paving the way for more women in management
breaking new ground in data protection
online opportunities for skills development
Page 6
Page 18
Page 22
Canadian
September/October 2014
www.canadiansecuritymag.com
PM# 40065710
The publication for professional security management
October 2014.indd 1
Standard Tom Rousseau’s Olympic efforts for Canadian Tire make him Security Director of the Year
2014-10-03 11:06 AM
WE STAND ON GUARD WITH EXPERIENCE, SERVICE AND COMMITMENT, COMMISSIONAIRES GOES BEYOND CLIENT EXPECTATIONS At Commissionaires, security is more than guarding. We offer broader security services including consulting, employee background checks, non-core policing such as bylaw enforcement, and comprehensive security training programs.
Commissionaires, a private not-for-profit organization, employs over 20,000 men and women across Canada of all ages and from many walks of life, including but not limited to, former Canadian Forces and RCMP personnel.
www.commissionaires.ca/cdnsecurity | 1 888 688 0715
Commissionaires_CS_May.indd 1 October 2014.indd 2
2014-05-21 11:06 11:45 AM 2014-10-03
1 11:45 AM
CONTENTS 3
Canadian The publication for professional security management
Columns
One stop shop
11 CCTV & the LAW After erasure
13 the big Picture Safe and sound
Departments
Tom Rousseau’s combination of skillsets give him the edge in retail security, making him 2014’s security director of the year
Photo: sandra Strangemore
12 Risk Perspective Objectivity rules
Volume 36 Number 5
By Linda Johnson
14
4 editor’s notebook A cloudy future 6 trending 10 ASIS update Answers for women in security
18
25 expert advice Front door safety for schools 26 product focus Locks and door hardware 30 world watch Turkish supermarket buys into biometrics; peace of mind for retirement facility
22
Creating the uncrackable
Time to get online
By Tristan Bronca
By Vawn Himmelsbach
In this age of security breaches, new research may help redefine data protection
Advances in e-learning tools are helping to make security education more accessible
visit www.CanadianSecuritymag.com Security leaders will be dropping by our studio in 2014, so be sure to check out the video section of our website for new content.
@SecurityEd • September/October 2014 Milestone_CS_April.indd 1
October 2014.indd 3
2014-03-21 11:21 AM
2014-10-03 11:06 AM
Canadian
4 editor’s notebook By Neil Sutton
A cloudy future Public data breaches have serious implications for security managers
T
hese days it seems that hardly a month passes without a large organization announcing that it has suffered a security breach. I can scarcely believe it has been seven years since the TJX breach, but that turned out to be the leading edge of an entire wave of breaches to follow. Several wellknown retailers have made headlines over the past year for reasons they would rather not. But these incidents are hardly isolated, nor are they limited to retail. By the time you’re reading this, it’s probable that another major hacking story will have surfaced. The idea that personal data can be compromised “As consumers, we is an unsettling one. I’ve had my car broken into on voluntarily give up two separate occasions (actually, two separate cars). The worst of the damage was a shattered driver-side our personal data.” window and a stereo system ripped out. Certainly, that was a pain to replace, but I think it was the idea that someone had been rifling through my personal belongings while I slept that bothered me far more. As consumers, we voluntarily give up our personal data in exchange for loyalty programs, or simply as a matter of course — shopping online requires financial data and home addresses change hands. The alternative is weekly visits to the bank, but in this increasingly cashless society, the sight of a $100 bill is practically a 1980s anachronism. As the data security incidents pile up, you would think that there would be a growing sense of mistrust on the part of the consumer, but I think the reverse might be true — eventually, senses become dulled to the implications and there’s a growing acceptance that breaches are simply an unfortunate by-product of a society ruled by information flow. These breaches affect security managers on several levels. Naturally, there will be those who are directly involved, either helping to put in place preventative measures or dealing with some of the clean-up after a breach has been confirmed. Some may also have a hand in analyzing risk posed by potential future threats. On another level, there will be those who have to make decisions as to whether they want to store information in the Cloud. I’ve heard a number of opinions on this topic, depending on the sensitivity of the information, the exact application and the person’s comfort level overall with data security. For some, it’s a definite no. Why take the risk, remote as it may be, of storing information offsite when there are still viable alternatives on-site? Another complaint is that the data could be stored outside of Canada, opening up the possibility that overseas agencies could exercise a right to monitor it. But there are plenty of security professionals who are testing the waters of Cloud-based systems (to mix a metaphor), taking advantage of potential cost-savings, not to mention server space on-site. There may come a time when storing data on site is like storing your retirement fund under the bed, but we’re not there yet. Based on the amount of sensitive data that has gone astray in recent years, there is still ample room for progress as well as caution. But as data begins to change shape (read our story on quantum cryptography on p.18), so may attitudes.
The publication for professional security management
Group Publisher Paul Grossinger pgrossinger@annexweb.com
Account Coordinator Trish Ramsay tramsay@annexweb.com
Publisher Peter Young pyoung@annexweb.com
Circulation Lisa Thomson lthomson@annexweb.com
Editor Neil Sutton nsutton@annexweb.com
President Mike Fredericks mfredericks@annexweb.com
Art Director Graham Jeffrey gjeffrey@annexweb.com
Editorial and Sales Office 222 Edward Street, Aurora, Ontario L4G 1W6 (905) 727-0077 • Fax (905) 727-0017 Web Site: www.canadiansecuritymag.com Canadian Security is the key publication for professional security management in Canada, providing balanced editorial on issues relevant to end users across all industry sectors. Editorial content may, at times, be viewed as controversial but at all times serves to inform and educate readers on topics relevant to their individual and collective growth and interests. Canadian Security is published six times per year by Annex Publishing & Printing Inc. Subscriber Services: Lisa Thomson lthomson@annexweb.com P.O. Box 530, Simcoe ON N3Y 4N5 Tel: 866-790-6070 ext (201) Fax: 877-624-1940 I.S.S.N. 0709-3403 Printed in Canada Canada Post: Customer #6597297, Agreement #40065710. RETURN UNDELIVERABLE CANADIAN ADDRESS TO CIRCULATION DEPARTMENT P.O. Box 530, Simcoe ON N3Y 4N5 Subscription Rates: Canada: 1 year $40.00 + HST; U.S.A. (payable in US dollars): 1 year $60.00; International (payable in US dollars): 1 year $75.00 The contents of Canadian Security are copyright by ©2014 Annex Publishing & Printing Inc. and may not be reproduced in whole or part without written consent. For information on reprints of any article that appear in this publication, contact The Reprint Outsource at 1-877-394-7350. Annex Publishing & Printing Inc. disclaims any warranty as to the accuracy, completeness or currency of the contents of this publication and disclaims all liability in respect of the results of any action taken or not taken in reliance upon information in this publication.
We acknowledge the financial support of the Government of Canada through the Canada Periodical Fund of the Department of Canadian Heritage.
Editorial Advisory Board Jason Caissie Profile Group
Tracy Ann Kosa Microsoft
Carol Osler TD Bank
Ken Close Trillium Health Partners
Bill McQuade Final Image
Theresa Rowsell Target
Ashley Cooper Paladin Security
Clark Northcott Pelco by Schneider Electric
Tim Saunders G4S
David Hyde Hyde & Assoc.
Malcolm Smeaton Whitehorse Group
@SecurityEd September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 4
2014-10-03 11:06 AM
axis_ad Axis_CS_
m
om
.com
That guy’s BMI just hit the roof.
Be the first to know.
The more you can protect your store’s assets, the less you lose. Now you can use network video to prevent losses from shoplifting, theft and fraud in your stores. It’s all made possible with high quality video feeds, real time alarms and other smart features in Axis’ leading network video solutions for retailers.
