For Security, Details Make the Difference

March 1, 2003
If there's one crucial point to be made about security, it is that it can't be "security-light." You can't have the illusion of security, as in mounting

If there's one crucial point to be made about security, it is that it can't be "security-light." You can't have the illusion of security, as in mounting cameras in your dock that you never turn on or view. Nor can there be just the perception of security, as in hand searching through luggage and removing credit-card-size SwissCards that contain miniature scissors and nail files. Systems with the function of security must be real. U.S. airports are a classic example of security illusion and perception versus reality. Before and after September 11, they had security guards, baggage scanners, locks on doors and hiring procedures. The difference between then and now is in the execution of those security elements. The new group of guards can and will run down a concourse to chase someone racing through. Every employee no longer knows the one password that opens all doors. There is more than one password now. And airport human resource departments now do background checks before hiring.

Sometimes, good security is no more difficult than actually executing the plan. Maybe that's all that needs to be done; just develop a good plan and actually execute it. Attend to the details! We've been sloppy in the past, taking for granted that we are immune to attack or that a few billion dollars in "shrinkage" is acceptable loss.

Well, now we know better, but that doesn't mean we need to go overboard to improve security. Maybe all we need -- in airports, at ports, in warehouses and DCs -- is to analyze our vulnerabilities, develop a plan to eliminate or protect those vulnerabilities, and effectively execute that plan. The key word is effectively.

We don't have to trade our civil liberties for security. It's an issue you will face when you decide what security devices to include in your plan. Fingerprints and cameras, for example, are obvious tools that can be abused, going too far in the name of security.

The paranoia and fear in our nation today may be creating more security nightmares and difficulties than are necessary. We are already intimidated. When, for example, was the last time you laughed at something someone said to you in the screening line at the airport? More likely you were thinking of not doing anything that might alarm a guard and delay your trip down the concourse. Now, think about this: Did you blink at the loss of that particular civil liberty?

Perhaps all we need do for better security is attend to the details of systems already in place. (You could argue that that is what airports should have done, but no one took security seriously then.) That means, making sure you actually have security policies and procedures. Ensure your employees know what they are. And make sure your policies are effectively (versus carelessly) implemented.

Then, be realistic about what security measures will and will not do. Installing security systems won't remove all risk. No system can. A police office located in a neighborhood won't stop all crime. A firewall won't prevent computer viruses from getting in. However, security systems can help you investigate breeches and help you reach a successful resolution of them. Crime scene investigators can help catch criminals. Computer and Internet intrusion detection systems can help minimize damage and catch hackers.

Security is important and should not be taken lightly. Part of our security problem is that we all have been careless with it.

We can no longer avoid the details. Our protection as well as our freedoms are at stake.

Leslie Langnau, senior technical editor, [email protected]