Security Procedures for Dummies, Chime in and add some... Options

[Scope_47]

Ok, so in the game I'm playing in my character has a security consultation business as a cover. So she hit this building in a run that had security that was so bad that she wanted to fragging cry... Ironically, three days later they hire her to come in as a security consultant. Aside from firing Skippy the wonderguard (long story that should be shared, but not tonight...), she beefed up their general security signifigantly before nearly suffering an annurism at the management's sheer idiocy. Well, so that he could determine how much she got paid, my GM had me write a 'cliff notes' bullet point version with bonus for humor (he limited length though).

Anyway, I thought I'd share the list and see if anyone had any to add...

• Proper maintenance of building and security devices!!!!
•
• Hiring standards should be higher than the local Stuffer Shacks, offer standard guards 10% higher than minimum wage
•
• Hire shift supervisors who are better trained and can keep the standard guards alert and following procedures
•
• Hire two security chiefs – one night and one day. Security chiefs are managerial positions who handle hiring/firing of security officers, note problems, and act as liaisons between security and management. Shift supervisors report to the security chiefs, who report to each other.
•
• Top-down security. Management must NOTIFY security of any abnormal deliveries etc. Security is not to allow anything without notification.
•
• Offer security employees the option of benefits and slightly lower pay. Those that take the benefits are the better employee because they have a vested interest in keeping their job
•
• A verbal order never happened… only written orders are accepted.
•
• If something didn’t happen because a guard wasn’t notified, drek does not roll down hill… punish the fellow with whom the paper trail (see above) ends, don’t scapegoat the guard
•
• Have every guard partnered with another guard. An area shouldn’t be left unsecured because someone needed to take a leak
•
• Shift supervisors do not have a post, they wander and check up on the other guards or investigate problems.
•
• Random (shift supervisor assigned) posting assignment each night – keeps guards from knowing in advance where they will be and prevents inside jobs. + it keeps honest guards interested with variety
•
• Guard partners will not be reassigned unless unusual circumstances are observed by the shift supervisor – guards should get to know their partners well enough to notice and report abnormalities in behavior.
•
• Random patrol paths randomly pick what order to check floors in, whether to take stairs or one of the three elevators, etc
•
• Check a room on each floor at random on each patrol – checking a room entails ENTERING it.
•
• Shift information that is determined randomly should never be entered into a computer, the shift supervisor should keep this information in hardcopy on his person.
•
• Tardiness will not be tolerated in a security force
•
• Early arrivals and late-to-leaves will be recorded by the on-duty guards to determine patterns.
•
• ANYTHING out of the ordinary will be investigated, but the acting guards MUST radio in the abnormality BEFORE investigating
•
• Place designated smoking areas near ingress/egress zones. Make the security station a designated smoking area
•
• Place vending machines in the security station – make money off your employees and ensure that they are neither hungry nor contemplating breaching security by ordering take-out.
•
• Guard dress code should be strict enough to present a professional appearance at all times, but should have allowances for personal firearms and body armor -during non-business hours especially.
•
• Guards who will be late to or absent from work must notify the shift supervisor, the security chief, AND his partner. If a guard fails to notify all three, then for that night/day security should be on high alert, and that guard should be reprimanded for the breach of procedure.
•
• Security officers are NOT tour guides! They have a job to do, and they can’t do it babysitting someone.
•
• Handheld olfactory sensor and MAD scanner should be kept in the security office. If a guard finds a suspicious bag/purse/briefcase etc, an officer should bring the sensors and investigate. Once safety is determined, lost objects are to be kept in the security office, and a copy of inventory list given to reception. People looking for lost objects ARE NOT allowed in the security office – they must describe the object to the on-duty officer and allow him to retrieve likely candidates.
•
• Security office is off-limits to non-security personnel. PERIOD.
•
• Mean-spiritedness is not an anti-hire factor in guards – just place these fellows on the night-shift. Security need only be cordial during business hours.
•
• ALWAYS retrieve keys and keycards when a guard’s employment is terminated
•
• If somebody loses a key or keycard, all locks matching that item must be rekeyed at the culprit’s expense. If this is a large amount, it is encouraged to spread it out over a large number of paychecks to make it a bearable burden.
•
• Offer incentives to employees who strive to keep the work environment safe and secure – this includes ALL employees, not just security
•
• Offer incentives to security officers who point out problems (examples: “the maglock opens if you jiggle the brick,” “Chief Higgins is developing alcoholism”)
•
• Instability at home leads to instability in the workplace. Instability in the workplace leads to an increased chance of a security breach. Be accommodating of employee’s personal lives when making work schedules, and allow leaves of absence (unpaid) for legitimate psychological needs. However, employees who make excessive (as determined by shift supervisors and chiefs, with guidelines provided by management) use of this policy should be evaluated for termination as a security risk. This policy may be applied to non security personnel as well at the option of management.
•
• While hiring someone who has already been trained may be appealing, former security officers of a another company may be a bad investment – do a thorough background check and determine the cause of their prior termination before making a hiring decision.
•
• Ability IS a valid criteria for hiring an officer. If a security officer is not physically fit enough to for example climb five flights of stairs quickly to provide backup to another officer, then he is of little use in the event of a breach. Also, a handgun in the hands of an untrained user is frankly dangerous.
•
• Day shift officers should be clean-cut, cordial, friendly, sharp-looking, etc. They should also be armed with a light (NOT HEAVY) pistol. It makes people feel safe and protected, but doesn’t intimidate the workplace.