This is just one way Axis’ IP solutions help retail stores minimize loss and maximize profits. Be the first to know how to stay one step ahead. Visit www.axis.com/retail
Axis network video solutions for retail integrate our leading network cameras with specially-designed applications from our partners. • Outstanding HDTV image quality • Integration to your existing POS, EAS and IP systems • Scalable, future-proof solutions from standardized equipment
axis_ad_retail-lp_cansec_fpc_en_1409.indd 1 October 2014.indd 51 Axis_CS_Sept.indd
2/09/2014 10:48:26 AM 2014-10-03 AM 2014-09-05 11:06 8:31 AM
6 trending Calendar Anixter Showcase
Oct. 7, 2014 Calgary Stampede Grounds/BMO Centre Calgary, Alta. www.anixter.ca
International Airport Investigators’ Training Symposium Oct. 7-9, 2014 Westin-Bristol Place Hotel Toronto, Ont. www.peelpolice.on.ca/en/ newsevents/IAITS.asp
Canadian Security Focus On Series: Commercial/Property Management Oct. 15, 2014 Sheraton Parkway Richmond Hill, Ont. www.focusonseries.ca
Security Canada Central
Oct. 22-23, 2014 Toronto Congress Centre Toronto, Ont. www.securitycanadaexpo.com
Securing New Ground
Oct. 29-30, 2014 Broadway Millennium Hotel New York, NY www.securityindustry.org
SecureTech
Nov. 3-5, 2014 Ottawa Convention Centre Ottawa, Ont. www.securetechcanada.ca
ISC East
Nov. 19-20, 2014 Javits Center New York, NY www.isceast.com
Security Career Expo
Nov. 25, 2014 Sheraton Parkway Richmond Hill, Ont. www.securitycareerexpo.ca
Canadian Security Focus On Series: Health Care Dec. 10, 2014 Sheraton Parkway Richmond Hill, Ont. www.focusonseries.ca
Garda strives for more female representation
A
ccording to several female employees at the company, Montreal-based GardaWorld has made a concerted effort in recent years to place more women in senior roles. Brooke Marion started at Garda a year and a half ago. “I know that when I joined, there was a push at that time. Myself and my counterparts were all female and in leadership positions,” she says. Marion worked in a variety of sales and customer service-type roles Brooke Marion before joining Garda as a relationship manager for protective services — everything from a software company to a high-end art gallery. The company was looking for not only women, but people with experience outside of the security industry. “I didn’t come in with any preconceived notions,” adds Marion. Amy Pickard joined Garda in 2012 and is currently an account manager for Garda’s Intercon division. She previously worked at a large IT hardware manufacturer in a business development role and was headhunted by Garda. “It was Garda looking for a female perspective on this industry,” she says. Diana Curic, by comparison, is steeped in security knowledge. She has been with Garda for two years as a relationship manager for strategic accounts, but has spent more than a decade in the industry in various roles from Amy Pickard loss prevention to private investigations to management positions. She’s seen how the industry has evolved over time and become more
inclusive, noting that Garda is “very supportive of women in decision-making roles.” But it’s not an entirely rosy picture. Both men and women outside of the industry aren’t always aware of the opportunities that lie within it. Many equate security with guard uniforms and little else. Women are entering the Diana Curic industry in greater numbers, but there could be a lot more. “This isn’t something that’s going to happen overnight,” says Pickard. “There’s also a lot of resistance from the female side to enter into this industry.” It’s up to women employed in security to help break down those barriers, says Curic. “I personally have had mentors in the industry in different verticals,” she says. “I try to do the same for others. In this day and age I think there’s a lot of pressure and expectation on the Y generation. Giving direction to young people is critical to their success.” In an industry struggling with employee retention issues, security companies may benefit by having more female supervisors, notes Marion. “I try to foster [relationships] with a lot of the guards on my site directly. It definitely does build a loyalty to the organization. We have a personal interest in seeing people succeed and get to where they want to go.” Eventually, there will be more women at the very senior levels of security, says Pickard, as young women hired now begin to move up the ranks over time — provided they prove their mettle. “You have to progress and pay your dues,” she says. “You can’t just come in and take over that kind of position.” — Neil Sutton
September/October 2014 • www.canadiansecuritymag.com
L_PRW42A_D_ October 2014.indd 6
2014-10-03 11:06 AM
Honeywe
unlock potential...
...and throw away the keys! With Pro-Watch 4.2, state-of-the-art access control is available at the most affordable price yet! With an enhanced lockset and biometric portfolio, it offers numerous reader options to meet specific security needs. With fewer wires and reduced costs, customers can now employ access control in areas that were once considered difficult, or even impossible! Plus, Pro-Watch 4.2 delivers enhanced biometric integration options that are easy to use, and provide fast, reliable and secure access points. You can finally throw away the keys and start enjoying the benefits of a robust access control management system. Unlock potential, and lock in the savings!
For more information, www.honeywellintegrated.com or call 1.800.323.4576 Š 2014 Honeywell International Inc. All Rights Reserved.
L_PRW42A_D_CS.indd 1 October 2014.indd 7 Honeywell_CS_Oct.indd 1
9/11/14 3:36 PM 2014-10-03 2014-09-12 11:06 8:48 AM
8 trending
Future security students receive scholarships
T
he National Association of School Safety and Law Enforcement Officials (NASSLEO) recently awarded several scholarships to U.S. and Canadian students who are interested in pursuing a career in a related field. NASSLEO exists to give students a good start in life, says Minaz Jivraj, school security and safety officer for the Dufferin-Peel Catholic District School Board in Mississauga, Ont., and NASSLEO’s scholarship Minaz Jivraj chairperson. “We are school safety officers. We are in the trenches. We are out there and ensuring that these kids come to school, have a safe environment to have a learning experience, and then they go home,” he says. As part of its mandate, NASSLEO
awards scholarships of $500 or $1,000 dollars to students based on nominations by a faculty member from the school they attend. In order to qualify, students must be a senior graduating from high school, will be attending a college or university and have demonstrated a positive commitment to their community. In general, awards go to those with an interest in policing or security, but not exclusively. The money awarded goes towards helping a student pay for related school expenses, such as meal plans, says Jivraj. Three of the scholarships are made possible through contributions by Canadian companies: Gemstar Security Service, Carehawk and Keyscan. Each of them provide funds to one U.S. and
G4S Canada appoints new regional managers headxfx
T
— The Canadian Press 4S Canada recently announced two additions to its ranks: Kyle Wightman, general manager for Quebec, and Tom Manley general manager for Southern Alberta. In their respective roles, Wightman and Manley will be accountable for the safety and wellbeing of all their employees as well as implementing and managing health and safety programs, including training, oversight and reporting. They are also responsible for financial management of their branches, and creating and implementing action plans. They also hold responsibility for operations matters, such as business administration, industrial and labour relations, training and customer service. Prior to joining G4S, Wightman was chief of security operations at the Agence Metropolitaine de Transport Tom Manley (AMT) in Montreal. In this role, he managed a security force of more than 170 officers. He also serves as vice-chair for the Montreal chapter of ASIS. In his previous role, Manley was the director of operations and business development for the Canadian Corps of Commissionaires in Southern Alberta. He was also an active member of the Calgary Police Service for eight years, during which time he was part of the G8 Summit Logistics Planning Team, and also served in the Canadian Armed Forces for 13 years.
G
one Canadian student through the scholarship program. Jivraj says he encourages companies to take an active role in rewarding student accomplishments. “If you really believe in the product that you have, then you have to give back to the community that you serve,” he says. “If you have cameras in schools, then you have a vested interest in those schools. If you have a security guard company, then you have a vested interest in ensuring that these kids that are going through our systems have some ability to turn around and give back to the community. It’s a civil conscience scenario.” Jivraj has been recognized for outstanding service by NASSLEO on several occasions. He recently received a lifetime achievement award from the organization and received the president’s award in 2012.
letter to the editor Re: New plan increases minimum wages for Manitoba guards (Canadian Security, July/Aug. 2014) I’d like to thank Canadian Security for running this article. As an Ontario licensed security guard, it doesn’t affect me, however, I would hope that this may pave the road for fair wages not only in my province, but all across Canada. Here in Ontario, guards are required to pass a provincially mandated course and exam to receive their licence. The fees and tuition of the process can cost up to $500, even before getting a job! Steps such as wage increases, and training/education opportunities will not only have a ripple effect on the entire industry — for the better — but will also professionalize it. Kristopher May
September/October 2014 • www.canadiansecuritymag.com
Avigilon_ October 2014.indd 8
2014-10-03 11:06 AM
Avigilon_
Avigilon spotted a man in this 2014-Feb-02 01:14:28.655 PM
who was caught 2014-Feb-02 01:14:35.471 PM
and identified by his 2014-Feb-02 01:15:45.559 PM
Meanwhile, analog identified CAM1 2014-FEB-02 01:14:35 PM
Only our high-definition surveillance solutions give you the full story. Identify incidents quickly and enhance response times with the superior image detail of an Avigilon end-to-end system. See how Avigilon can help your organization at avigilon.com/casestudies The top three images were shot with an Avigilon 29 MP HD Pro camera. The fourth image was shot with an analog camera.
