Well, this seems to be the season for “major” security breaches.  There seems to never be a week in the last few months some retailer or government entity isn’t revealing how it’s been penetrated. Along with those revelations comes the torrent of critics who ask “How could this happen?” and proclaim “This is the worst thing ever!….Incompetence!….This is epic!” Please, note the heavy amount of snark and sarcasm there. As one of a few people who sort of gets security, I often find myself getting increasingly frustrated about the growing number of amateur critics who have in some way implied “expertise” on a topic few professionals in the industry actually get. So in an effort to educate everyone and to vent (okay, mostly to vent), I’ve decided to do a piece on the myths surrounding security. Bear with me. If it feels like I’ve kicked you in your stomach, good – that’s why I’m doing it.

1. Physical security is easy. Sigh. This is the most upsetting and doggone frustrating statement a security professional could hear. Contrary to popular belief, security is not easy. It’s pretty hard, actually. There’s a lot more that goes into security than just bag searches, menacing guards, cameras, and alarms. It encompasses multiple disciplines which contribute to the security mission. They range from everything from the information security to operations security to risk management to executive protection to physical security to personnel security to personal security. All of them bring something unique to the table. Each is an integral part of the total security package. It takes a professional versed in all of them to be able to deploy the package seamlessly.
2. Anyone can do security. Ugh. Wait, no. Double – ugh!! Not everyone can “do” security. As I stated before, it’s hard. It’s not rocket science but if the only thing you’ve ever protected in your life was a bike in a bad neighborhood, you may not be as qualified as you think to speak expertly on matters such as the security surrounding rather complex and sensitive facilities as the White House or military bases. I know I just made a lot of folks in the DC press conglomerate very unhappy. So let me explain. You can have all of the facts on an issue but still not get the nuances behind how to properly execute an effective security plan or understand the stark realities those facilities face. As a matter of fact, there are people in the job who barely get some of these concepts which explains why so many security plans fail.I’ve been in this industry for 14 years and there are things I’m learning every day. I am no “expert” and I often eschew any effort to attribute me to that title. It is also my suggestion, given my background, if I admit to knowing far less than most “experts” with less experience are willing to, then maybe you should be questioning their “expertise” as well. Think you can “do” security? I’d happily place you in charge of physical security at the White House which receives MILLIONS of visitors every year and hosts the most targeted human being on the face of planet Earth. Good luck.
3. There’s entirely too much security for this. Another sigh. Seriously, folks. Unless you’ve walked in the shoes of the person who designed the security apparatus for that facility or worked in a similar post, you may not understand the thought-process behind how security is set-up there. In order to better educate most folks who are not familiar on this topic, I’ll take a moment to digress and speak on the mission of security and how it is often set-up.Security’s primary mission, no matter the discipline, is pretty much the same minus some semantics. It is to detect, deter, delay, and destroy. There are professionals who will undoubtedly find issue with my choice of words here. My message to them is clear – I get it but let’s think more figuratively. While it is optimal in security to see the threat before he arrives, that may not always be the case. In fact, there is very little empirical data to suggest much of what is done in physical security actually deters the truly dangerous threat. However, what is quantifiable is delaying and subsequently disrupting or destroying the threat’s ability to continue their actions.
   

   A great example of classic defense-in-depth

   Finally, let’s examine what drives most security plans. Much earlier, in another post, I wrote extensively about risk management which is a process by which security professionals and their stakeholders ascertain the level of risk they’re able to maintain and the mitigators they plan to deploy minimize the risk.  As you can imagine, this process is what most security plans are derived from. Within those plans, therein lies the basic outline of how most modern security is implemented – defense-in-depth. This is best explained by asking you to imagine an onion. As you peel the skin on any onion, you’ll note the various layers contained. Security is much like that. Every protected resource has an outer layer of protection which supports the inner layers. The close you get to the resource, the more intimate the security. Imagine the White House. The far most outer layer of security there could be the scores of CCTV systems found all over the DC area. From there, the security mechanics become more intimate with their resource. Stop laughing. I hear the jokes. Serious. Stop it. The inner layers encompass a new level of protection more closer to the resource than the next. See, I cleaned it up for you.

