assigning work based on cyber experience instead of jurisdiction, so cyber teams can deploy at a moment's notice."</p><p>In an interview, Assistant Section Chief for Cyber Readiness Supervisory Special Agent John Caliano says the FBI is looking internally to beef up all employees' cyber abilities.</p><p>"There is a notional thought that all the cybersmart people are in the Cyber Division," he adds. "There are a lot of very talented people outside the Cyber Division, some have worked in other areas…the goal is to start to pick up in the investigative realm and lift the abilities of all employees, so they have a basic understanding of cyber and digital threats today."</p><p>To do this, the FBI has employees undergo a cyber talent assessment which looks at the skill sets they brought with them when they were hired, the skills they have learned on the job, and their aptitude for formalized and informalized training on cybersecurity and technology. </p><p>The FBI then sorts employees into three categories: beginners, slightly advanced, or advanced. Employees are then sent to outside educational courses, such as those provided by the SANS Institute or partnering universities, to learn more about cybersecurity and bring that knowledge back to the FBI. The FBI also works with the private sector to embed employees to teach them specialized skills, such as how SCADA networks operate.</p><p>In 2016, Caliano says, the FBI identified 270 employees for cyber training who were not part of the Cyber Division. Approximately two-thirds of those employees were categorized as beginners at the outset, and Caliano says the Bureau plans to continue the assessments and training for the foreseeable future.</p><p>And for its specialized teams, the FBI is continuously developing in-house training that will eventually be offered to the entire FBI. </p><p>"One day, all FBI employees will take these courses and pass these courses," he says. "People will understand what depth and defense mean, how to secure networks, and trace IP addresses."</p><p>These specialized teams include its Cyber Action Team (CAT), which is made up of employees who deploy when a major cyber incident occurs. For instance, when the Sony hack occurred in 2013 the initial FBI response team had a few members who were also CAT members who were sent to the scene.</p><p>Once the FBI became aware of the severity of the incident, it sent a full CAT to Sony's headquarters to sit with the network operators to comb through their logs to see how the attack spread.</p><p>While this training provides professional development opportunities to current employees, the FBI is also focused on identifying future talent that can be recruited into the FBI. </p><p>"We can't compete with dollars, but we can compete on mission," Caliano says, adding that the FBI often gets to look at cyber threats and address them in a way that the private sector does not, providing employees a "deeper sense of fulfillment."</p><p>To attract talent, the FBI has a variety of initiatives including an Honors Intern Program open to all college students. It also has a postgraduate program where the FBI will pay for a graduate or doctoral student's degree. It's also reaching out to students at the high school level through its Pay It Forward program, which engages students in math, science, and technology who might show cyber aptitude.</p><p>"We are, as a workforce planning objective, training at schools—driving down to the high school level," Caliano tells Security Management.</p><p>Another new recruiting channel has been championed by Wiswell since she left the DoD in 2017. After leaving the public sector, she went to work at GRIMM, a cybersecurity engineering and consultant firm, as a principal consultant. One of her main responsibilities is to oversee its GRIMM Academic Partnership Program that runs the HAX program.</p><p>Through HAX, undergraduate cybersecurity clubs can participate in friendly competitions and gain hands-on cyber experience. GRIMM has partnered with Penn State University at Altoona's Security Risk Analysis Club and Sheetz Entrepreneurial Fellows Program, the Michigan Technological University (MTU) Red Team, George Mason University Competitive Cyber Club, and the Rochester Institute of Technology's Rochester Cybersecurity Club.</p><p>Throughout the academic year, participants in HAX break into teams to complete programs designed by GRIMM engineer Jamie Geiger that are similar to computer Capture the Flag challenges. While participants have the option to compete individually, Wiswell says she encourages students to create a team to hone their communication skills.</p><p>"A lot of this field has an individualist focus a lot of the time, and what's really needed is the ability to communicate well, both up and down, to work well on teams, and to have effective analytical skills," she explains. "The kinds of things that you learn well by doing these kinds of team-based challenges."</p><p>GRIMM chose these programs in particular to create a talent pipeline for the company, which has offices in the Washington, D.C., area and in Michigan—near two of the universities it's partnered with. By engaging college students through HAX, GRIMM hopes to create a talent pipeline and increase diversity on its own staff.