The Security You Can’t See

It’s easy to assume that adding security will automatically make an environment safer, but every security measure comes with its own risks and consequences.

I’ve had discussions about whether armed security should be added to an environment because there was a concern about safety. The initial thinking was fairly straightforward: if there is a potential threat, having an armed security officer provides another level of protection.

My concern was that we also needed to consider what we were introducing into the environment.

If you place a firearm into a relatively small, controlled location, the firearm itself becomes part of the risk assessment. You have to consider the threat that justified it, the training and experience of the person carrying it, the possibility of the weapon being taken during an altercation, the response of employees and customers, and the liability that comes with having it there.

There are absolutely situations where armed security is appropriate, but the decision should come from the risk assessment rather than the assumption that an armed presence is automatically safer.

I take the same approach with security technology, staffing and physical controls. Before adding something, I want to know what problem we’re trying to solve and whether the proposed solution actually addresses it. A company can spend a considerable amount of money adding cameras, guards, access controls or technology without fixing the vulnerability that created the concern in the first place.

There is also value in the perception of security. I’ve always believed that you don’t necessarily need to show someone every security measure you have in place. In some situations, creating uncertainty about what is being monitored, what controls exist and how quickly an organization can respond can be an effective deterrent on its own.

If someone considering theft or another criminal act can easily determine exactly where your security begins and ends, they can also begin looking for ways around it. I would rather create an environment where they aren’t quite sure what they can see, what can see them, or what might happen next.

That doesn’t replace good security controls, but it can make the controls you have more effective. The goal is not always to build the biggest visible security presence; Sometimes it is to create enough tension and uncertainty that the person considering the act decides the risk isn’t worth it.

Consider This

When evaluating a security measure, consider more than what you can add. Look at what the actual threat requires, what your existing controls already accomplish, and whether the security presence itself can create enough uncertainty to deter the behavior.

Not every control needs to be obvious, and not every capability needs to be visible. If someone cannot easily determine where your security begins and ends, that uncertainty can become part of the deterrent.

Effective security isn't always about showing everything you have. Sometimes it's about making sure no one is quite certain what you have.