Avigilon_FullStory_DLevel_D0220_8X10.75.indd 1 October 2014.indd 9 1 Avigilon_CS_Oct.indd
JOB NAME: Full Story D Level Ad
2014-09-11 3:40 PM
TRIM:
8� x 10.75�
Cyan
2014-10-03 2014-09-16 11:06 10:42 AM
10 ASIS UPDATE
By Silvia Fraser
answers for Women in Security
I
n 1997, I became a woman in security. Little did I know what that meant at the time. On my way to conquer the field, I questioned, why security/law enforcement? Why would a woman choose a non-traditional career? In my quest for the answer, I researched a variety of factors, specifically a conceptual model including family, gender roles, self-esteem, self-efficacy, and personality. The influence of each factor is significant, however there is also a substantial interrelation between all of them too. There is no definitive answer to the question, however, the influencing factors are oriented to family and gender role stereotyping. To define why a female chooses the field of law enforcement requires looking at all the factors in detail. Other reasons such as media and peer influences are notable, as well
as issues of empathy and compassion, which are very important. In some of my research I found that a major influence in choosing a career was the desire to help people. Law enforcement’s core function is to help people and offer support to communities. Females in law enforcement have brought many valuable traits to this field. Increasing numbers of female police Silvia Fraser officers and security professionals is a result of these traits. It has been very clear to me that a lack of research in the area of women in security/law enforcement is noticeable and is required to further explore the motivation behind choosing a career in the field. I believe the question is not only, why choose a career in security/ law enforcement, but what makes you stay in it? In recent years, I have seen an increase of women in the security industry, evident at all levels, including front lines
and the C-suite. Career paths for woman in security have become more clear, demonstrating new opportunities. Initiatives such as the ASIS International Women in Security encourage more women to enter the security industry and to be inspired to continue their career aspirations in the field. At the ASIS Toronto Chapter, our mission is “to provide support and assistance to women in the security field as well as inspire those interested in entering the profession.” It is in support of this mission we are holding the first annual ASIS Toronto Chapter Women in Security Symposium on Nov. 7, in Toronto. Organized by many dedicated volunteers, the event will bring together a day of learning, sharing, mentorship and networking. For more details, please visit us at www. asistoronto.org. Silvia Fraser is the chair of Women in Security, ASIS Toronto Chapter.
OPP officers win Canadian Banks’ Award
F
our Ontario Provincial Police officers have been awarded the Canadian Banks’ Law Enforcement Award (CBLEA) for two separate investigations. The first is for investigative skill in identifying and arresting suspects of a violent gang accused of robbing a number of banks across Ontario and Quebec; the second is for an investigation into a sophisticated fraud ring operating across southwestern Ontario. Detective Constable Steve Paddon, Detective Constable Max Gomez and Detective Constable Dennis
From left: Detective Constable Jay Brodie, Detective Constable Steve Paddon, Detective Constable Dennis Thompson, and Detective Constable Max Gomez.
Thompson of the West Region Ontario Provincial Police (OPP) and Detective Constable Jay Brodie of the East Region OPP were presented with
the award in August at the Canadian Association of Chiefs of Police conference in Victoria, B.C. “Canadians trust their banks and consistently rate them highly. Upholding that trust means we depend on the close working relationships between banks and law enforcement agencies across Canada,” says Nathalie Clark, general counsel and corporate secretary for the Canadian Bankers Association. “Banks in Canada, their customers and their employees are proud to celebrate the achievements of the four recipients of this prestigious award.”
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 10
2014-10-03 11:06 AM
By Elliott Goldstein
cctv & the law 11
After erasure
Y
Evidence from an erased video was held admissible in Court
ears ago, I wrote about a British the video they observed depicted the scene case where a video of shop theft of the alleged crime. They viewed the video was accidentally erased by the immediately after the alleged event when investigating (police) officers. the Complainant rewound the tape. The However, the prosecutor was still able to evidence led the Court to conclude that the obtain a conviction based on the testimony video had not been tampered with prior to of the officers who viewed the video prior to the Complainant and the officer watching its erasure. 1 A similar thing happened in a it. The officer was looking at something which, had it been available recent Alberta case 2 where to the Court, would have a Provincial Court Judge been capable of conveying admitted the evidence of a “The officer viewed a a first-hand impression to police officer about what video of the assault in the Court. It conveyed a he saw on a video that was first-hand impression to erased prior to trial. the store shortly after the officer and his evidence The video showed described that impression. the accused walk to the the assault occurred.” Therefore, in principle, the store’s ATM machine. The officer’s testimony about Complainant, a store clerk, what he saw on a videotape walked to that location is no different from and there appeared to testimony about anything else he observed. be a conversation. The Complainant tried The officer’s testimony is evidence of to escort the Accused out of the store. The what he observed. The officer was crossAccused struck the Complainant, left the store, examined at length at trial on what he returned a short time later and again struck the recalled having seen on the video and on Complainant. The accused was charged with what might have influenced his memory and assault. impression of the video. The officer viewed a video of the The officer was interpreting a visual assault in the store, shortly after the assault recording and that interpretation is testable. occurred. At trial, the officer described at This is different from traditional hearsay what he saw on the video. The surveillance where a witness is interpreting another camera was above the [cash register] till and person’s interpretation and verbalization of showed a viewpoint from which the officer what was observed, the accuracy of which could see the store clearly. is not testable. In the end, the accused was Unfortunately, neither the police nor convicted of assault based on the officer’s the store staff was able to secure a copy of evidence of what he saw on the video, the video. The video system’s DVD burner notwithstanding that the video itself was not was not working so a proper copy could be admitted into evidence. obtained, and the videotape was recorded This case points out the importance of over. showing the video to as many persons as The accused objected to the officer’s possible as soon as it is recorded, because evidence being admitted on the ground that their testimony may be necessary if the video it is inadmissible hearsay. The trial judge is not available at trial. ruled that a video is not a hearsay statement. In this case, the videotape itself was not available. Had it been, and providing Elliott Goldstein, B.A., J.D., is a Thornhill, Ont.-based it met the criteria for admissibility, it lawyer (elgold@rogers.com). would have been relevant and admissible 1. See Taylor v. Chief Constable of Cheshire, [1987] All English evidence capable of conveying a first-hand Reports 225 (Queens Bench Division, England). impression to the Court. The evidence of the 2. R. v. Mesfin, 2012 ABPC 115 (Alta. Prov. Ct.) , 2012 Complainant and the officer indicates that CarswellAlta 821 (per E.A. Johnson Prov. J.:). @SecurityEd • September/October 2014
October 2014.indd 11
2014-10-03 11:06 AM
12 RISK Perspective
By Tim McCreight
Objectivity rules
O Why personal opinions should be curtailed when assessing risk
ur past experiences shape how we perceive the present, and plan for the future. We create opinions from these experiences, amongst other sources. These opinions can sometimes find their way into a risk management program, disguised as facts. I’ve been guilty of this myself. I always considered myself a reliable driver with a good driving record. I never thought about taking the coverage to replace my windshield — it always seemed like an extra expense that didn’t offer much value. My decision was a personal one, based on my own experiences driving in my home province, and occasionally replacing a windshield. I didn’t conduct any research when I made my decision, I simply declined the extra fee. Recently, I’ve been using this example in discussions with organizations about risk, and how they perceive the process of assessing risks. When I ask folks who drive if they selected the option for additional windshield coverage for their insurance, I always find some that have, and others that haven’t. The reasons range from not having the money to replace a windshield, to owning a car where the windshield replacement cost would surpass the vehicle’s value! Sometimes, I hear testaments on the way others drive, the horrible road conditions, or the perceived profits of the insurance company. Whether we’re talking about windshields or organizational risks, it’s difficult to separate ourselves from personal opinions when we begin assessing risks. Invariably, we find ourselves answering questions from a personal perspective, and not from a business or strategic one. We tend to rely on our own viewpoints when it comes to looking at risks facing our organizations’ key assets: people, property and information. Our goal as security professionals should be
an unbiased, objective approach to assessing risks and working with our organizations to develop controls to reduce the impacts if a risk becomes a reality. We need to borrow Joe Friday’s line from Dragnet and focus on “Just the facts, ma’am.” There are a number of frameworks, methodologies, software packages and international standards that can help. These range from simple checklists that review the current controls in place at an organization, to complex software packages that generate on-demand reports of risks facing an entire organization. The path you select, and the tools you choose, should be unique to your circumstances and organizational requirements. Regardless of your organization’s size, you need to use some form of objective assessment of risk. The approach needs to take into account the context of your organization and the business environment it operates within, any special legislative or regulatory controls that apply to your organization, and an appreciation of what it does to say in business. Without this critical background information, we may miss key items in a risk assessment or overemphasize one type of control over another. The most expensive risk management software can’t help if you don’t provide the right information, or insert personal opinions instead of objective facts and data. The old adage “garbage in equals garbage out” applies directly to risk assessments, too. And it doesn’t hurt to have a third party check your assessments regularly. The organizations we protect rely on our professional expertise to safeguard their assets, and help them review risks facing the organization. We must ensure our recommendations are based on an objective approach to assessing risks and not our own misgivings or personal opinions. If we are to keep our place at the executive table, one sure way of doing so is to be that quiet, measured voice that others can rely on to be open, honest and unbiased. Tim McCreight is a managing consultant at Seccuris (www.seccuris.com).