4. The security guys just need to do a better job. Really? Like seriously. What qualifies you to make statements like that? Have you examined the actual, no-kidding threat intelligence or data to understand the nature of the adversaries those “security guys” may face or the countless attacks which get thwarted. A great example of this is a conversation I had recently with a political website editor regarding how the United States Secret Service would be better served by doing a “better job of managing its fence” rather than deploying checkpoints further from the ones already at the gates closest to the White House. I strongly disagreed not because I love checkpoints (I don’t – see my thoughts on crowds) but because I understand (because I’ve actually done executive protection and physical security versus offering critiques about something I only read about) what drove the US Secret Service to acknowledge they were considering checkpoints. You would be remiss as a professional not to consider them as an option. I think we would all do a lot better to understand the difference between a consideration and an implementation.
5. I have a PhD so I have the magic ability to know all things related to security, though, my PhD is in an unrelated field or I’ve written books non-security professionals think is dope. I won’t waste a lot of time and space on this but this is a growing issue throughout social media. Stop it. There are few things more irritating than to be dismissed by an academic or author who thinks their degree or books written provide them with omnipotent ability to know everything they need in order to criticize security. As I’ve stated before, you’re probably extremely smart in your area of expertise. This does not lend itself to transference into what I’ve done for 14 years. Sorry. But that’s the truth. Again, I don’t know a whole lot and there are guys in my field who are far more impressive than me. That being said, read this and #2.

   

6. You say tomato and I say TOH-MAH-TO. Same difference. No, it’s not the same. In security, certain terms do matter. They really do. For example, I had a very good conversation with a national security pundit I follow on Twitter, Joshua Foust. Joshua is smart when it comes to matters of national security and almost ties John Schindler in trolls except Joshua doesn’t have a parody account yet and his and John’s tweets are thought-provoking.  That being said, our discussion this morning was about the efficacy of passport revocations. Joshua intimated revocations made jihadi terrorists stateless people. I find that most people confuse revocation of passports with revocation of citizenship. The two sound the same but are vastly different both in mechanics and impact. However, because they sound the same they are often confused. We saw this when Snowden’s passport was revoked. People claimed he had been stripped of his citizenship, although he never formally renounced his citizenship nor did Congress or the President revoke it. In fact, the passport revocation is nothing more than a travel restriction. You’re allowed to travel to other countries as long as your country provides you with a valid passport. If your country revokes your passport, you’re no longer able to travel and can only come back to your home country.Joshua would later admit the semantics were different and we both agreed there were mechanisms already in place with respect to fugitive warrants and the Foreign Terrorist Organization designation. Neither, from my limited knowledge, have been integrated when it comes to jihadi foreign fighters. Something, I’m sure the President and other leaders are seeking to change because the inherent value of Western foreign fighters for groups like the Islamic State is their passports. Western travel documents can gain you access to a variety of countries, if they’re not revoked or cancelled.
7. I could take down security anywhere and I could break in there if I wanted to. Okay, that sounds very cool. I’m sure you could. However, taking down an unarmed security guard because he’s 75 years old with a bad limp is vastly different than being faster than his radio and being tougher than the eight burly deputies who will respond. You might also be able to break into a facility. That’s also great and amazing. However, keep this in mind – sometimes breaking into a facility has more to do with luck rather than skill or technical acumen – remember one of the latest White House fence-jumpers was a toddler. In other words, the sun shines on a dog’s rear every now and then. You also may not be as lucky as you think.

8. OMG, this breach was the worst breach EVER!! Stop. Full-stop. Don’t move. Breaches happen all over physical security for a variety of reasons. Some are preventable, sure. Some are not. Some occur in ways professionals never thought of. Some occur because the security manager and his/her stakeholders accepted too much risk. All I ask is that before you roll up a physical security breach as the worst ever, analyze not only the breach but the totality of circumstances. Some people are making a big deal about the recent White House fence-jumper who made his way “into the White House”. I’ll take a moment and explain why this is wrong.Yes, the White House fence-jumper recently made his way to an inner layer of the mansion. Keep in mind what I said about layers. Here’s something most critics won’t acknowledge mostly out of ignorance. The doors, which I have pictured below, are actually an entrapment area. Wait. What? Yes, the North Portico doors are indeed an entrapment area. What does that mean? Simply put, the exterior doors remain unlocked so exterior personnel (security and non-security) can enter through them and gain access through the second set of doors which remain locked and more than likely, guarded by on-duty US Secret Service Uniformed Division personnel. In other words, someone or something would need to verify your credentials before allowing entrance into the interior.
   

   The diagram of the White House showing the doors.

   The North Portico doors UNLOCKED. But do you see the doors behind them?

   Scriven, how does this change the fact that he should have never gotten that close? It doesn’t. However, it’s always best to remember while this is the first time someone has made it to those doors, there have been other more egregious breaches. Thirty-three others, to be exact. Remember when the airplane crashed in the White House lawn? I digress. Did the USSS accept too much risk by keeping the doors unlocked? Sure, but I’m also aware these doors were probably unlocked more for convenience for certain non-USSS personnel. How do I know that? Because I’ve done something similar in a variety of security situations. So what does this little exercise tell us? First, it tells you I have entirely too much time on my hands and I spend a lot of time on Twitter. Second, it tell tells you exactly why layers exist and whether they function properly. In this case, a few layers were breached but the resource was secured by one. Third, a lot of people are making wild assumptions without having read the official report nor has there been an accurate articulation from which direction the jumper entered or whether he had been observed (my guess is he was). Also, some of these same people make all kinds of weird guesses about the nature of security at the White House based on rumor and what television and the movies convey. No, the President will not firing an RPG at multiple jumpers next time.

