The Security Institute Conference 2010

Thursday AM and I have had some time to reflect on the last two days. All in all not a bad conference some interesting speakers (and if i am honest some not). I have walked away with some newly acquired knowledge and a few good contacts who I will email later today.
The thing with conferences is it's probably impossible for the organisers (who did a great job by the way) to provide speakers who are relevant and of interest to all the attendees but the common theme was security - or rather 'Security Art or Science' and at times we appeared to wander from this path. To be a little more specific there were at least two speakers who just simply gave a breakdown of the work they and their teams do - which was not inline with the conference portfolio and if I am totally honest I found it a little self indulgent. There was also one speaker who mentioned security twice throughout the entire presentation and is 45mins of my life that i will never get back.
Before anyone asks I don't mean the presentation by 'The Colourworks' which was great and very thought provoking, non 'security' related yes but very relevant to building a more effective and dynamic team.
I thought Lord Carlile was great and what a fantastic president for the SyI bearing in mind the roles past and present he has held.
So the big question for me is still around the institute acquiring Chartered status and how this will be obtainable by me and other members.......I guess it's out of my hands and one to keep a watching brief on.

Below is brief breakdown of the two days:

1330: CoLP a good insight into the work that is being carried out by the NFIB.
1246: Lord Carlile a very worthy president of the SyI.
1151: Azeem Aleem is talking convergence, what an interesting subject. A very knowable presenter and a few bits to take away and think about.
1132: William Hill 30mins in and security has been mentioned once.
1047: Mitchell's and Butlers a basic presentation to a group of experienced security professionals.
0940: Bill Butler from the SIA was interesting. I wouldn't want his job for any amount of money.
0900 Day 2: Don Randall was funny and gave a good insight into the work around acquire Chartership, the register of security particinors and the WCoSP.
1802: End of day one. It's been an entertaining afternoon and we have had some interesting speakers (Hostage UK was my favourite). Let's wait until the end of tomorrow for my overall thoughts. Time for a beer.......the BBQ starts at 7pm.
1721: You and your team - unleashing the x-factor.......very entertaining and interesting actually quite thought provoking!
1623: Hostage UK are on, maybe one day I might need them if I spend anymore time in Croydon! A very interesting presentation from a knowledgable presenter. That's one business card that I will hopefully never need to use!
1500: The Art of the Forger seems to be a debrief of successful UKBA 'jobs'. Entertaining but I question if its relevant to the audience at the senior level of them (not me) are at?! More useful to a bunch of HR managers.
1436: Just had a whirlwind tour of Risk Management. Audit and review were mentioned but a little negatively I thought! Ummm some education needed.
1345: Things have kicked off.......hold on tight.
1135: What a great location! Let's hope the content is up to scratch.

- Posted using BlogPress from my iPhone

How to Provide Security Assurance in 9 Easy Steps!

The following is proven to work across all security disciplines including Physical Security, Personnel Security and Electronic Security. I know the thought of inviting Auditors into your areas of responsibility is a little daunting but if used correctly this can really be a very effective tool and can also be utilised to provide some free consultancy advice.

In conjunction with management you should produce and deliver an Annual Programme (1) of risk based audits aimed at ensuring security risks are identified and effectively managed. It is more than useful to obtain senior executive level approval that is communicated throughout your organisation and that clearly sets out the objectives, authority and responsibilities of the Department conducting these security audits.

Once high level approval is obtained you need to develop a structure as to how these security audits should be done and who needs to be involved. Below is an idea for a structure that could be adopted once the business area or security risk owner (also known as an auditee) has been identified.

A Planning or Opening Meeting (2) should be arranged with you and the auditee to agree areas of scope and to gain a better understanding of their business area. This meeting will include discussion of: appropriate questions to enable the level of risk maturity to be determined, confirmation of your understanding of the purpose of the area under review, the objective and scope of the audit, agreement of the key risks, any concerns risk owner may have which need to be addressed and agreement of key contacts and dates. This information then sets out the detail that is captured in an Engagement Letter (3) and once complete this letter is issued to the principal auditee(s) before fieldwork starts. I see the engagement letter as an essential document because it enables and drives the auditee and other key staff to have an input into the audit, clarifies the work that will be done, confirms the timing of the audit, ensures that the appropriate resource has been assigned to the audit, and establishes responsibilities of all parties.

Once you have identified your resource, the security auditor/advisor/manager should create a security audit programme. The purpose of the Security Audit Programme (4) is to set out in more detail the actual testing and work that will be carried out to address each of the areas in the scope. The programme is used as a basis to effectively align the Fieldwork (5) with the risks to be reviewed. The audit programme is the document that will focus on testing the effectiveness of the security controls and other risk mitigations in place to manage the most significant risks.