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 12
2014-10-03 11:06 AM
By Yves Duguay
The BIG PICTURE 13
Safe and Sound
T
Making concert events both secure and enjoyable is an ongoing challenge
he unfortunate deaths of spectators at the Pemberton Music Festival in British Columbia and the Veld Festival in Toronto in recent months have raised serious concerns about the effectiveness of current security measures. The challenge for festival organizers is to find the right balance between security and safety imperatives on the one hand, and customer experience on the other. Security for such events must be aligned with the mindset that is being promoted at the event along with the desired outcome: spectators securely accessing the site, enjoying the shows and becoming repeat customers. The security and safety measures that we implemented during the latest edition of the Osheaga festival in Montreal, which attracted over 135,000 spectators, exemplify how that balance can be achieved. In preparing for the Osheaga festival, we used an integrated approach for greeting and welcoming the guests, securing them through access points, assisting them on site, preventing incidents or accidents, and managing emergencies. By providing a systematic approach, the security team can create value for the organizers by reducing costs and liabilities, protecting revenues and most importantly, reducing the risks that could taint the event’s reputation. The level of security required should be commensurate with the characteristics of the site and the event. This would include information ranging from the size of the crowd, the space available for each spectator, to the availability of alcohol on site. Based on this analysis, measures are identified and implemented to prevent criminal activities, dangerous crowd movements, property destruction and physical violence. In addition, it is essential that event organizers push information through various means, including social media, to inform
the guests about prohibited behaviours and items and the requirement to submit to a search as a condition of admission. Initial communications must be reinforced on the site through posters and announcements. Furthermore, guests must undergo security screening. In our case, with Evenko’s consent, we elected to test walk-through metal detectors, similar to those we find in airports. The equipment was set to detect the weapons and prohibited items identified in the assessment phase. By informing, preparing and guiding the guests through the process, we were able to screen spectators at an average of 14 to 15 guests per minute. This led to the detection of knives, glass bottles, aluminum cans and metallic flasks. Drugs and drug paraphernalia were also found and turned over to the police authorities. The last elements underpinning this approach are staff experience and training. Our partner, Fortas Security, has been able to recruit professional and experienced staff, familiar with a concert’s environment. Prior to the event, supervisors were trained on the usage of metal detection equipment and most importantly, on the security team’s contribution to the guest experience through verbal and non-verbal communications. Event security is becoming a domain of its own. In the United States, the University of Southern Mississippi has established a program to certify security professionals in that regard. Undoubtedly, Canadian universities will soon develop similar programs, leading the way to the establishment of Canadian standards, while providing security professionals an opportunity to acquire the specialized knowledge and expertise to manage such events. Yves Duguay is the president of HCiWorld (www. hciworld.ca). @SecurityEd • September/October 2014
October 2014.indd 13
2014-10-03 11:06 AM
14 security director of the year
One
Stop
Shop
Tom Rousseau’s mix of security skills make him the right person for the job at Canadian Tire
I
By Neil Sutton n the weeks before his company’s delegation was to arrive in Sochi for the 2014 Winter Olympics, Tom Rousseau identified two major security problems. First, he and his team has no contacts whatsoever among the people on the ground. Second, chances were pretty good that any phone, iPad or laptop the delegates carried would be hacked the moment their plane touched down in Russia. “It was such unknown territory for us,” says Rousseau, associate vice-president of corporate security at Canadian Tire Corporation in Toronto. “We started with a clean slate and had to come up with our own ideas.” Rousseau has been selected as 2014 Security Director of the Year, sponsored by Anixter Canada, by the Canadian Security editorial advisory board. In his 19-year career at the company, he
has transformed the role of security by building a strong professional team and creating the perception of security as a valued part of the management group. In addition to being responsible for the physical protection of Canadian Tire employees and assets, Rousseau collaborates with other departments to create best practices. He is responsible for the security programs at Canadian Tire petroleum and Partsource divisions, oversees fraud investigations and works with franchise owners — Canadian Tire stores are independently operated — to promote security and loss prevention. His responsibility extends worldwide, to executive protection, to the corporation’s offices and supply chains overseas and to national and international events. The biggest project Rousseau had ever managed came when the corporation announced it would be a premier national sponsor for the
2014
SECURITY DIRECTOR
Photo: sandra Strangemore
OF THE YEAR
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 14
2014-10-03 11:06 AM
15
@SecurityEd • September/October 2014
October 2014.indd 15
2014-10-03 11:06 AM
16 security director of the year they could provide a letter, in English Canadian Olympic team at the Winter and Russian, stating the carrier was a Olympics in Sochi. In February 2013 Canadian citizen and travelling with he travelled to Russia to assess the a company, was now lost and who situation and begin making plans to they need to call. A copy of the letter provide physical security support for was given to each delegate when they the delegation of about 60, including arrived. customers (winners of a store contest), “Our delegates kept it with them executives and business partners. all the time,” he says. “It gave everyone Rousseau and his team started by a sense that, it’s OK if something forming an alliance with the consulate happens.” offices in Moscow. Timing was on their On such a project, side. Rousseau says, “We were able sharing expertise and to get the attaché “ He doesn’t take resources is key. The who had just left the team called other Moscow embassy himself too seriously Olympic sponsors and the one who was on the team, but he’s and asked them to going there, and we share their experiences met them both in dead serious about of the Games. They Ottawa. So we got also created and a sense of what had the work.” chaired a security been going on and — Eugene Roman, committee and invited could keep in touch Canadian Tire people from other with the new attaché organizations, such as about what was going international police to happen,” he says. agencies, broadcasting companies Duty of care was Rousseau’s biggest and government agencies, to join so concern. In addition to ensuring they they could work together and share had secondary locations available in resources and information before and case they needed to relocate people, during the Games. they also put in place a full extraction “This allowed us not only to plan plan. They provided satellite tracking before the Games but also to receive for each delegate so they knew where real-time intelligence during the everyone was at any given time. For Games,” he says, adding he believes good measure, he asked the attachés if strongly in networking and communicating. “People in security often don’t want to share. It’s almost as if it’s a secret,” he says. “I’m more about, let’s learn from our mistakes and let’s share what we’re doing.” To prevent hacking in Russia, they developed a clean phone policy. Instead of using corporate devices, all Canadian Tire employees were given clean devices and email addresses, which Tom Rousseau and Josh Murray, manager of corporate security
went to a separate server. Regular emails were managed by the executives’ administrative assistants, who decided which ones to send on to the Sochi address. “If they wanted to reply, they would answer back to that ‘non-server,’ the Canadian Tire server, where it would be scrubbed first to make sure there was no virus on it,” he says. Rousseau remembers the Olympics as a fantastic experience. “It was a lot of work and a lot of uncertainty. I can’t tell you I was at ease the first time I got into the plane. I’m 47 years old, and I’ve seen some James Bonds,” he says. “But we got positive feedback from everyone, and I got to see the Games. I was working, but at the same time I was at the gold medal [hockey] game for the women’s and for the men’s. In Russia! It was an experience of a lifetime, for sure.” In the 19 years Rousseau has been with CTC, he has worked to raise the profile of security within the corporation. He has established regular communication links with other departments. And instead of security personnel being seen as the ones who show up when someone’s in trouble, they’re now seen as colleagues who help solve problems. “At the beginning, the department was almost seen as a necessary evil. Most people didn’t really understand the value and need for the department. We were a small team and had difficulty moving things forward; people just didn’t get it,” he says. “Security is seen now more as a partner who can work with other departments to come up policies that work best for that department. We show that we do add value. We’re here to help them, and we’re a better return on investment because we will save them money down the line.” Josh Murray, manager of corporate security and loss prevention at Canadian Tire, says Rousseau has built the current business unit from the ground up.