[hyzmarca]

Don't bother with metahuman security; use robots, instead.
You can get surplus ED-209s pretty cheap.

[Pyritefoolsgold]

[hyzmarca]

The ED-209 uses a high-rating robot pilot and will not accept any external commands once activated, thus making hacking very difficult.

[Garrowolf]

For one you need to eliminate the need for guards as much as possible. An efficient security system has maybe two guards at night.

People are trying to solve security problems the wrong way with security most of the time. Security guards are not there to protect a building. They are there to provide choice and human interaction. They are there to act as a witness. A person can't protect a building that well.

Okay. If you want to secure a facility you have to first figure out what kind of area it is. There are three basic areas: Public access, Limited Access, No Access. Public Access is where you put a guard to be able to direct people. They will usually handle phones, logs, and dispatch. They might handle traffic flow at a gate.

Then there is Limited Access. This means that there are going to be people in this area that belong. This could be cleaning crew or night shift. This area should be covered by key cards, cameras, and a roaming patrol. You should also make sure that it isn't easy to see from the outside. That way they don't know what occurs when.

Then there is No Access. The guard should do a round in this area every once in a while if there is no better way to deal with this. A better way is to seal it up after a patrol and set alarms. For Shadowrun you have drones then let them sit at choke points. Any movement sets of an alarm. Any door use sets off an alarm. Any activity on any scale sets off an alarm. Blow air from the floor to suspend a cloud of RDID tags. If someone walks through then the alarms go off.

If it is a highly secure facility then you have a spyder to monitor. You would also have another guard who is not rigging watching a bunch of monitors that highlight anything going on there. Never have a guard within sight at a door way.

Have airlock style doorways large enough to hold several people so that you can isolate anyone that is a problem. Elevators are good for this. You can force the elevator to go into a cage area to control them. Have glowmoss at checkpoints as well.

Bury secure rooms under living ground. Put lots of bacteria cultures and stuff in the walls and doors.

Don't use human patrols on the perimeter. Use good sensors and drones with clear fields of view. Humans get tired too quickly with repetitive tasks. Don't have the drones move. Have enough drones to cover the whole area. Have the drones fire paint balls with a sleeping agent, DMSO, and a bunch of RFID tags upon first contact. That way they don't kill someone that they shouldn't accidentally, they can highlight them if they try and go hide and can track them easily for anyone on the base to shoot at later. If the target returns fire and destroys the drone then they have done their jobs and every other drone will be watching for them. Then send heavy combat drones after them.

Put walkways for drones and security beside normal hallways with one way glass in between.

Put in pressure plates on random floor tiles that go off if they don't have motion as well.

[TheOneRonin]

I second the comments about automated security. I do IT work for a company does a lot of contract work for the DoD, and security is a big deal here. Having been forced to sit through security briefing after security briefing, I'd say that Garrowolf and Hyzmarca are dead on. The weakest element in ANY security plan is the human element. Your secure areas are far more likely to be breached because an irresponsible employee lost his/her ID card rather than by someone tinkering with the electronics of the card reader.

In my games, there is rarely any physical presence in Corp Offices after hours. Most of the electronic security is focused around threat detection. The on-call sec team is on standby to respond to any alerts/breaches. All security systems are monitored from an off-site location. A sec company like Knight Errant might have 3 or 4 dozen such monitoring stations scattered around Seattle, and probably have several response teams scattered about the area as well. Got intruders at Bob and Bob's Shipping in northern Tacoma and the Response team is deployed elsewhere? Send in the the south-downtown sector team.

A big part of the reason physical security shows up in SR is for the players to have a (meta)human opponent to confront. But it really doesn't make sense. My response teams do make sense, and give the runners that opponent, IF they don't manage to get out before the FRTs drop in. A sense of urgency is always helps motivate the runners to get the job done and get out.