   Finally, it teaches us the value of relativity and complexity – this was bad but was it the worst? It’s all relative. Seriously, can you imagine managing the security of POTUS and his/her staff and guests AND the most iconic tourist attraction in the Western world? It poses some SERIOUS security challenges which are countered every single day, mostly with zero incidents. If this was the “worst”, then the Secret Service did an excellent job of containing the threat.

9. Security is pretty simple. I can’t even.
10. The Israelis do it better.
    

    Israel has an entirely different security landscape than we do. It’s also key to remember their adversaries surround them.
    — Scriven King (@scrivenlking) September 20, 2014

Source: http://kupeesh.com/social/even-friends-wont-miss-facebook-plans-eulogize-die/

In my current occupation, as an investigator, most of my day is spent on social media. Much of that time is used figuring out who the account belongs to in order to make contact with the user for a case I’m working on. In security, we’re often monitoring social media to gain some insight on kinetic events in our areas of operation. In either case, we run the risk of finding out the users of theses accounts being dead with little information given as to who may be using the account in their stead. I found this infograph here and sharing it on this space to help other practitioners.

Day after day, on social media and elsewhere on the Internet, there are lots of folks who are seemingly shocked every time a bad guy shows up and acts like a bad guy. Seriously, how many times have you read or seen “I can’t believe Suspect A was able to murder all of those people” or “If only they (security) did XYZ like I thought of during a conversation with my veterinarian who may have been in the military, that bad thing wouldn’t have happened”? I see it quite a bit and frankly, I’ve decided it may be time to finally add my .02 about it.

Those of us in security who have spent some time studying “the threat” (insert whatever scary bad guy you’re dealing with) understand what few who haven’t studied it don’t. No matter how awesome your protective measures are, they do little to mitigate (and certainly not “prevent”) the attacker unless you start thinking a bit like they do. Herein lies the fatal flaw of most “white hats” and even some “grey hats”.

1. You think of attacks in ways that you would conduct them. No offense but if you’re protecting yourself against robbers but know relatively little of them, you may be looking to deploy solutions which don’t work against that threat. One of the most painful things any security professional can hear when doing a site survey with a client from the client is “If I were the bad guy, this is how I would do it.” More often than not, it is not how the bad guys would attack. Think security cameras in homes. Most people will deploy a camera at home with the thought the camera provides an extra layer of protection when in fact it doesn’t. I have known several victims of home invasions who either had cameras installed or had an alarm sign out front. These are two commonly deployed deterrence tools that we know don’t work. Instead, focus on the problem as if the bad guy would ignore the deterrence measures (because he will because we have little proof he won’t) and proceed with the attack and use things like cameras as after-incident mitigation tools to catch the perpetrator later.
2. You think of your threat as one-dimensional. Most good guys see their threat based on commonly accepted precepts of what the threat is and how he has attacked in the past. Just because the bad guy only hit you or the other guy using one vector doesn’t mean he won’t try something different later. A great example of this is 9/11. Prior to the second World Trade Center attack, there were common beliefs that terrorists were only capable of performing certain kinds of attacks. What no factored in was changing realistic threat capabilities. In other words, we assumed the threat wasn’t evolutionary in his tactics. Seriously, who could’ve imagine having to protect a building against two near-simultaneous aircraft crashes? Perhaps we could have had we accepted the idea that as we change so does the threat.
3. You think the threat is omnipotent and omnipresent. It’s easy to get caught up in the hype of a threat. I do it sometimes. This is a natural defense mechanism after an attack has occurred. Why? No one likes to have their vulnerabilities exposed. After every mass shooting or act of violence that makes the news, we assume every venue that is like the one that was attacked is also vulnerable and being selected as the “next” target for another perpetrator.

   I remember fondly working on 9/11 on a small Air Force base on a perimeter patrol. What I recall the most are the initial attitudes people had of al Qaeda. We believed this one attack displayed a level of sophistication unseen by them before on US soil could be replicated on a massive scale. Every Muslim, ignorantly, was assumed to be a sleeper agent waiting for cues from “Muslim HQ” to attack us wherever and however they chose. The months and years ahead showed how far from the truth that was. Imagine how many countless resources were expended before we realized the fallacy behind this assumption.