Fieldwork consists of a range of activities undertaken by the auditor/advisor and may include the following: Interviews with key staff involved in business processes, observation of key processes, carrying out tests of key controls, reviewing relevant documentation The purpose of fieldwork is to gather sufficient information to document the processes involved in the system under review and form an opinion on how well the key security risks or areas for review are being managed. The outcome of fieldwork will then form the content of the report with a management action plan to address any findings highlighted.

On completion of audit fieldwork and armed with a copy of the Draft Report (6) you should then meet up again with the management and auditee and hold a Closing Meeting (7) where the draft report, the findings and any suggested actions to rectify be discussed and pending this outcome it is then you notify management of the next stages in the audit process.

Most audit functions apply 4-5 Conclusion (8) titles ranging from very good, very poor to must try harder (a traffic light system is also sometimes used). It doesn’t matter what the conclusions are called just as long as it means something to the business. Based on the assessment of the fieldwork and the content of the identified issues a conclusion should be assigned to it, time scales with a defined date of when the identified issues will be addressed and owners named as this audit will have a Follow Up (9) and further tested at the agreed date. The report should then get an appropriate level of circulation to enable the business area, its managers and those that want and need assurance to understand its risk better. Dependant upon the audit conclusion the report circulation might include COE’s and other senior board members.

Cultural sites 'vulnerable to criminals' during 2012 Olympics

Former Scotland Yard expert warns that security focus on London games will leave museums, galleries and cathedrals open to theft

The Ashmolean museum in Oxford was broken into in 1999. Photograph: Graham Turner for the Guardian A former head of Scotland Yard's art and antiquities squad has warned that "virtually nothing" is being done to secure Britain's cultural and religious sites against criminal attacks which he claims could be sparked by the London 2012 Olympics.

Charles Hill said security around the games was focusing on Olympic sites, while many so-called "soft targets" – including museums, galleries, churches and cathedrals – are being overlooked.
Hill pointed to evidence of "high and holy day trophy art crime" being carried out when police resources are especially stretched.

During the 1994 winter Olympics in Norway, thieves stole Edvard Munch's painting The Scream from the Oslo National Art Museum and left a note that said: "Thanks for the poor security."

On New Year's Eve 1999 robbers broke into the Ashmolean Museum in Oxford and took its only Cézanne, while Rembrandts and a Vermeer were stolen from a museum in Boston – still the art world's biggest unsolved theft – on St Patrick's Day 1990.

Hill has investigated some of the most high-profile art thefts and headed undercover operations to recover works. Today, he said soft targets inside and outside the capital would be vulnerable during the Olympics, which could also be a target for terrorist attacks.

His comments came after the sports minister, Hugh Robertson, announced last week that the security minister, Pauline Neville-Jones, is carrying out a review of security for the 2012 games.
However, it has not been confirmed whether the review will include soft targets, with the Department for Culture, Media and Sport saying security was a matter for the Home Office.

Hill's concerns were echoed by Peter Osborne, a former national security adviser for the nation's museums, who said: "It is imperative that the security of [cultural] sites is not overlooked." But the directors of the Museum of London and the National Portrait Gallery said today that their security was being reviewed through the National Museum Directors' Conference, which represents the UK's national collections.

Jack Lohman, the Museum of London director, said: "We're hot on security …liaising with police. All national museums have plans, co-ordinated by the NMDC." However, Dr Michael Dixon, the chairman of the NMDC, said: "There is no specific project that NMDC is working on to consolidate security issues for the Olympic year.

"It's up to individual museums, and there are good relations with the security services."
A spokesman for the Association of Chief Police Officers said: "Museums, galleries and cultural sites typically put in place their own security measures where necessary."

Our opinion on what the current security sector risks are

These are generic and as we all know there isn't really a one size fits all!

£430m loss, let's blame the Security Guards!

Five master pieces valued at up to £430m have been stolen from the Museum of Art in Paris. Museum officials discovered the theft early on Thursday, when they found a smashed window and a broken padlock which had been cut to gain access to the five paintings.

A number of news headlines highlighted the that the guard/s (some reports state that 3 were on duty) were sleeping and the Evening Standards headline said 'Guards dozed as thief stole Paris paintings'! Why is it that the security guards sleeping hits the headlines and not the other catalogue of errors and issues that took place at the Museum :

• CCTV cameras pointing only at the roof
  
• Managements decision to switch off the alarm system because it kept going wrong (parts were on order).
  
• The paintings may not have been insured
  
• £15 million was spent upgrading security during a two-year refit which ended in 2006.
  
