What can an organization do to protect its people in the event of an attack? What can it do to prepare for one?
Often, security planning is about preventing an attack. But no security system can eliminate all threats. Organizations also need to be able to detect potential threats, respond when an incident occurs and recover from it.
The fallout from an attack can reach far beyond its direct target. An attack can hurt workers, limit access to facilities, disrupt vital services and lead to long-term financial and operational consequences for an organization. Planning for these eventualities before an incident can lessen the impact and help an organization recover.
The Cybersecurity and Infrastructure Security Agency (CISA) provides resources to help organizations develop security plans to protect people, property and operations. The Federal Emergency Management Agency’s (FEMA) National Incident Management System (NIMS) provides a framework for organizations to prevent, protect against, mitigate, respond to and recover from incidents.
Prevention Starts With Understanding Risk
The first step in protecting an organization is knowing what to protect.
Organizations need to identify critical assets, personnel, facilities and operations and determine where vulnerabilities exist.
Security must also be layered. Components of a comprehensive security program may include access control, security personnel, surveillance, physical barriers, lighting, emergency communications and employee awareness.
There is no single measure that can prevent all attacks. Instead, a layered approach offers more opportunities to deter, detect and respond to a threat.
People are also part of prevention. Employees need to know how to report suspicious activity and who is responsible for considering those reports. CISA’s physical security resources focus on what individuals and organizations can do to spot and report suspicious activity.
The aim isn’t to turn employees into investigators. It’s to make sure that potentially important information gets to the people who are responsible for evaluating it.
Preparation Before an Attack
No matter how good the preventive measures are, some level of threat will always remain.
Organizations therefore require contingency plans that set out what personnel should do when an incident occurs. These plans should define responsibilities, communication procedures and coordination with emergency services.
Preparation also requires training. An emergency written plan is only useful if employees understand it and can implement it under pressure. CISA provides resources to help organizations develop emergency action plans and train personnel to respond to active-threat incidents.
Preparation should also involve people with different needs. Employees or visitors may have disabilities, medical needs or other conditions that affect their ability to evacuate, shelter or communicate in an emergency.
Organizations should periodically review their plans and exercise them as appropriate. A plan is not a document that you write once and then file away. Threats, personnel, facilities and operations change over time, and security plans must change with them.
Detection and Early Warning
There is no way to stop every attack. So another important aspect of security is the early detection of possible threats.
Organizations may have procedures for reporting suspicious behavior, threats and other security concerns. They may also use security systems, access controls and trained staff to identify activity that may require further assessment.
But a potential threat does not necessarily translate into an imminent attack. Reports should be based on what can be observed and what is known, not on assumptions about a person’s identity, appearance or background.
The idea is to identify relevant warning signs without scaring people unnecessarily or confusing normal behavior with suspicious activity.
Responding When an Attack Occurs
An attack changes the priorities.
The priority is to save lives and prevent further harm. Personnel should follow their organization’s emergency procedures, evacuate when appropriate, shelter in place when directed to do so or when conditions warrant, and call emergency services when it is safe to do so.
During a crisis, communication becomes even more important. Organizations need a reliable way to provide employees with accurate information and to cut through the haze of rumors.
Response requires coordination, too. The same incident can involve police, fire, emergency medical services, security personnel and organizational leadership. FEMA’s National Incident Management System (NIMS) emphasizes coordinated incident management and common processes among government agencies, nongovernmental organizations and the private sector.
An organization doesn’t have to deal with a major incident alone. Effective preparation can help establish relationships and communication procedures before emergency responders are needed.
Recovery Begins After the Immediate Threat
The attack does not always mean the end of the emergency.
Organizations may need to account for personnel, provide medical or other support, secure impacted areas, communicate with employees and stakeholders, and determine whether normal operations can resume.
Some organizations may need to evacuate personnel from the affected area or temporarily suspend operations. Others may have to restart vital services as investigators try to determine what happened.
FEMA’s National Incident Management System (NIMS) guides organizations to prevent, protect against, mitigate, respond to, and recover from incidents.
The recovery process should also take into account the people impacted by the incident. Employees may suffer physical injury, financial disruption or emotional impact even after the immediate threat has passed. Supporting staff can be a critical element of an organization’s recovery.
Learning From the Incident
An attack should also be an opportunity to identify weaknesses.
Organizations should review their response after an incident to examine what happened, what worked, what failed and what could be improved.
The point is not simply to place blame. It is to see what can be changed.
If the security system doesn’t catch a threat, it may need to be updated. An emergency plan that caused confusion may need to be rewritten. If the incident revealed that the communications system failed, an alternative may be needed. Training may have to be tailored to the real-life experiences of personnel.
These findings should then inform the organization’s next security assessment.
Security Is a Continuous Process
No organization can guarantee that it will never be attacked. However, it can determine how prepared it will be if one occurs.
Effective security means more than guards, cameras, barriers or emergency plans. It is a continuous cycle of risk assessment, vulnerability mitigation, personnel training, threat identification, incident response and lessons learned.
The best security plan, then, is not simply the one that tries to stop an attack.
It is the one that prepares an organization for what comes before, during and after it.