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 16
2014-10-03 11:06 AM
Photos: sandra Strangemore
security director of the year 17 security, e-security and “He has broken the traditional physical security are all silo barriers, has built trusting, blurring, so the teams interdependent relationships and has work together, as if advantageously positioned security as they’re one team,” he a profitable contributor to the overall says. business,” he says in an email interview. Born and raised Unlike many security people, in the small Quebec Rousseau is not rule-driven, says town of Rimouski on Eugene Roman, chief technology the St. Lawrence River officer. His approach is at once both — where, he recalls, professional and easy-going. there wasn’t much to “He doesn’t take himself too do in winter: “You play seriously on the team, but he’s dead hockey and you stay serious about the work. It’s high stress warm”— Rousseau work. And he ensures that everybody Tom Rousseau with Canadian Tire CTO Eugene Roman. Strong co-operation later went to Montreal understands what’s on and what’s not allows them to better manage both digital and physical security and studied at the on. He sets the tone at the top. They’re University of Montreal. very professional.” and trusting relationships in business. After moving to Toronto, he landed his At other companies, Roman adds, He identifies what it takes to be a first job at Canadian Tire, running the a request for help is often met with leader, who to surround himself with company’s money the response, “We’re and what it takes to achieve results,” he program. busy.” says. “The only “With these guys, “He has broken the “Balancing this,” he adds, “is security at the time you don’t have to ask. his sense of humility. When we were on the millionYou just tell them traditional silo barriers notified that Tom was honoured with dollar inventory I what’s happening, and this award, he came into my office and was responsible for they do the rest. They and built trusting said to me, ‘Thanks. It’s not about me, was a sign that said say, ‘I understand it’s relationships.” though. It’s about the team.’ ” ‘Authorized Personnel important, and we’ll Canadian Tire will continue as an Only.’ I had a bit of a figure it out.’” — Josh Murray, Olympic sponsor for the next seven problem with that,” Corporate security Canadian Tire years. Rousseau and his team have he says. works closely with IT, already started preparing for the 2016 From 2004 to Rousseau says. They Summer Games in Rio de Janeiro. 2010 he served as a regularly exchange There, the delegation will be larger — reservist with the Durham Regional information on projects such as between 200 and 300 people — and, Police, and in 2001, he joined the designing security plans for new sites with venues spread out across the city, corporate security department at CTC. and maintaining current ones, and also he expects the difficulty of protecting Starting with a team of two, he now rely on each other to share resources delegates will be greater. oversees six managers, who all have and provide support. Still, he adds, he’s looking forward their own teams. In fact, last year a separate team to the challenge and continuing to lead “It’s been a long journey. Nineteen within the security department was his department. years is a long time, and the last 10 created to work more closely with IT. “One of the reasons I’ve been here have been fantastic,” he says. “The The closer collaboration allowed them so long is the culture of the company, company’s growing so fast; we’re to complete several projects, including which is fantastic. It was started as running full throttle.” converting retail locations to NVR a family business, and it still feels Rousseau’s leadership skills, Murray and digital solutions and, as well, that way, although we’re a very large says, are demonstrated daily. He is centralizing security servers in a new company now. And my heart’s here confident and dedicated and inspires data centre with full redundancy levels. because I feel as if this is my baby. I do his team and other colleagues to deliver Roman says Rousseau recognized it, and I want to keep doing it,” he says. results in challenging and diverse the convergence of technology and “And Rio’s coming, and after Rio situations. security. is going to be Pyeongchang in 2018. “Tom’s personality provides him “He said, ‘They do things in new There’s a lot of cool stuff coming with exceptional rapport-building tools ways, and we do things in new ways, down.” that are essential in creating impactful and we meet in the middle.’ Digital @SecurityEd • September/October 2014
October 2014.indd 17
2014-10-03 11:06 AM
18 DATA SECURITY
Creating the uncrackable Advances in quantum cryptography may have huge ramifications for data protection in the future By Tristan Bronca
B
ack in 2012, in the skies high above Germany, a team of physicists took part in an experiment that demonstrated the beginnings of a looming shift in information security. During a connection that lasted about 10 minutes, a specially outfitted
aircraft flying at 300 km an hour transmitted a beam of photons (light particles) to a base 20 km below and more than 90 km away. The experiment displayed such technological precision in tracking and transmitting these photons that it was hailed as nothing short of astonishing. But the information encoded on the beam of light is arguably even more incredible. These were not ordinary photons. They were
quantum bits or “qubits” as they’re known amongst the physicists, engineers and enthusiasts who grapple with understanding them. In this experiment, these particles carried information that came together to create a cryptographic key that is, in theory, impossible to crack. This is quantum cryptography, and it’s based on the laws of quantum mechanics — laws that govern the smallest bits of everything in the universe. “The first thing you need to understand is that quantum mechanics is very alien to our everyday experiences,” explains Daniel Gottesman, a quantum physicist from the Perimeter Institute of Theoretical Physics in Waterloo, Ont. “Everyday language isn’t that good for talking about quantum
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 18
2014-10-03 11:06 AM
DATA SECURITY 19 mechanics. So anything I tell you is just going to be an approximation to the real thing that you have to understand by looking at the mathematics.” Like ordinary computer bits, qubits have two possible values: a one and a zero. The most popular methods of quantum and classical cryptography assemble these values in a particular order to form a security key that unlocks a separate channel of communication. However, unlike ordinary bits, qubits can in some sense also be both a one and a zero at the same time. This is known as a “superposition” and it is one of the hallmarks of quantum mechanics. To imagine this, it may help to think of the qubits’ physical form. For example, in some quantum systems, the qubits are electrons in different energy states. An electron in its ground state — low energy level — has a value of zero while an electron in an excited
now it is being controlled to produce state — high energy level — will have a an unprecedented level of security. To value of one. According to the laws of put it simply, if anyone other than the quantum mechanics, not only could each intended recipient of the key tries to of these electrons be in either an excited intercept, eavesdrop, or ground state at any or otherwise given time, they could “The first thing you interfere with it, the be in both an excited superposition will and ground state at need to understand is collapse and cause the same time. But there is one that quantum mechanics errors visible to the two parties. very important catch: is very alien to our The results of the the superposition German experiment itself is impossible to everyday experiences.” were published at measure. The act of — Daniel Gottesman, Perimeter the end of March “looking at” any of Institute of Theoretical Physics 2012 and were these incredibly tiny first presented last particles will cause year at the annual the superposition to QCrypt conference collapse, leaving you — a gathering of leading experts with either a one or a zero at random, and interested students in the field Gottesman says. of quantum cryptography. The 2013 This property has been verified conference was held at the beginning again and again in experiments and
Send your 2014
Rising Stars SECURITY CAREER EXPO
November 25, 2014 • Sheraton Parkway Toronto North Hotel • Richmond Hill, ON
www.securitycareerexpo.ca Canadian The publication for professional security management
GOLD SPONSORS
SILVER SPONSORS
Community Partners
@SecurityEd • September/October 2014
October 2014.indd 19
2014-10-03 11:06 AM
20 DATA SECURITY
UNTIL NOW! SOURCESECURITY.CA/ WEGOTTHIS
Client: SOURCE SECURITY Job Number: 5124 BIG Time Ad Pub: Canadian Security Specs: 2.125” x 10” CMYK Contact #: 902-835-3559
THE SECURITY BUSINESS HASN’T CHANGED IN 100 YEARS.
of August in Waterloo, Ont.; a site that has been dubbed by some as “Quantum Valley.” (This year’s conference was recently held in Paris, France.) “It’s a metaphor,” says Michele Mosca, co-founder and deputy director of the Institute for Quantum Computing at the University of Waterloo and founding member at the Perimeter Institute. “It’s the 21st century version of Silicon Valley and it’s here in Canada.” Mosca was one of the first researchers who helped create this community that has hosted several world-famous experts in the field. This includes the Perimeter Institute’s executive director, Neil Turok, and its distinguished research chair, Stephen Hawking. Mosca says that it will take the efforts of this entire community to continue to develop these technologies. “Quantum information is vast,” says Mosca, “it’s not just one tiny niche.” Quantum cryptography is not the only research field that may change information security in years to come. Researchers in Waterloo are also working on other systems that could make many current digital security schemes obsolete within our lifetime: quantum computers. Mosca explains that today, almost all of the Internet’s infrastructure relies on a form of public-key cryptography known as RSA. Whenever your computer downloads any secure operating system or antivirus updates, RSA authenticates the source of those downloads. Whenever you make a purchase online, or sign in to online banking, RSA makes sure you’re really sending your money where you’re trying to send it. Each party involved in a communication has a publicly available key — a very large number — that works sort of like an address. That number is a multiple of two random prime numbers (a number divisible only by one and itself).
