Month: February 2016

The Afghan Experience

On By weshamerlyIn Security planningLeave a comment

CIMG2675

A few years ago I was in a faraway land known as Afghanistan. The specific time and place I cannot say, and isn’t relevant to my point anyway. An Afghan security officer was tasked with upgrading security for his base’s headquarters’ section and more specifically the base commander, to protect against the insider threat. He requested assistance from US forces and, being that my section was involved in threat assessments and counterterrorism, we were tasked with assisting him. We had been training the Afghan army for about ten years, we thought they should be conducting business in the same manner as the U.S. Army… we were wrong.

Our assessment was horrific, security personnel without protection or communication, parking areas right outside senior officer offices, open air breezeways with no protection, very little traffic control, and unlimited access to the building. This was going to be an interesting job.

As we got into planning we were given three rules we had to incorporate into the plan, all three were non-negotiable.

  1. Be discrete. They didn’t want the commander to look like he was hiding or afraid. They thought it would make him look weak in front of his men. Thus, making the place look like a fortress was out.
  2. Keep the cost low. They were restricted in resources and money. We were constrained to supplies and equipment they had on hand. If we couldn’t scrounge it locally, then they probably couldn’t get it.
  3. Don’t mess with the roses.

Wait… what? What do roses have to do with anything? One could see the other requests, but what does a flower garden have to do with protecting the building? Well, as their chief of staff tolerantly explained, roses are a symbol of success for the Afghan Army. Removing or damaging the rose garden in front of the building would have roughly the same effect as making the commander look weak. They would not compromise their values in the name of security.

This got me to thinking, and subsequently colors my current attitude toward security planning and assessments. First, you should not have to look like you are hiding frightened in your house to have robust security. You shouldn’t have to live with obvious security barriers like bars on the doors and windows, high intensity lights all around, large fences and gates topped with razor wire surrounding your entire perimeter, and generally looking like some kind of fortress. Most people want to present a warm and friendly outlook in the appearance of their house.

Second, it shouldn’t cost a whole lot of money to create a safe environment. Yes, we have the options of high security alarms, monitored and recorded digital video systems, high impact resistant window film, locks costing hundreds of dollars, etc. but if we can have a similar security increase by simply placing a five dollar stop on a window, or a bar in the sliding glass door, or trimming our hedges, then that should be our initial approach to security. Knock out the easy, inexpensive, and effective first. Worry about the other stuff later. Keep it simple.

Lastly we shouldn’t have to give up our values to increase our security, or make major changes in our lifestyle. We can use what we already have, adapt it, and incorporate it into our security plan.

This has become my philosophy, and my approach when it comes to designing a security plan. I believe, if we look hard enough, and do a little outside the box thinking, one can create a plan that is inexpensive, effective, and unobtrusive.

To answer your question, we were able to incorporate the rose garden in the security plan. Later it became indispensable to make our plan work. What began as a challenge became an opportunity.

Defense in Depth Approach to Security Planning

On By weshamerlyIn Security planningLeave a comment

training

When conducting an assessment, and creating a subsequent security plan I work with a “defense in depth” concept. Defense in depth creates areas or zones starting from inside the house or business, and building outward (or from the outside looking in if that is your preference). Each zone has its own security considerations and challenges, and will have a perimeter which must be crossed to get into a lower zone before an intruder can reach their target. Items creating the border of can either be psychological, such as indicators of difficulty, they can be deceptive, such as lack of indicators of valuables, or they can be physical, such as higher security locks, strengthened doors, or locked and shatter resistant windows.

One of the key principles of defense in depth is requiring the potential intruder to spend larger amounts of time entering or working inside the premises, and risking greater exposure and chance of getting caught. An intruder will want to spend as little time as possible breaching the house and then less than 10 to 15 minutes actually inside searching and collecting valuables. The short exposure time makes the criminal feel safer as they are typically faster than a police response to a property crime call. If the thief can spend only a few minutes breaching the house and 10 minutes inside they will probably be gone before law enforcement can arrive. If they have to spend more time than that, there is a better chance that they will move on and attempt to enter someplace else. Realizing time and exposure are a factor, we work to maximize both.