[nezumi]

As has been said previously, technical security should be at the fore-front, with human security offering a secondary line of defense.

Technical security includes:
-Overlapping cameras of ALL approaches to the building, especially around doors, windows, parking lots, etc. In this day in age, don't be afraid to put one just watching over the roof either. Cameras should be paired with motion and heat detectors for more robust threat identification.

-The entire area should be well lit. Lighting alone is one of the single greatest deterrents to crime. Light the parking lot, every wall, and major hallways. This should work with cameras to increase their effectiveness.

-Take advantage of chokepoints. Limit access to two or three entrances. All entrances should have cyber scanners and MADs. There's no real reason to ever turn these off, even if they're unmanned. A person walking by a MAD with metal will still sound an alarm. Chokepoints should be well lit, under surveillance, and generally feed into a security desk.

-Onion defense - do not set a single, tough perimeter defense and leave the gooey center open. Defenses should be stacked behind defenses. Exterior windows should have hedges in front. Most, if not all doors (excepting lavatories) should be locked to prevent entrance (exit may be okay, depending on your policy).

Everything should be connected to a dedicated host disconnected from the matrix. The security controls should not be accessible from outside of the building, likely restricted to a few controlled rooms (so no wireless).

In regards to personnel security:
-Use frequent shift breaks. Studies have shown that perception drops 90% within the first hour of watching a camera.

-Use reasonably sized shifts, nothing over 8 hours. Sure, it might be cheaper, but it greatly decreases the effectiveness of your guards if they're asleep on the job.

-Fire escape plans and security response plans should be part of regular employee training and should be tested.

[cetiah]

If you want to (slightly) increase the humor level, picture yourself telling this to an Idoitic Executive Manager. Next, imagine the IEM asking supidly, "Why?" and write your answer after the bullet point.

• Tardiness will not be tolerated in a security force

Can you imagine your response to a manager who looks at you curiously and asks, "Why not?"

For example:

• Check a room on each floor at random on each patrol – checking a room entails ENTERING it.
There are squatters that have been living in room 204 for months now.

[Rotbart van Dain...]

[Scope_47]

Yes, automated security would be the best... but its also prohibitively expensive... the premise for the original list was that the company wasn't big enough to afford a budget for that sort of stuff. Metahuman guards are much cheaper than all that automated stuff. While you might say that its high overhead low-upkeep, remember that regular maintenance is needed, plus software updates, physical upgrades, etc. In the end, the team of ten guards per shift is much lower... and since the company is small, if the shit really hits the fan they can call in Lone Star on the city's tab due to the municipal contract.

- Scope

[Moon-Hawk]

[TheOneRonin]

Yeah bud. Moon-Hawk is spot on. Electronic security is far cheaper, especially in the long run, than (meta)human security.

[stevebugge]

[Wraithshadow]

Let's see here...

Keep all doors and windows clear of obstructions. You want a clear line of sight to all of them not only from inside but also from outside- a hedge in front of a window is a place someone can hide while they open the window. If you really need that hedge, replace it with something that's not going to be pleasant to sit in- whether that means poisonous plants (like poison ivy) or cultivating hornet's nests inside it.

Autonomous, sense-and-alert alarms. Sound-based, thermal, whatever. In 2007 you can find them as toys, you should be able to get them very cheap in 2070. Something you can put in a room, turn it on, and it'll scream if it detects something. No Matrix link, no wires, no connection to the power supply. Keep 'em out of LOS of any windows or doorways, so you have to set them off to get near them.

Fisheye lens mirrors. Set them up so you can see around corners, under stairwells, or to either side of the door you're about to walk out of. Cuts down on ambushes.

Cycle through the guy on monitor duty. Sitting at a desk staring at a screen where nothing's happening gets old fast- and people miss things when they get bored. Either get someone to write some sort of game program to keep their attention (more below) or rotate the guy at the desk regularly enough that they won't fall asleep or bring in a handheld.

Spot And Poke - This is a simple program for security monitors. The program repeatedly places a target somewhere in the image, partially camouflaged from view. The individual watching the monitor must repeatedly search for and click on the target, gaining points for speed and winning streaks. The program encourages security personnel to pay attention to the monitor, avoiding boredom. If the pointer becomes inactive for more than 5 minutes, the program sends an alert to a selected commlink (usually a supervisor). Turning off the program also sends an alert. High scores, winning streaks, and names for up to 200 individuals can be stored in the program, allowing security personnel to compete with each other.

[Ravor]

Of course if I remember correctly, the "drones are cheaper then meta-humans argument" is always based off what I view as the false premise that the corps would pay anything close to a livable wage to their grunts.