While anyone and everyone can send information to this public key, only someone with access to those two prime numbers can unlock the information on the other end. For any would-be eavesdropper who does not already have these two numbers, finding them can require enormous computing power. The longer the key or the greater the “bit size,” the less likely anyone is to determine those two prime numbers. That makes for a very secure transmission. Joseph Emerson, a faculty member at the Institute for Quantum Computing and the department of Applied Mathematics at the University of Waterloo, says that right now, there is not enough computing power in commercially available products to crack reasonably sized RSA codes. A quantum computer however, would change that thanks to a discovery known as Shor’s algorithm. Emerson explains that increasing the size of an RSA key by only a few bits would increase the computing resources required to crack that key exponentially. But, for quantum computers, it wouldn’t. For example, if a system can factor a 2,000-bit number, it would be able to crack an RSA key of comparable size. According to the Payment Card Industry’s data security standard, 2,000 bits is about twice the minimum keylength required to secure MasterCard payments. “A recent estimate suggests we would need a quantum computer with about 1 billion qubits to execute Shor’s algorithm on that sized number.” That may seem like a lot, but even a laptop with only 3GB of RAM has roughly 26 billion classical bits to work with. Now, a quantum computer would also perform a lot faster than a classical computer because, in some sense, tasks aren’t happening one at a time. In the documentary “The Fabric of the Cosmos,” theoretical physicist and
September/October 2014 • www.canadiansecuritymag.com SourceSecurity1_CS_Oct.indd 1
October 2014.indd 20
2014-09-12 9:00 AM
2014-10-03 11:06 AM
DATA SECURITY 21 author Brian Greene likens the process systems are compromised, they aren’t to being in a hedge maze. “What you’d easily changed. want is to find a way out as fast as Emerson echoes this concern, saying possible, the problem is that there are some information transmitted today so many options … you just have to try needs to remain secure for the next 50 them one at a time,” he says in the video. years. RSA cannot guarantee things like That’s the way today’s computers work: state secrets, health records or financial they try out all the possibilities one at a information will stay secure, even against time, although they do it very quickly. advances in classical computing. Now, Mosca and other teams are investigating A quantum computer on the other hand would, in a sense, try out many, which kinds of classical cryptography many possibilities may keep information at the same time. safe in the coming “Quantum information But this explanation quantum era. isn’t exactly correct, Researchers can’t is vast; it’s not just one Emerson contends. say how long it will “The truth is much be before quantum tiny niche.” more subtle, but not computers are large — Michele Mosca, Institute for easy to explain.” While enough to have Quantum Computing practical applications mathematics offers scientists a better but if their evolution resembles the classical understanding of these computer, global computing power processes than any conveyed through is bound to explode past the already language, the truth is that these processes impressive rate at which classical are inscrutable by necessity. You cannot computing is growing. observe the quantum computations Quantum cryptographic without ruining the desired effect. technologies, one the other hand, are Despite this, the effect remains both already on the market but the techniques impressive and easily articulated: a task remain largely experimental. While that takes a classical computer thousands of years to complete could be done by a the German experiment was the first quantum computer in only a few days. instance of wireless quantum encryption, Of course, this time frame represents a other transmissions have occurred over very rough theoretical estimate based on shorter distances through fibre optic the current understanding of quantum cables. In what may be the most famous systems, but the principle has been example to date, political officials in proven. Right now, however, even large Switzerland used the technology to quantum computers are far smaller than securely transmit the results of the 2007 their classical counterparts. Perhaps federal election. But the technology the largest computation to date was still has a long way to go before it carried out by B.C.-based company becomes uncrackable in practice rather D-Wave using 84 qubits, and even than in theory. Other research teams at Waterloo have identified and are large computers only have about 12 to 15 qubits to work with. Mosca says working to correct “loopholes” in the that scientists need to work on better technology’s engineering that might controlling the quantum mechanical allow an eavesdropper to intercept a properties of these qubits before they communication. begin to think about assembling largerBut if they can address these scale computers. However, he, Emerson difficulties, quantum cryptography may and Gottesman agree that it would very well provide permanent solutions to evolving computing power, emerging unwise to wait until these computers threats and more clever algorithms. pose a practical threat to implement more secure kinds of cryptography. Mosca says that current information Tristan Bronca is a freelance writer based in security isn’t all that “agile” and once Toronto.
13 OFFICES NATIONWIDE AND COUNTING.
WE’RE SHAKING THINGS UP
BIG TIME! INFO@SOURCESECURITY.CA 1-888-888-5451
@SecurityEd • September/October 2014 SourceSecurity2_CS_Oct.indd 1
October 2014.indd 21
2014-09-12 9:02 AM
2014-10-03 11:06 AM
22 SKILLS DEVELOPMENT
Time to get Online
E-learning tools have progressed in recent years and security professionals can benefit
By Vawn Himmelsbach
T
he traditional classroom isn’t always accessible to today’s working security professionals. But in security, continuing education is becoming increasingly important to further careers — and is leading to the rise of online and e-learning courses and tools. And it’s not so much about expanding skill sets — it’s about specializing. “The technology is requiring more and more specialization of knowledge,” says John Lechner, director of educational programs with ASIS International. “Every job is going to be unique and [continuing education] allows you to become a strong professional in one area.” Part of the need to be online is because technology is changing so quickly. Security professionals don’t always have time to go back to school full-time or even part-time. And if they live outside of major urban areas, the classroom simply isn’t a viable option. “I’m not sure that most of us have a lot of material online from the professional association side yet, but we’re all desperately building it,” says Lechner. ASIS is working with its partners to build an online learning system, where security professionals can simply set up an account and start looking for both in-class and online courses. So where is education headed? There is a movement toward online courses — ones that combine video, audio and chat capabilities for an immersive experience. We’re also seeing “hybrid” courses that
combine in-class learning with various online components. The University of Phoenix is an example of where this is heading: It has around 9,000 students signed up for security management courses — and they’re all online. “We’re working with [the university] to do studies on gaps in the security workforce and trying to build more courses that are dealing with those gaps,” says Lechner. “When you’re looking at competency-based learning, that allows for hybrid learning,” he adds. Certain competencies can be taught online, but there are those that are more difficult to convey in an online environment — those that must be taught in a classroom or field location. How to do a security audit, for example, must be taught in the field,
says Lechner. You can teach the theory online, but certain practical skills must be learned through real-life experience. Education used to be all about getting a degree, he says, which meant you met the qualifications of the degree — not necessarily that you’re qualified for a specific job. With competencybased learning, you can apply what you already know in a different way. “It’s all going to be hybrid in the future.” AFIMAC Canada provides a swath of online courses for security professionals, from mailroom safeguards to armed robbery response — and they’re available in almost every format, physical or in-class or online. “For the physical side, those are a little more difficult to do online,” says Stephen Anderson, vice-president with AFIMAC Canada. For training in areas
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 22
2014-10-03 11:06 AM
SKILLS DEVELOPMENT 23 the Internet is an efficient way to get like cuffing, batons, firearms and takethat information out to the general down techniques, general theories could population. be taught online, but having a handsMany organizations are required on component is essential. “Whether to provide legislated training; if you it’s someone just entering the security have 1,000 employees to put through industry to someone who is a seasoned a course, it can be daunting from a expert, there’s always courses out there scheduling and resource perspective. to improve,” says Anderson. “If you can get most of that done in AFIMAC’s courses offer video, an online course, it makes things a lot photos and diagrams to support the easier,” he says. course material. This makes the learning Everybody has access to the Internet. process more interactive. If there’s a And today’s online courses are engaging, diagram of counter-surveillance and often with interactive modules. “There’s how people and vehicles should move video, there’s audio, in those situations, a there’s good graphics student could pause “The technology is and images that that and go back to relate to what’s being various bullet points. requiring more and taught,” says Romain. “People are tuned into “[Students] can get doing that now,” says more specialization of through it on their Anderson. own and download a Security knowledge.” certificate at the end professionals tend to John Lechner, of it.” have limited time — ASIS International Even though perhaps more so than online courses have other professions. been around for Working full-time years, the field is, in some respects, still makes continuing education a challenge, in its infancy. “It’s just starting out with and they often have additional concerns. the capabilities that you’re seeing now When a crisis hits, for example, they in desktop computing — the ability to could be on the clock 24x7. That’s why show really good-quality videos [and] AFIMAC designed courses that could be the bandwidth penetration so you done at a student’s own pace. “If I were can do more engaging exercises,” says to start a course today and get halfway Romain. “It’s those kinds of things that through it and a crisis hits and I can’t make it interesting for the individuals get back to it for the next two weeks, I actually completing these programs.” can just rewind and go back to the very There are still disadvantages beginning,” says Anderson. to e-learning, he says. You’re never That doesn’t apply to all courses, really going to be able to answer all though: Some online courses are “live,” of your questions online. Though meaning there’s a real-time component video chat could help resolve issues of with an instructor or other students, so misunderstanding. there’s less flexibility with the day and “The way the ministry has it set up, time. But this provides an element to it’s not just modules, there’s a facilitator the learning process that’s sometimes as well — an actual person you can missing in the online learning world: send emails to,” says Romain. This helps social interaction. to address one of the failings of online John Romain, an instructional learning — effective interaction. designer with Online Learning This hybrid approach is “the best Developer, is currently creating an online of both worlds” because students get course module for the Ontario Ministry foundational knowledge in a convenient of Labour, designed to educate the online environment, and any questions industry about new legislation around they might have can be answered by occupational health and safety — and
a facilitator in a video chat or online conference. A general investigative course for the Toronto police, for example, is offered in a two-week blended learning format. The first 40 hours are offered online, which must be completed prior to the second week, which is in-class. Another shortcoming with online learning is effective testing. “If you want to test [students] for any kind of accreditation, that has to be done faceto-face,” says Romain. “If they’re online, you can’t tell who’s taking the test, even if you have a camera there — they could be using a wireless keyboard. Any time it’s a critical test, it should and will be done in class.” One of the biggest benefits to online, however, is that it levels the playing field and offers continuing education opportunities to any security professional, anywhere in Canada. It’s hard to get people together for a class in remote locations, so Romain has also worked with Durham College to build an online component as part of its police foundations course. Students have the option of 40 hours in-class or online; most opt for online, he says. Online learning is not only accessible to security professionals in remote parts of Canada but to anyone around the world. “That’s how online learning allows us to reach further and assess knowledge in a different way,” says Lechner. Security standards have become more international in scope; the expectation is that security professionals are all being taught to the same competency. While taking continuing education courses can help to improve skill sets and even advance careers, they’re not the be-all-end-all. “If you study best practices but don’t inject them into your daily work, those will fall by the wayside,” says Anderson. “Education and continued learning is important but you really have to apply what you’ve learned.” Vawn Himmelsbach is a freelance writer based in Toronto. @SecurityEd • September/October 2014
October 2014.indd 23
2014-10-03 11:06 AM
Now one call protects it all.