For planning considerations in a residential area, I usually use four zones. Businesses may have less or more, depending on their specific situation and location. The number of zones the planner uses is dependent on how the planner is viewing the situation and what is the most convenient. I tend to order the zones from the interior to the exterior, but in this case we’ll discuss them in the order a potential intruder will encounter them. It should be noted the zones can be called anything you wish. Lacking imaginative labels, I simply use one through four.

Outside of your perimeter Zone Four:

Zone four consists of everything in your neighborhood outside of your actual property line. Within this zone are factors you may or may not be able to control or affect. However, threats in zone four may be effectively controlled by working with your neighbors, your housing association, building managers, other area businesses, or local law enforcement agencies. Other than cooperative efforts of the entire neighborhood, the most one may be able to hope for is monitoring situations and reporting possible criminal activity. Awareness of activity in one’s area may increase security for the entire neighborhood.

This is also the zone where a potential intruder will survey the premises and determine if there are valuables worth taking and if it is safe enough to attempt a break in. Trash with indicators of recent purchases, un-secured mail, and high ticket items such as boats, jet skis, or ATVs will aid the intruder. Indicators of open doors and windows, or heavy cover reducing visibility from the street may increase the likelihood of a crime. Lack of these indicators may make the potential intruder check the next location.

Property line to outer wall: Zone Three

Zone three is the area between the outside property line and the actual envelope of the home or business. This may include the yard, driveway, Parking lots, open areas, and fenced in areas. Specific items and deficiencies within zone three can be directly affected by the owner and either modified, eliminated, or repaired. Security is enhanced in zone three through increased physical security measures and direct observation. In some cases, such as apartments or businesses renting space within a shared building, zone three may be very limited or non-existent. This adds a challenge to planning as the only obstacle between zone four’s uncontrolled area and the potential target is the envelope of the structure itself. Lack of visibility into the structure may help deter the intruder due to not being able to determine if there are easily accessed valuables.

In this zone the intruder’s exposure is at its highest. In the fourth zone, they may be just a passer-by, in the second they are inside and less visible. The third zone is where we want to maximize the intruder’s visibility and time.

Outer wall to inner room: Zone Two

Zone two is the area inside the house between the outer envelope and an inner safe room or bedroom. This is the area where a burglar will find most of your valuables. After the outer envelope of the home or business is breached, the intruder is typically able to move easily from room to room and is hidden from outside observation. Items that cannot be found or easily removed within the 10-15 minute window may be abandoned. The burglar may find things in this area, such as keys, that may not be of immediate use, but may be used on a return burglary. He might also see something a very high-value that he cannot to remove immediately and may come back with proper tools or help to extract the item.

Protection of zone two is typically through alarm systems and securing valuable items in areas that are difficult to find or in security containers which are bolted to floors or walls to prevent easy removal. Other options may include stronger interior locks or hidden areas to increase the time the burglar spends in order to conduct a search. Anything which frustrates the intruder during his activities uses time and keeps him from conducting a thorough and effective search.

Zone two is also important because this is where the family may be during the course of a violent home intrusion, or employees during a robbery. Plans must be in place to move people quickly to a safe area in the case of an intruder forcing their way into the building. This will require creating a plan, and practicing a quick response to the threat.

Inner room: Zone One

Zone one is an inner room inside the home or business which may be hardened against an invasion attempt. Typically the area will be an inner room or office, or the master bedroom. This is not to be confused with a “safe room” which is a hardened structure made for long duration safety. The purpose of the zone one room is to create time, to help protect the people, repel the invader long enough to summon law enforcement, and possibly defend the household if required. This inner room may have a number of small improvements, but is fundamentally a product of the homeowner’s security planning. Some improvements for zone one may incur a substantial, many do not.

