Security management

Security risk management

The management of security risks applies the principles of risk management to the management of security threats. It consists of identifying threats (or risk causes), assessing the effectiveness of existing controls to face those threats, determining the risks' consequence(s), prioritizing the risks by rating the likelihood and impact, classifying the type of risk, and selecting an appropriate risk option or risk response. In 2016, a universal standard for managing risks was developed in the Netherlands. In 2017, it was updated and named: Universal Security Management Systems Standard 2017.

Types of risks

External

• Strategic: Competition and customer demand.
• Operational: Regulations, suppliers, and contracts.
• Financial: FX and credit.
• Hazard: Natural disasters, cyber, and external criminal acts.
• Compliance: New regulatory or legal requirements are introduced, or existing ones are changed, exposing the organization to a non-compliance risk if measures are not taken to ensure compliance.

Internal

• Strategic: R&D.
• Operational: Systems and processes (H&R, Payroll).
• Financial: Liquidity and cash flow.
• Hazard: Safety and security; employees and equipment.
• Compliance: Concrete or potential changes in an organization's systems, processes, suppliers, etc. may create exposure to legal or regulatory non-compliance.

Risk options

Risk avoidance

The first choice to be considered is the possibility of eliminating the existence of criminal opportunity or avoiding the creation of such an opportunity. When additional considerations or factors are not created as a result of this action that would create a greater risk. For example, removing all the cash flow from a retail outlet would eliminate the opportunity for stealing the money, but it would also eliminate the ability to conduct business.

Risk reduction

When avoiding or eliminating criminal opportunity conflicts with the ability to conduct business, the next step is reducing the opportunity of potential loss to the lowest level consistent with the function of the business. In the example above, the application of risk reduction might result in the business keeping only enough cash on hand for one day's operation.

Risk spreading

Assets that remain exposed after the application of reduction and avoidance are the subjects of risk spreading. This is the concept that limits loss or potential losses by exposing the perpetrator to the probability of detection and apprehension prior to the consummation of the crime through the application of perimeter lighting, barred windows, and intrusion detection systems. The idea is to reduce the time available for thieves to steal assets and escape without apprehension.

Risk transfer

The two primary methods of accomplishing risk transfer is to insure the assets or raise prices to cover the loss in the event of a criminal act. Generally speaking, when the first three steps have been properly applied, the cost of transferring risks is much lower.

Risk acceptance

All of the remaining risks must simply be assumed by the business as a part of doing business. Included with these accepted losses are deductibles, which have been made as part of the insurance coverage.

Security policy implementations

Intrusion detection

• Alarm device.

Access control

• Locks, simple or sophisticated, such as biometric authentication and keycard locks.

Physical security

• Environmental elements (ex., mountains, trees, etc.).
• Barricade.
• Security guards (armed or unarmed) with wireless communication devices (e.g., two-way radio).
• Security lighting (spotlight, etc.).
• Security Cameras.
• Motion Detectors.
• IBNS containers for cash in transit.

Procedures

• Coordination with law enforcement agencies.
• Fraud management.
• Risk Management.
• CPTED.
• Risk Analysis.
• Risk Mitigation.
• Contingency Planning.