Tyco SimplexGrinnell and Tyco Integrated Security have come together to form one unified organization in Canada—Tyco Integrated Fire & Security. We’re now your single source for the industry’s most comprehensive fire, security and life-safety solutions. Working with us means customers get the right solution, developed by experts and supported by the resources of a committed fire and security industry leader. We’re advancing safety and security for customers in Canada like never before.
Visit the one team that protects it all: www.TycoIFS.ca.
Tyco_CS_Sept.indd SIMP0180_CanadianSecurityMag.indd 1 October 2014.indd 241
2014-09-11 9/10/14 10:02 4:15 PM AM 2014-10-03 11:06 AM
14 10:02 4:15 PM AM
expert advice 25
Front Door SAFETY for schools Patrick V. Fiel, Sr. is an independent security consultant working with Aiphone (www.aiphone. com/ontario).
T
he Ontario Ministry of Education is on the right track when it comes to securing elementary schools — it starts with protecting the front entrance. During the 2005-06 school year, the ministry’s “Safe Welcome” program offered Ontario’s public elementary schools up to $3,100 to buy and install new locking outside doors, security cameras and buzzers (video intercoms). Nearly 850 schools took advantage of the offer. A 2012 program expansion added
schools from among 66 of Ontario’s 72 school boards. In total, more than 75 per cent of the province’s 4,000-plus public elementary schools received Safe Welcome funding. Some schools had already installed security access devices on their own. However, some campuses still allow visitors to walk unchecked through the main entry. Once inside, it may be impossible to keep them away from children. Protecting the entry is one of the wisest decisions administrators can make. Here are three components that can do the job. A remote-controlled front door lock lets campus staff admit visitors while sitting safely behind a locked door. And it’s important the door remain locked whenever students are in the facility. A video intercom serves as a campus
“video doorbell.” Signage directs visitors to a wall-mounted component outside the entry. The unit has a call button, while a built-in camera, speaker and microphone — combined with an interior desktop station — allows two-way voice-andview communication. Once a visitor is approved, the door can be remotely unlocked. If there’s any doubt about a visitor’s intentions, the door stays locked. Security screens made of stainless steel mesh deter criminals willing to break door glass or adjacent windows to enter. These screens are virtually impervious to hammers, knives and clubs — even gunshots. This equipment adds valuable layers of security between the public and students. And it adds them at one of the most vulnerable points of a school — the front door.
Securitas Canada earns ISO 9001:2008 certification for management of security services!
www.securitas.ca 1.800.268.0545
Our ISO Certification is based on our service delivery and not back office support. This focuses our quality management efforts squarely on our customers, and anchors our continuous improvement processes to service delivery. Our ISO certification will provide: • Greater focus on customer feedback and customer-centric data • Improved customer satisfaction • More consistency in the delivery of our services • Raised quality awareness and morale amongst our employees
Securitas Canada is a knowledge leader in security. From a broad range of services of specialized guarding, technology solutions, and consulting and investigations, we customize offerings that are suited to the client’s needs, big or small.
ISO 9001 is internationally recognized as the gold standard for quality management systems. The standard ensures that organizations are continuously striving to excel at operational excellence through measurable performance metrics. This provides customers with a high level of trust in the services and products of ISO certified companies.
@SecurityEd • September/October 2014 Securitas_CS_July.indd 1
October 2014.indd 25
2014-07-08 11:10 AM
2014-10-03 11:06 AM
26 product focus LOCKS AND DOOR HARDWARE Wireless reader
Door lever
Securitron The R100 Surface Mounted Wireless Reader with Aperio technology is capable of mounting directly on glass, stone, granite or marble entryways without drilling. Aperio simplifies installation, wirelessly linking the R100 to a new or existing access control system. It transmits credentials for request to entry in real time and uses a single-card system that can be used with existing ID badges. The R100 reader is available in two frequency models, each supporting a range of technologies along with NFC compatibility via Seos. The R100 is fully potted to operate in a wide range of outdoor temperatures, protected from moisture, heat and cold. www.securitron.com
PDQ The Orlando Lever is a contemporary door lever, designed for any décor, offered for both mortise and cylindrical locks. In the MR Mortise Series, Orlando is available in J and JW Trim 630 (US32D) stainless steel types. In the TJ Apartment Series, it’s provided in 630 (US32D) stainless steel. And in the versatile SD Cylindrical Lock Series, users may choose from 605 (US3) Bright Brass, 613 (Dark Oxidized Satin Bronze, Oil Rubbed) or 626 Satin Chrome finishes. The MR1 Extra Heavy Duty Series Orlando lever is UL/CUL 10C listed for three hours for single doors up to 4’0” x 8’0”. It’s certified to ANSI/BHMA 156.13200, Operational Grade 1 and Security Grade 1. www.pdqlocks.com
Cabinet door lock
Digital glass door lock
Olympus Lock The extended bolt for the N Series 100DR and R Series 500DR cabinet door locks provide an additional 3/4” to the bolt length when in the locked position. This allows the lock to be located farther from the edge of the cabinet door while still providing enough bolt material to engage the strike. Extended bolts are available separately (item number 15-1-35) or factory installed in the lock. www.olympus-lock.com
Adams Rite The RITE Touch RT1050D digital glass door lock offers a surface-mounted, keyless alternative for glass openings. It includes a fire detection sensor, break-in and damage alarm, is electronic shock resistant and features a dual action, safe thumb turn. Each unit is individually boxed with mounting plate, AA batteries (x4), credential cards (x4), single door magnet, bolt extensions, thin door plate, and mounting screws. www.adamsrite.com
September/October 2014 • www.canadiansecuritymag.com GaiTronics_CS_Oct.indd 1
October 2014.indd 26
2014-09-11 9:58 AM
2014-10-03 11:06 AM
Single door controller Kantech The KT-1 single door controller provides simplicity at the edge of an IP network. With its single button programming and on-board Ethernet port for direct network connection, the KT-1 controller is up and running in just a few steps. Because of its unique form factor, the KT-1 controller can also be installed in a variety of locations, from plain view to a traditional security cabinet. Combine the new KT-1 controller with EntraPass security management software, including EntraPass Web and the EntraPass GO mobile app to create a scalable solution that installs quickly. www.kantech.com
STOCK
Z-Wave deadbolts Yale Locks & Hardware The Real Living Key Free Push Button B1L and Key Free Touchscreen T1L Deadbolts offer streamlined installation, enhanced security, one button Z-Wave enrollment, and a modern appearance. The Yale key free deadbolts eliminate the cylinder and as a result, the lock can’t be picked or bumped. The push button version comes with a black push button keypad that illuminates when touched. The touchscreen model features a black acrylic capacitive touchscreen. The Key Free B1L and T1L include fully gasketed installation, ANSI/ BHMA grade 2 certification, motorized tapered deadbolts, and intuitive phone layout keypads. www.yalerealliving.com
CUSTOMIZED
Server cabinet lock HES The KS100 extends access control to individual server cabinet doors to protect data centre assets from intrusion and expensive downtime. The KS100 leverages Aperio technology, enabling mechanical locks to be wirelessly linked to a new or existing electronic access control system. The HES KS100 integrates with existing access control systems and ID badges, extending access control from the server room entrance to individual server cabinets, while eliminating the need for keys or codes to remember. www.hesinnovations.com
Smart deadbolt
CUSTOM
IMPROVE YOUR VIEW
Kwikset When paired with a Z-Wave-based home automation system, the SmartCode 914 Deadbolt with Home Connect technology includes a range of enhanced design features, as well as new certifications and capabilities. The design offers a new exterior style and reduced interior size for enhanced aesthetics inside and outside the home. Features include: an all-metal interior escutcheon with decorative inset; a 10-digit backlit pushbutton keypad; a dedicated lock button; and a Master Code option, that allows the user to prevent user codes from being added to or deleted from the lock. www.kwikset.com @SecurityEd • September/October 2014 Winsted_CS_April.indd 1
October 2014.indd 27
2014-03-20 11:20 AM
2014-10-03 11:06 AM
28 Book review By Derek Knights
Cutting to the chase The Art of Thinking Clearly By Rolf Dobelli Harper Collins ISBN: 9780062219688
F
rom the first chapter, entitled “Why You Should Visit Cemeteries” I knew I was in for an interesting read. After two pages of interesting discussion, author Rolf Dobelli says, “Survivorship Bias means this: People systematically overestimate their chances of success. Guard against it by frequently visiting the graves of once-promising projects, investments, and careers. It is a sad walk but one that should clear your mind.”