Response to the intrusion needs to be a planned addition to the security plan and will be what fits the homeowner and family the best. This may not include a violent response to the intrusion, but must include a means to contact outside help. There is the possibility that, in the case of a burglary, the intruder will have no interest in breaching the door or confronting the homeowner, and will leave when he realizes the family is awake, aware of his presence, and has contacted the police.

These zones, and the factors within them are merely a starting point for planning, and not an all-inclusive list. The planner should feel free to adjust the zones as they fit the specific circumstances, and discard the ones that don’t seem to apply. A zone doesn’t even have to be physical. One could create a “cyber” zone to focus on networking and communication issues. All defense in depth really does is aid our planning efforts by allowing us to focus on smaller areas of similar security concerns. Once we determine our zones, we can begin to address factors within the zone to deter an offender, or increase his exposure and chances of detection.

So You Want To Buy A Gun…

On By weshamerlyIn WeaponsLeave a comment

So, you’ve decided you want to obtain a firearm. If you have done so in the past, you know the ramifications of this decision and can probably skip down a couple of paragraphs to concentrate on security tips. If not, you might want some information on the repercussions of your decision, some good, and some bad.

The first question is: Why are you getting the weapon in the first place? Now, this isn’t a 2nd Amendment argument, and the answer shouldn’t be “I’m ‘Mercan and it’s my right!”, because that isn’t my meaning at all. The question is probably better phrased as: what is the intended use of the firearm, and is important in determining how to secure the firearm safely.

If you are going into sport shooting, i.e. skeet, trap, hunting, target shooting, competition, etc. then we treat the security measures for the firearm and ammunition very differently than we would if you are buying a weapon for home or personal defense. The worst thing you can do is go into the purchase without knowing the possible security ramifications of having a firearm around the house, thus creating new problems.

Please note, this is not a commentary on what to buy. You can get that in one of a thousand other blogs… with a thousand different opinions of the “best” gun for whatever application. My only advice here is do your research. This is also not a dissertation on weapon safety or the safe handling of firearms. That is better taught in a hands-on environment. Here we are simply going to talk about the decision itself, security for the firearm, and how it might fit into your overall security plan.

Financial effects:

The first thing you need to realize is you are not just purchasing the firearm itself. You will need sights, ammunition, cases, cleaning kits, holsters, and devices to secure the gun. Most firearms are required to be sold with a trigger lock. If it didn’t come with one, trigger locks can usually be obtained for free from local law enforcement offices. Remember that the trigger lock only stops someone from loading the gun or pulling the trigger, but this is no defense from someone walking off with the thing. You’ll probably want some kind of safe. We’ll discuss physical security in a bit.

Another financial factor is lessons and range time. If you have never worked with a firearm (and even if you have) take some lessons. They are well worth the time. One of the worst things you can do to yourself and your family is own a weapon you don’t know how to use. This is just a catastrophe waiting to happen. Shooting is a perishable skill, so after you take the lessons practice. All of this costs money, quite a bit in the long run, but good shooting skills come with time and practice, and lots of ammunition put into targets.

The point is, if you are looking at a firearm as part of your security plan, it will be an expensive part. If it isn’t part of your security plan, you will still see an increase in your security expenditures.

Standard firearm security:

So let’s say the purpose of your firearm is recreational shooting or hunting. Now that you have it you have to secure the weapon against unauthorized access. This means keeping it out of the hands of not just criminal intruders, but also from family members, such as children, to whom the weapon may pose a danger. In this case, with sporting arms, this isn’t difficult. Get yourself a good gun safe that fits the particular firearm, and have it properly mounted into the position where you will be storing the firearm. Most safes come with holes for bolts or other mounting hardware to insure someone can’t just pick up the safe and move it. Don’t just rely on a trigger lock or locking gun safe. Get something you can bolt down. Also don’t rely on the mounting hardware which comes with the safe (I’ve dealt with some which was obviously insufficient for the task). If it seems inadequate for the job, replace it with something that will work better. You want something that will discourage a burglar and take time and effort to remove. Drywall is easy to break and drywall anchors pull right out. Lag bolts into floor and wall studs or beams are much harder to break.