</p><p>"HAX is an effort to do both those things," Wiswell says. "We are kind of do-gooders on one hand. If folks that are participating in the program have no interest in coming to work for GRIMM, that's fine. We just hope that they use their talents and go somewhere."</p><p>That's why the challenges and the experience to connect with people working in cybersecurity are important, according to Wiswell, because it helps students make informed decisions about what they would like to do after graduation.</p><p>"We're trying to think outside the box in ways that students feel very well rounded, so students can make decisions on what sliver of this workforce is most interesting," Wiswell says, explaining that current challenges are focused on Linux and Microsoft systems, but in the future, might include hardware and other areas. </p><p>And to gain even more experience before graduation, Wiswell says she encourages students to take part in bug bounty programs to get connected to companies that might one day hire them.</p><p>"If you already have a lot of good skill and you're trying to hone skill—and make some cash—we think that bug bounty programs are a great way to do that," Wiswell explains to Security Management. "GRIMM is partnered with a couple bug bounty as a service providers to help them get in a broader group of individuals who are interested in participating, as well as companies that could benefit from hosting bug bounties themselves."   ​</p>GP0|#91bd5d60-260d-42ec-a815-5fd358f1796d;L0|#091bd5d60-260d-42ec-a815-5fd358f1796d|Cybersecurity;GTSet|#8accba12-4830-47cd-9299-2b34a4344465
https://adminsm.asisonline.org/Pages/Take-No-Chances.aspxTake No Chances<p>​Security processes are working properly if nothing happens, as the adage goes—much to the chagrin of the security manager looking for buy-in from the C-suite. But if something does go wrong at an organization, the error lies in either the company's risk profile or its implementation of mitigation procedures. Using risk management principles to create a risk profile and implement procedures to mitigate those risks should leave no gray areas for an incident to occur, says Doug Powell, CPP, PSP, security project manager at BC Hydro. Security Management sat down with Powell, the 2017 recipient of the Roy N. Bordes Council Memb er of Excellence Award, to discuss how to create a mitigation program that only gets stronger after a security incident.​</p><h4>Weigh the Risks…</h4><p>A basic tenet of risk management principles is understanding what risks an organization faces by conducting a thorough risk assessment. "For me, nothing should happen in the security program in terms of making key decisions around protection principles until you've been through your risk management exercise, which will do two things for you: tell you where you have gaps or weaknesses, and what the priority is for addressing those," Powell says. </p><p>Look for the risks that are high-probability, low-impact—such as copper theft—and low-probability, high-impact—such as a terror attack—and build a protection plan that primarily addresses those, Powell says. </p><p>"You use that prioritization to get funding," he explains. "I tell people there's a broad spectrum of risks you have to consider, but there are two that you focus on that I call the board-level risks—the ones the board would be interested in because they could bring down the company."​</p><h4>…And Use Them to Build a Strategy</h4><p>Establishing those risk categories will not only help get buy-in from the C-suite but frame the company's security strategy.</p><p>"You should never say something like, 'well, the copper losses are so small that we're not going to deal with this at all,' in the same way you're not going to say that you'll never likely be attacked by terrorists so let's not worry about it," Powell says. "With that in place, you should have an effective mitigation strategy on the table."​</p><h4>Flesh Out the Baseline…</h4><p>While getting buy-in may rely on emphasizing the impact a risk can have on business operations, the security team needs to have a well-rounded understanding of the risk itself. Powell illustrates the distinction by using an example of how protesters might affect critical infrastructure.</p><p>"It's one thing to say that there's risk of work being disrupted or of a pipeline being taken out of service by protesters, but it's quite another thing to say that in the context of who these protesters are," according to Powell. </p><p>"You have one level of protesters who are just people concerned about the environment, but all they really do is write letters to the government and show up and carry picket signs to let you know they are concerned. The more extreme groups are the ones that would come with explosives or physically confront your workers or who would blockade machinery," Powell explains.</p><p>While these two groups of people both fall under the protester category, the risks they present—and how to respond to them—are vastly different.</p><p>"You have to understand the characteristics of your adversaries before you can adequately plot the seriousness of the risk," Powell explains. "Would it be serious if our pipeline got blown up? You bet it would. But who has the capability to do that? Are they on our radar? And what's the probability that we would ever interact with them? There's a bit more than just saying it's a bad thing if it happens."​</p><h4>…And Keep It Updated</h4><p>Don't let an incident be the impetus for conducting a new risk assessment. Creating a governance model will facilitate regular reviews of the risk assessment and how it is conducted.