• Theft not discovered for up to 3 hours
  
• The intruder slipped into the Museum after simply removing a window.

• Insiders working for low pay in galleries are often suspected of helping criminals.
  

I think this really goes to prove a point that I made in this blog after my recent visit to IFSEC. You can spend an awful lot of money on technology (£15m in this case) but you still have the human element 'who leave cameras pointing at the ceiling' or the senior member of management that 'turns of the alarm systems due to false activations' or the member of staff who 'leaves the door unlocked in return for €50's'.
There is and always will be a requirement to have a robust security management regime (including Physical Security and Personnel Security) in place along with regular security audits to provide assurance that these measures are proportionate and effective. Although the night guard failing asleep is a serious issue (and one which is a common in the industry) it hardly deserves to be the headline for what is a heist of the century and a £430m loss of some of the rarest art pieces in the World.

One of the pieces stolen a £15m: Fernand Leger's 'Still Life with a Chandelier'

SOME OF THE BIGGEST ART THEFTS IN HISTORY

• May 2010: A lone thief stole five paintings possibly worth hundreds of millions of euros, including works by Picasso and Matisse, in a brazen overnight heist at a Paris modern art museum.
• February 2008: Armed robbers stole four paintings by Cezanne, Degas, van Gogh and Monet worth $163.2 million from the E.G. Buehrle Collection, a private museum in Zurich, Switzerland. The van Gogh and Monet paintings were recovered.
• December 2007: A painting by Pablo Picasso valued at about $50 million, along with one by Brazilian artist Candido Portinari valued at $5 million to $6 million, were stolen from the Sao Paulo Museum of Art in Brazil, by three burglars using a crowbar and a car jack. The paintings were later found.
• February 2007: Two Picasso paintings, worth nearly $66 million, and a drawing were stolen from the Paris, France home of the artist's granddaughter in an overnight robbery. Police later recovered the art when the thieves tried to sell it.
• February 2006: Around 300 museum-grade artifacts worth an estimated $142 million, including paintings, clocks and silver, were stolen from a 17th-century manor house at Ramsbury in southern England, the largest property theft in British history, according to reports.
• February 2006: Four works of art and other objects, including paintings by Matisse, Picasso, Monet and Salvador Dali, were stolen from the Museu Chacara do Ceu, Rio de Janeiro, Brazil, by four armed men during a Carnival parade. Local media estimated the paintings' worth at around $50 million.
• August 2004: Two paintings by Edvard Munch, The Scream and Madonna, insured for $141 million, were stolen from the Munch Museum in Oslo, Norway by three men in a daylight raid. The paintings were recovered nearly two years later.
• August 2003: A $65 million Leonardo da Vinci painting was stolen from Drumlanrig Castle in southern Scotland after two men joined a public tour and overpowered a guide. It was recovered four years later.
• May 2003: A 16th-century gold-plated Saliera, or salt cellar, by Florentine master Benvenuto Cellini, valued at $69.3 million, was stolen from Vienna's Art History Museum by a single thief when guards discounted a burglar alarm. The figurine was later recovered.
• December 2002: Two thieves broke in through the roof of the Vincent Van Gogh Museum in Amsterdam and stole two paintings by Van Gogh valued at $30 million. Dutch police convicted two men in December 2003, but did not recover the paintings.
• December 2000: Hooded thieves stole a self-portrait by Rembrandt and two Renoir paintings worth an estimated $36 million from Stockholm's waterfront National Museum, using a motorboat in their escape. All paintings were recovered.
• October 1994: Seven Picasso paintings worth an estimated $44 million were stolen from a gallery in Zurich, Switzerland. They were recovered in 2000.
• April 1991: Two masked armed men took 20 paintings - worth at least $10 million each at the time - from Amsterdam's Van Gogh Museum. The paintings were found in the getaway car less than an hour later.
• March 1990: In the biggest art theft in U.S. history, $300 million in art, including works by Vermeer, Rembrandt and Manet, was stolen from the Isabella Stewart Gardner Museum in Boston, Massachusetts, by two men in police uniforms.
• December 1988: Thieves stole three paintings by van Gogh, with an estimated value of $72 million to $90 million, from the Kroeller-Mueller Museum in a remote section of the Netherlands. Police later recovered all three paintings.
• May 1986: A Vermeer painting, Lady Writing a Letter with her Maid, is among 18 paintings worth $40 million stolen from Russborough House in Blessington, Ireland. Some of the paintings are later recovered.
• August 1911: Perhaps the most famous case of art theft occurred when the Leonardo Da Vinci's Mona Lisa was stolen from the Louvre by employee Vinczo Peruggia, who was caught two years later.