Safes can be fairly expensive, so if you are thinking of obtaining more firearms in the future, get one big enough to hold possible future purchases. Luckily most gun safes (with the exception of those made specifically for pistols) hold at least a couple rifles or shotguns.

In the case of sporting arms. Store them unloaded with the ammunition in a locking box separate from the firearm itself. This is a further obstacle to the possibility of an accidental discharge if an unauthorized person gets ahold of the weapon. Store ammunition in a dry place out of the magazine. Over time the magazine spring can lose tension if ammunition is stored in it for long periods leading to a weapon failing to function.

I prefer to keep the safe, ammunition, and any shooting accessories out of the view of visitors, contractors, and strangers. Firearms are high-value items and are always a target for theft. The fewer who know about them, the less of a target you will be. This falls into my general principal of limiting knowledge of your belongings to those who actually need to know.

Firearms for home and self-defense:

The first thing you need to do, before purchasing a weapon designated for home or personal defense, is to sit down and do a little soul searching. Think long and hard about if, given a situation where deadly force is necessary, you would actually be willing to take a life. If the answer is “no,” then don’t buy the gun. Pulling a gun and pointing it without the intent to use it will get you into serious trouble. Once your bluff is called the gun will be taken from you and probably used on you and your family. If not, it is now in the hands of a criminal who will use it on someone else or sell it to a third person who will use it. If you have to pull it, you cannot allow it to be taken. If you can’t use it, it’s better to not have it in the first place.

A weapon for home or self-defense adds new challenges into the security situation. They have to be stored in a manner that fulfills the above requirements of safety and keeping it out of the hands of unauthorized or unwanted persons, but also must be stored in a “ready” condition. This is to say with immediately accessible ammunition and quickly accessible to the user. Weapon maintenance will increase and magazine springs or magazines will have to be checked and replaced more often. Weapon awareness or weapon “discipline” must be constantly practiced.

Luckily there are many smaller gun safes and lockboxes on the market specifically made for home defense weapons. Again, I recommend they be mounted out of sight and make sure they are bolted down. Don’t advertise where they are. Small gun safes come with four primary types of locking mechanisms: key, combination, electronic buttons, and biometric. Of these I prefer the electronic buttons. With a key lock you will need the key close by, which can be found by children or unwanted intruders. A combination lock will be difficult to work in the dark, and takes time and light to access the gun. Biometric locks are quick and work in the dark, but are more expensive and past reviews of home defense situations have shown some altercations take place prior to the defender getting to the weapon, with the defender injured in some way. Blood on the hands and fingers could easily obscure your fingerprints and deny access to your weapon when you need it most. The electronic push button locks, in my experience, worked the best, and are much less expensive than the biometric locks for the same amount of security.

Remember to check the batteries in the safes on a regular basis. I’ve had some last for years, and some that only last about six months. Some have an audible indicator of when the battery gets low, but typically the only time you know they need a new battery is when they don’t have the energy to unlock.

Whatever you do, don’t rely on concealment alone to protect the firearm. Family members will probably know where it is, and most thieves who have been about their business for a substantial time know all the typical (and a-typical) places your valuables may be found. You might think your hiding place is unique and imaginative, but they have seen it all before. Almost every residential burglary has had the mattresses on the bed flipped. The victims are confused as to why this is. I simply say the thief was looking for the gun (whether or not there was one hidden there is immaterial). Why are the sugar and flower bins smashed on the floor? Because somebody started telling people to hide their extra keys there. The refrigerator is open and food is everywhere because some news station has recommended, as a security tip, you hide valuables in there (burglars pay attention to those tips too). Drawers will be pulled all the way out and dumped to check behind them, flat surfaces and shelves emptied, and book cases and furniture flipped. The intruder will know the hiding places. Make it hard to get the firearm even after they find the hiding place. The key here, as with everything else, is make it difficult and time consuming.