</p><p>"If you do it well at the head end, you should be mitigating to those standards," Powell says. "Risk doesn't happen once a year, it's an ongoing process where you establish the baseline, mitigate to the baseline, and start watching your environment to see if anything bad is coming at you that you should be taking seriously because the world is dynamic."</p><p>Consistent monitoring of threats allows the mitigation strategy to be adjusted before weaknesses are discovered and exploited.</p><p>"The monitoring aspect is critical, and after an incident you might say that the reason your mitigation plan failed is you simply didn't monitor your environment enough to realize there were new risk indicators you should have picked up," Powell says. "The risk management process is dynamic, it never stops, it's continually evolving, and whether something happens to cause you to reevaluate or whether you reevaluate because that's your normal practice, that has to happen."</p><h4>Establish a Process…</h4><p>Through risk management, a security incident occurs when the risk assessment was not accurate, or the mitigation processes were not properly carried out. After an incident, security managers should never feel blindsided—they must identify the shortcomings in their processes.</p><p>"When something critical happens, the first thing you will do is go back to your risk profile and ask yourself some key questions," Powell advises. "Did we get it right? Did we miss something? How did this incident occur if in fact we had our risk profile correct? Or did our mitigation planning not match well with the risk profile we had developed? If we had this assessed as low-risk but it happened anyway, maybe we got something wrong. If it was high-risk and it happened anyway, what was the cause?"</p><p>If the security program matches the risk profile and an incident still occurred, it's time for the organization to change the baseline.</p><p>"Did we understand our adversary?" Powell asks. "Was it someone we anticipated or someone we didn't anticipate? If it was someone we anticipated, how did they get in to do this thing without our being able to stop it or understand that they were even going to do it? Do we have the right security in place, did we do the right analysis on the adversarial groups in the first place? What did we miss? Are there new players in town? Is there something going on in another country that we weren't aware of or ignored because we didn't think it impacted us over here in our part of the world?"</p><p>And, if it turns out that the risk profile was inaccurate despite proper governance and maintenance, don't just update it—understand why it was wrong. "Look at whether your intelligence programs or social media monitoring are robust enough," Powell suggests.</p><p>"If you had 10 or 100 metal theft incidents in a month, you want to go back and ask why this is continuing to happen," Powell notes. "We've already assessed it as a risk and tried to mitigate it. For me, the two things are intrinsically connected. If you're performing risk management well, then your mitigation programs should mirror that assessment. If it doesn't, there's a problem, and that's what this review process does, it gets you into the problem."​</p><h4>…And Use It Consistently</h4><p>Whether it's copper theft or a terrorist attack, the incident management process should be carried out in the same way.</p><p>"That should always be a typical incident management process for any kind of event," Powell says. "What varies is input, but the methodology has got to be identical. If it's metal theft, it's a pretty simple thing—we have some thieves, they broke into a substation, removed ground wires, and as a result this happened. What can we do to mitigate that happening at other substations in the future? </p><p>If it's a terrorist attack, of course a lot more people will be involved, and you'll be asking some very challenging questions. The process becomes a lot more complex because the potential for damage or consequence value is much higher, but the methodology has to be the same all the time."</p><p>"Overall, whether you're looking at a security breach that happened because you exposed your cables and the bad guys were able to cut them or whether it was a new, more dangerous group coming at you that you weren't aware of, or because you neglected to identify the risk appropriately—all of this has to go into that evaluative process after something happens," Powell says. "Then you have to reestablish your baseline, so you're going back into that risk analysis and move to mitigate it according to what that new baseline is. If something bad happens that's what you do—go back to the baseline and discover what went wrong, and once you know, you seek to mitigate it to the new baseline." </p>GP0|#cd529cb2-129a-4422-a2d3-73680b0014d8;L0|#0cd529cb2-129a-4422-a2d3-73680b0014d8|Physical Security;GTSet|#8accba12-4830-47cd-9299-2b34a4344465