Lawyer,
Mediator
Author of Visual
Evidence
Elliott Goldstein, Cell: 416.315.0066
& B.A., J.D.
elgold@rogers.com
Mediation of Disputes - Commercial, Shareholder, Employment. Litigation to Collect Debts or Defend Customer Lawsuits. Alarm Installation & Monitoring Contracts, Employment Agreements. Minute Book Reviews and Updates, Incorporations. Wills, Powers of Attorney for Property and Personal Care. Video Surveillance Law Seminars, Forensic Video Analysis Law.
www.videoevidence.ca 45 Redondo Drive, Thornhill (Vaughan), ON, Canada L4J 7S7
Fax: 905.597.6226
According to the book’s cover, it contains “examples of what the author calls cognitive biases, simple errors all of us make in day-to-day thinking.” Each chapter is a simple explanation of the many reasons why we do things wrong, backwards, or upside-down. I loved it and I think I learned as much chuckling through its 99 chapters as in the 55 years I’ve had learning from the same mistakes. Does it translate well in the world of security professionals, fraud investigators and business managers? Oh, yes. Particularly if you have that (rare) ability to look at yourself with a critical eye and admit when you are wrong, and actually take steps to deal with it. Most of us are familiar with Confirmation Bias, whether you know it by that term or not. It’s when you find yourself interpreting available facts to fit your existing theory. He quotes Warren Buffett who said people are good at “interpreting all new information so that their prior conclusions remain intact.” Be honest. Don’t you do that? Dobelli uses one of Aesop’s Fables to demonstrate Cognitive Dissonance, a common error in reasoning: when we set out to do something, fail, and therefore reinterpret what happened retroactively. This is a frequent challenge in all parts of life, but more noticeable in business, and potentially harmful in the security field. There are times when we need to coldly examine our plans and projects and objectively identify challenges so we can competently deal with them. I really liked Chapter 57, called “If You Have Nothing to Say, Say Nothing.” It’s about the Twaddle Tendency. Dobelli defines that as “[using words] to disguise intellectual laziness, stupidity, or underdeveloped ideas.” The meaning of about half the written work I see daily is camouflaged beneath extraneous verbiage that, once hacked away, leaves a message inadequately articulated. Dobelli says the more eloquent the haze of words, the more we fall for it. It’s why we see so much writing that’s wordy, confusing and incomplete. Dobelli’s book carries endorsements from some credible people, such as Nassim Nicholas Taleb, author of The Black Swan — another book about errors in thinking — and a Harvard professor. He doesn’t just prattle on about people’s funny quirks, but concisely points out behavioural and managerial risks. Get yourself a copy of this book for the office. Those days when the screen and keyboard are getting to you, it’s a terrific little mini-vacation. Each chapter will take you less than five minutes to read, and you’ll likely both chuckle and learn something, too. Derek Knights, CPP, CISSP, CFE CIPP/C, PCI, is the senior manager, strategic initiatives, global security and investigations, at the TD Bank Group (www.tdbank.com).
September/October 2014 • www.canadiansecuritymag.com Goldstein_CS_Sept.indd 1
October 2014.indd 28
2014-09-04 1:44 PM
2014-10-03 11:06 AM
Securete
October 2014.indd 29 Securetech_CS_Sept.indd 1
2014-10-03 AM 2014-09-04 11:06 2:52 PM
30 world watch Rehab centre seeks CCTV stability
VMS helps with child-parent relationships
The National Rehabilitation Center, in Khalifa City, Abu Dhabi, spends, on average, more than US$350,000 per patient on their treatment. The centre is comprised of two structures: Complex 1 and Complex 2. Complex 1 suffered a series of security setbacks, so, when opening Complex 2, administrators chose a different approach. Regional security integrator Euro Technology offered a presentation that promised to fulfill the client’s needs. Improvement included a mix of Hikvision cameras and an iVMS-4200 Management Software to control the solution. Positive results combined with stability improvements (no delays or crashes), led facility administrators to grant Euro Technology a new contract to duplicate its Complex 2 success in the security-problematic Complex 1.
A hospital in Joensuu, Finland, is using a Milestone Systems VMS to tackle difficult care challenges through innovative parent-child training. North Karelia Central Hospital offers specialized medical care and special needs services for the inhabitants of its 14 member municipalities. At the hospital, the parents are let into a room with their child while the staff observes them from another room, viewing with the Milestone XProtect Smart Client. The Axis cameras and Milestone XProtect are used in a special clinical environment, furnished to look like a home with a kitchen and a bedroom. The hospital staff use the system to review interactions and evaluate them with the parents.
U.S. health system picks incident management system North Shore-LIJ Health System in New York State has selected incident management software from PPM 2000 as its new dispatching, incident reporting, and case management platform. The rollout is scheduled for staged implementation across 16 hospitals and will commence with the five largest hospitals in the system. Each of these hospitals has a full time desk officer who is responsible for incident management reporting at that facility. Implementation at the remaining hospitals is scheduled for completion over the following six to twelve months. The expanded central command centre will be responsible for incident management reporting at these other locations.
Peace of mind for retirement facility McCrite Plaza Retirement Community recently expanded its operations by opening a 163-unit combined senior-living and assisted-living community in the Briarcliff area of Kansas City, Mo. To protect resident safety and its investment in the new 200,000-square-foot building, McCrite deployed a Toshiba IP video surveillance system. During construction, management of the new facility sought out an IP-based video surveillance solution providing forensic-quality streaming video images and lowbandwidth consumption. Its mission was to protect residents, monitor staff, deter theft and vandalism, and to further facilitate peace-of-mind for family members. “McCrite is dedicated to providing only the absolute best for its residents,” explains Cassidy McCrite, director of McCrite at Briarcliff.
Turkish supermarket buys into biometrics Carrefour Supermarkets in Istanbul, Turkey, have deployed Suprema fingerprint recognition terminals for a new system of access control and time and attendance. The company decided to change from an RF card-based system to a fingerprint-based system in order to meet HR-related challenges, such as “buddy-punching” and frequent card loss, and improve efficiency and productivity in administration. “We’re very pleased to provide our products to Carrefour, a global leader in the global retail industry.” says Young S. Moon, vice-president of Suprema. “Though the project is specifically for the supermarkets in Istanbul this time, we expect it will be a momentum to bring more opportunities of business expansion for partnership with Carrefour Group internationally in the future.”
Ad Index Avigilon Axis Communications Commissionaires Elliott Goldstein Gai-Tronics HID Honeywell
9 www.avigilon.com 5 www.axis.com 2 www.commissionaires.ca 28 www.videoevidence.ca 26 www.gai-tronics.com 32 www.hidglobal.com 7 www.honeywell.com
Keyscan Milestone Systems Securitas SecureTech Source Security Tyco Winsted
31 www.keyscan.ca 3 www.milestonehusky.com 25 www.securitas.ca 29 www.securetechcanada.ca 20,21 www.sourcesecurity.ca 24 www.tycoifs.ca 27 www.winsted.com
September/October 2014 • www.canadiansecuritymag.com
October 2014.indd 30
2014-10-03 11:06 AM
Keysca
KEYSCAN GIVES LEGACY ACCESS CONTROL SYSTEMS WHAT THEY NEED
...A FUTURE. With Keyscan’s full complement of feature-rich 1, 2, 4 and 8-reader door and elevator floor access control units and our renowned software, we can provide a simple solution to upgrading your aged or failing access control system. Keyscan’s ‘hybrid’ approach to access control mixes network appliance-based hardware architecture as well as our ‘At-the-Edge’ solution. It simplifies system design by utilizing some, if not all, of your existing readers, credentials, network and power cables. Keyscan’s approach helps you breathe new life into your aged or failing system by providing the latest in access control technology and making it easy for you to upgrade.
Contact Keyscan today to find out how we can assist you. 1 888 KEYSCAN (539-7226) toll free Canada or USA www.keyscan.ca
October Keyscan_CS_Sept.indd 2014.indd 31 1
2014-10-03 2014-09-1611:06 10:56 AM AM
Move to the secure platform that grows with you.
Leverage HID Global’s extensible iCLASS SE® Platform to keep your access control optimized, today and tomorrow. With constantly evolving access control concerns and demands, how can you ensure your investments today will be operable tomorrow? Go with the new standard in access control — HID Global’s iCLASS SE® Platform, the open and adaptable solution that easily integrates smart cards, mobile devices and whatever tomorrow brings, for greater security and flexibility. Now no matter where technology goes, your access control is always growing with you. Learn more about the iCLASS® SE Platform’s advantages at hidglobal.com/grows-cansec © 2013 HID Global Corporation/ASSA ABLOY AB. All rights reserved. HID, HID Global, the HID Blue Brick logo, the Chain Design, and iCLASS SE are trademarks or registered trademarks of HID Global or its licensor(s)/supplier(s) in the US and other countries and may not be used without permission.
iclass-se-platform-grows-cansec.indd 1 HID_CS_Nov.indd October 2014.indd 132
11/7/13 10:27 AM 2014-10-03 2013-11-18 11:06 9:23 AM