Your car can be equipped with a lockbox too. Many of the small boxes can be mounted in the automobile with bolts or cables, and here combination or key locks work just as well and are much less expensive. Make sure you check the appropriate laws regarding storage inside the vehicle, and keep it out of sight to avoid temptation of any would-be thieves. Why might you need a lockbox inside your car? Many who possess a concealed carry license will come across locations which do not allow weapons and have to leave them in their vehicles. You still have to maintain security over the weapon even if you are forced to leave it behind. It’s also a great place for your iPod or GPS while you’re gone.

Training with a weapon intended for home or self-defense is a must. Not only do you need to train to be able to use the firearm quickly and effectively, and under adverse conditions (such as in the dark with a flashlight… or not) but you must get some legal training as to when the use of deadly force is both legal and appropriate. Again, don’t rely on hearsay, seek out a professional instructor and take the time to get trained.

I recommend, if you obtain a weapon for self-defense, you take the steps to obtain a concealed carry license, even if you don’t intend to carry a weapon. Don’t buy into the hype that if you have a license you have a moral obligation to carry at all times to protect the public. You are under no obligation to carry at any time or ever if that is your desire, but the license does a couple things for you. The first (if an actual course is required in your state) is it gives you the training discussed above regarding legality and appropriateness. The second thing it does is level the legal terrain for carrying a firearm. Many jurisdictions within a state (city, county, highway, parks, etc.) will have different laws regarding the legal transportation of a weapon and ammunition. One might have no problem with a gun near ammunition within the cab of the vehicle, another might require the firearm be locked in the trunk with ammunition separated from the firearm or magazine. It is very easy to be perfectly legal driving down the road, cross a county or city line, and suddenly be committing a major felony. With a concealed carry license, most of this problem goes away and you are in a much more stable legal situation. You still have to be careful on federal land, and know those venues where you cannot take a firearm at all, but the possibility of getting arrested for violating a local ordinance goes way down. Many Concealed carry licenses have what is called reciprocity with other states, so you level the legal playing field when traveling as well.

The upshot here is know what you are getting into if you decide to obtain a firearm. Know what the purpose of the gun is before you start, and do your research. Pre-plan how to secure the weapon before you actually obtain it, because security will be an obligation as soon as it leaves the store. Get proper training in its use, and continue training to build skills. Lastly, expect the necessary financial outlay for accessories, ammunition, training, and security.

Owning a firearm, for those who have not owned one before, is a life changing event. Hopefully this little article will give you some insight into what you can expect. If at this point you re-think your plans, no problem. If you decide to continue with your purchase, all I can say is, “See you at the range.”

Social Media and Internet Security, a Common Sense Approach

On By weshamerlyIn Cyber SecurityLeave a comment

I have been asked a number of times for some basic ideas to make surfing the internet, e-mail, and social media a little more secure, so I thought I would post my thoughts here. For those who are looking for some form of reassurance that the World Wide Web is a safe and secure means of communication, I’m afraid I may not be able to help.

The first thing to be aware of is that the internet is not a safe place. If most people knew the magnitude of the threat out there, they might stay away from the internet all together. We are constant attacked from computers all over the world. Some are attempt to grab information, some try to commit identity theft, some try to control your computer to send out further messages in what is called a “bot net.” If you have installed a fire-wall that can log attempted penetrations, check the log sometime. Most computers on the internet get probed hundreds (or more) of times a day by other computers looking to find a way in. Some are from people who know what they are doing, who program their own code and look for exploitable weaknesses, others are what are referred to as “script kiddies,” who log onto hacker websites and download open source software to break into your computer. The attacks can come from almost any country. Many of the vulnerabilities they find have either been corrected or are detectable by any good antivirus, but many people just don’t get around to fixing the problem, thus letting them in.

These are some of the tricks I either use, or know about, to keep information a little more secure. This is not an all-inclusive list, but a start.