https://adminsm.asisonline.org/Pages/Find-the-Fire.aspxFind the Fire<p>​The University of Hawaii at Hilo (UHH), founded in 1941, is located on the largest island of the Hawaiian archipelago, Hawaii–also known as "the Big Island." The school offers 38 undergraduate areas of study, including a renowned astronomy program, to approximately 3,600 students.</p><p>The Hawaiian skies over the central Pacific Ocean offer a spectacular view of the heavens. </p><p>But despite the campus's magnificent panoramas, the university's security staff found itself gazing too often at fire panels that weren't functioning properly, says Ted LeJeune, project manager at UHH. </p><p>When the campus began major renovations about five years ago, the security department ran into challenges with the fire panels, which worked via radio signal. "We were starting to experience issues with the reflectivity and the inconsistencies of the radio system," LeJeune says, "so we were having trouble passing our final fire inspections with the fire marshal."</p><p>The institution's fire system includes panels that intermittently report back to a central station in the campus security office. "On a regular basis, the panels transmit signals that say, 'Hey, I'm here, I'm doing fine,'" LeJeune explains. "And as long as we get that heartbeat notification, the security office knows that we don't have any problems."</p><p>The fire panels report any issues to the central station, including triggered smoke detectors, pulled fire alarms, and offline panels. When any of these alarms are triggered, "we get an immediate notification to our campus security office that we have an issue with a building, and we need to dispatch somebody to investigate," LeJeune notes.</p><p>In the campus security operations center, which is staffed around the clock, security staff members monitor a large screen that displays the fire life safety system's current status, as well as active alarms. The screen allows operators to scroll through notifications and keep an archive of reports. In case of fire or another life-threatening hazard, the fire department is contacted. </p><p>The campus roofs are made of corrugated steel. But whenever the Hawaiian sun would hit the metal rooftops, the signals could get diffused or jammed, causing the radio-based fire alarm systems to report inconsistently, or not at all. This led to a host of issues for the campus security department. </p><p>"We were having intermittent connectivity and even losing connectivity to some of the locations because of the radio signal reflectivity of our roof systems," LeJeune says. </p><p>Besides the connectivity and transmission issues, the old radio units were burdensome to maintain, and an outside engineer had to travel to the campus to service the units. </p><p>These challenges led to a conversation with Digitize, which provides several aspects of the campus's fire life safety system. In the fall of 2016, Digitize suggested land-based radio units that connect into the university's existing fiber optic cable and Ethernet system. "We've done several upgrades over the last few years to standardize and stabilize our Internet," LeJeune explains, "and it was just a natural extension to add Digitize to the land system because we already had the existing backbone."</p><p>The land-based radio units allow the end user to remove the frequency transmitter on the fire panels, and connect into either the Ethernet or fiber connections in the buildings. This landline connection enables the panels to report back to the central station within seconds. </p><p>UHH launched a pilot project in the spring of 2017 to test the new product on its recently renovated College of Business and Economics building. The university upgraded its base unit in the campus security office to accommodate both the radio frequency and the land inputs. </p><p>During the testing, the land-based units successfully and accurately reported all issues to the central station. "Our pilot project went fantastically," LeJeune says. "We were able to retrofit the remote unit [with the landline], and we were able to clearly communicate and program the base unit," he says. The school also brought the fire department in to observe the new system. "They were thrilled that we were getting a more stable network and that we were able to more clearly manage and supervise our system." </p><p>Since installing the new system, the campus has not experienced any issues with fire alarm panel reporting. Over the next several months, the campus plans to add additional land-based units to at least 25 buildings. Some of the larger buildings will have their own unit while groups of smaller buildings can share units, LeJeune adds. </p><p>With the new system, UHH security staff can service the panels themselves, rather than relying on an outside engineer. "Digitize has given us in-house training, so that we can not only diagnose but also put new systems online, and program them at both ends to communicate consistently and properly," he notes. "The ability to work on them internally…and the training that we've been able to get from Digitize has just been a real major step forward for us." </p><p>He adds the new system allows security to fully focus on the issues that deserve attention. "It's about having confidence that we have consistent communications, and that we're not getting dropouts or false alarms," he says. "This allows the security office folks to focus on their assigned tasks rather than chasing ghosts and false alarms."</p><p>For more information: Abe Brecher, Digitize, www.digitize-inc.com, abeb@digitalize-inc.com, 973.219.2567 ​</p>GP0|#cd529cb2-129a-4422-a2d3-73680b0014d8;L0|#0cd529cb2-129a-4422-a2d3-73680b0014d8|Physical Security;GTSet|#8accba12-4830-47cd-9299-2b34a4344465