However, I seem to be in a tiny minority with my ideas on what the life of an average Wage-Slave actually entails.

[nezumi]

1) If you want to argue about putting hedges and bushes in front of windows, don't bring it to me, refer to all of the physical security experts who made the rule up. Look anywhere, the rule of thumb is put obstructions in front of anything you don't want people to have access to. Ultimately, cover is less of a benefit than an obstruction is a detriment, especially in the case of bushes which hurt, make noise, and leave evidence of passage. If it's a big, fat bush you can easily crawl into, yeah, that's stupid, but a proper hedge is very difficult to get through or hide in.

2) If my job were to play "point and poke" for 10 hours a day, I would kill myself. I expect most guards would agree.

[Wraithshadow]

[Garrowolf]

The sheriff thing applies mostly to houses. Most commercial buildings have no ground floor opening windows.

People are not cheaper then sensors. They are much more expensive. You could put a sensor on every door in your building and cut the number of guards down to a couple much cheaper then having enough guards to walk all those halls.

Also you don't want shift supervisors able to fire. You get into personality conflicts too much. Tardiness doesn't matter that much as long as the other guard doesn't leave until releaved. Once a room is locked you shouldn't enter it again. Just check the doors.

Having worked security for ten years you would not be able to run security with a lot of this. People keep mistaking security for police or military security. They are there to sort out the crap and monitor. The more you have them operating outside of that then you have problems.

It's not that it wouldn't make it more secure. It's that it would force a level of tension on the guards that would wear them out too quickly. You would end up with having NO guards to secure your place because they all quit. I've seen it several times. You limit access, alarm everything you can, and have guards only at choke points. The rest is beyond what guards can reasonably do.

[kzt]

To keep a shift covered 24 hours a day requires 7 people if you are working normal 8 hour shifts. (That's the number from a guy who was a security manager for a large corporation.) Assume you are paying McDonalds wages, which right now seems to $7/hr. That means each guard station costs $98,000 per year in salary alone.

In current vague numbers: A camera and the DVR slot is something like $2500 per, electronic access control on doors is something like $3000 per pair of doors. So you can buy a hell of a lot of access control and cameras for the cost of 10 guards.

And if you are paying only $7 per guard it should be pretty easy for shadowrunners to get hired, as the constant turnover and short-staffing means they are always hiring guards, and you can't be too picky at essentially minimum wage.

Getting hired on for security or the cleaning crew is a greatly underrated technique to break into a fairly secure site.

[Jaid]

seriously, to set yourself up with a single security drone, it costs 3k for a doberman, maybe another 500 for a weapon (smartlinked taser, for example), and then if you want a drone with 4 pilot 4 autosoft it costs another 10k for pilot, 2k per autosoft. but at that point you've got a drone with perception that's beating the human guard you would have hired by two dice.

add in sensors to taste.

point being, if you're really too cheap to upgrade your drone, you can get a drone which is probably as good a security guard, if not better, as a human version, and it will cost you 3500 nuyen. never mind 5 years for that to break even, you're probably looking at 5 months, tops.

[Aaron]

You don't even need a pimped-out drone. A few Fly-Spies or Microskimmers and you can increase the area of influence of a pair of armed guards from a few dozen square meters to a few hundred.

[Fix-it]

[ShadowDragon8685]

Okay, here goes...

1: THOROUGH background checks on ALL employees. If you don't know them at least as well as the UCAS Department of Investigations, you're inviting security risks.

2: Train your guards not to play hero. Not only does it get you out of death pay-outs, but a living guard who understands that if confronted with firepower, their job is not to get into a shoot-out, it's just to get the hell out of Dodge and call Lone Star, is a good guard.

Remind your guards; they are not Shadowrunners, they are not trid heros, they are not Spec-Ops retirees (not even if they are). They're there to guard the premesis from the routine menace. Their light pistols are to make the wageslaves feel safe, and to control said wage-slaves if they get out of control, or possibly to control very minor disturbances if the boil into the premesis.

Not to have shoot-outs with gangs of highly-armed, highly-motiviated, highly-skilled, and obviously superior hardened criminals.

3: Forget completely about having the camera screens monitored by a living guard. They just can't do it, and a program to monitor the feeds can do it much more efficiently.

4: Don't trust RFID chips, especially during the after-hours. Every security patrol and other person in the building should intersect with a security patrol at least twice an hour, with confirmation being needed from the security patrol.

[kzt]

[hyzmarca]

Even the best background check doesn't stop any half-decent mage from Alter Memory-ing him until he thinks he's James Fucking Bond your company is a front for SPECTRE.