1. Create a decent password for your online accounts. Don’t use your name, a simple word, your telephone, birthday, or anything simple to guess. A hardened password should consist of more than ten characters and use capital letters, small letters, numbers, and symbols. Change the thing on a regular basis. A secure password may be difficult to remember, and many people come up with a system. If you do that, don’t tell people your system. Don’t store your passwords on your computer or cell phone.

2. Use a different password for every account. That way if one gets compromised, you have not lost them all. I know this can be difficult as many of us have a multitude of passwords for different accounts, and many companies want you to log on and use their billing systems located online to pay your monthly bills. Try your best to separate them. Remember, each one of these accounts is associated with the transfer of finances and has your personal information. A little extra time is worth the security.

3. Do not share your passwords with other online applications. Facebook used to have app that allowed it search your e-mail address book for others on Facebook. All you have to do is give it your password. Problem is if someone gets into your Facebook, they can now access your e-mail.

4. Keep your e-mail address book on your local machine. That way if someone does get your password, they are limited as to who they can send messages to. It also makes it simpler to re-create it later. One method is to use a mail program on the local machine such as Outlook. It simply goes to your e-mail, pulls down the mail, and clears the server. It keeps all your addresses local.

5. Do not get too attached to your e-mail or social media account. Accounts out there are free, if one gets hacked, burn it and get a new one. Use it to send to all your friends your new address and the fact the last one got hacked. This is another good reason to keep that address book on your local machine.

6. Get a good virus detection program, and a good fire-wall. Keep them up to date, and use them. If they tell you something is wrong, listen to them. A good virus scan will have a link to a database which will tell you about the detected malware or intrusion, and what to do about it.

7. Strive for anonymity online. Don’t tell every online application who you are. They are computers, they will not be insulted if you don’t give them your full name, address, phone number, or date of birth. You are not required to do so, and if you are, you might want to re-think signing up for them, or at least ask why. Some of you might have noticed I have a weird e-mail address for standard correspondence: “wesany.” This came from Google asking my first name (I said Wes) and them my last name (I shrugged my shoulders and said “any”). When I give up on this e-mail, get hacked, or start getting too much spam, you will get to see a new e-mail: “weswhocares,” or “wesnoneofyourbusiness,” or maybe even “wesgojumpinthelake.”

8. Do not click the box on Facebook or your e-mail that says “keep me logged in,” particularly on a public computer system. This creates a cookie on your machine which tells the website who you are and to log you back in. If your computer gets hacked, I suspect the cookie can be too. Log in each time.

9. Know who you are talking to. Do not respond to e-mails wanting you to confirm your bank or credit card information, your password, or your pin numbers. Your bank is not going to close out your credit cards for not responding to an e-mail, and probably has a policy in place not to send an e-mail asking for it in the first place. If you have a question on something you receive, call them using a phone number you look up yourself (don’t use the one from the e-mail). That way you know who you are talking to. You also will not be notified by e-mail of outstanding warrants, tax bills, traffic tickets, or lottery winnings (how did these people get your email in the first place). Nobody is just going to come out of the blue and hand you great wads of money.

10. Last, for now, if you get an email from someone you don’t know, delete it. Don’t open it, just pitch it into the burn bucket. If it has a strange subject or no subject, burn it. If it is from someone you know and seems fishy (like I’m trapped in England and need money), check with the person by some other means, then burn it. Look at the address of the sender. If the IRS does send you something it will not have a .com domain (although even .gov can be spoofed these days) Look for foreign domains such as .ru from Russia, .cn for China, or .cu for Cuba. Do not click the links on these e-mails, and do not download the attachments. If it seems too good to be true, it is.

The thing to remember is to consider anything you post online as public, and can be seen by everyone (I don’t care if you have your privacy settings on “friends only”). If you have something you think is a scam e-mail there are plenty of sites online which will help you confirm it.

I’ll revisit this subject in the future, and hit on more specific threats and remedies. Till then, happy and safe surfing.