4. You think your attacker “chose” you for a variety of reasons he didn’t. People almost always assume an attacker chose to attack them or others for reasons they didn’t. Rape is commonly thought to be a crime of lust because good people believe sex is the only reason you rape because it’s the end-result. However, most criminologists and psychologists would agree rape is a crime of power. I would argue the majority of crime takes place for this very reason. Terrorism occurs because of this as does murder (what’s more powerful than ridding yourself of someone permanently), drug dealing, fraud, and a host of other crimes. You’re either fighting to obtain it (i.e. steal it from someone else) or committing crime to become more powerful. This confusion could possibly explain why most crime “prevention” measures based on policy fail at alarming rates – we’re clueless on what truly motivates people to attack us.
5. You assume because you haven’t seen the threat, he must not exist. Whether we see the threat or not, we should never assume he does not exist. While the threat can’t be everywhere every time, the threat can still be very much. Never assume the absence of threat means he or she isn’t going to show. You still need to adequately protect your assets as if today is the day you’re going to be attacked. Remember, the attacker chooses the time of attack. You choose how well-prepared you’ll be when it happens.

I’m not proposing anyone go out and hire a red team. I firmly believe one of the reasons we, often, fail so miserably at security sometimes is due to our natural inclination to think the bad guy thinks like we do when they don’t. So how can we fix this?

1. Study your adversary. Seriously, pour over any open source intelligence you can on your threat. Read the paper and look for crime stories. Pick up a police report or two on similar venues like yours. I’ll leave how you conduct your research to you. Just do it. Stop assuming blindly how the attack will go down or even who your adversary is.
2. Consider hiring folks who can think like attackers. I’m not saying you hire criminals but red teams hire specialists who can mimic attackers. Choose folks from a variety of backgrounds to round out your security team. By the way, by “background”, I’m not talking education. I mean pick a team with a variety of specialists.
3. Test your systems with exercises. The only way you’re going to learn is by testing how well your security program holds up against an actual attack. Consider doing this with little to no notice and have an after-action or “hot-wash” debriefing with your red team and affected staff right away. Finally, fix the vulnerabilities as soon as possible.
4. Reward outside the box thinking. When I was a young boy, I recall my fondest memories were playing games like “hide-and-go-seek” with my friends. The guys who were the most creative were the best at this game. Why? Because they were unpredictable. I’ll leave how you choose to reward these folks on your own. Just do it.

I can’t even begin to tell you how many times I run into stores that have decoy cameras in lieu of real cameras. I also can’t tell you how many countless times these same stores get robbed. Buying a decoy camera, in my opinion, are invitations for criminals. This is not to say most criminals can’t tell the difference between fake and real. This is to say that many of these businesses and homes that utilize decoy cameras don’t quite get what kind of mitigators they need to adequately protect themselves and their assets.

The added statistic at the bottom of this photograph is especially troubling because it dupes customers into believing they have added another layer of “security”. This is correct in some respects. Remember what I said about “security” being a goal and less of an action? The problem lies in exactly the same place issues of semantics in security are – it relies on data that is either incomplete and more than likely, irrelevant to their protection needs.

We all know cameras serve a variety of purposes other than video surveillance. We also understand some vendors and property owners either have poor tools or are so under-trained they may as well not have a camera. However, when an incident happens, the last thing property owners want to tell the police and insurance companies (worse yet, a jury in a civil liability trial) is they thought a decoy or non-operative camera offered better protection.

If you’re a property owner and considering one of these decoys, turn around and invest in a camera system you will monitor and maintain. If you’re a pro, call these out and the dangers behind using them.

One of the toughest and most insightful lessons I learned came during a conversation with a good military buddy about why English is such a difficult language to learn. “You never mean the things you say. You say you “love” your car in Spanish, it means you love it like family. It’s as if you use the words so much they lose their actual meaning.” I was a bit taken aback by this. No one had ever explained the issue of semantics so eloquently before to me.

This same thing happens in security and explains what makes it so difficult for so many professionals and lay-people to be able to comprehend it. The following are great examples:

1. Prevention versus mitigation. Prevention is defined by Websters as “the action of stopping something from happening or arising.” Mitigation is defined by Websters as “the action of reducing the severity, seriousness, or painfulness of something.” The words mean something completely different from the other, yet are used interchangeably. In security, getting these two words wrong can mean the difference between a loss of life (yours or an innocent) and victory over an attacker. Having lofty goals of prevention through methods and measures seldom tested with actual bad actors, often leads to failure when they do show up. However, having sound mitigators in place should they attack, could save both life and property and result in the consequential capture of your bad actor. The decision to stop his or her actions is totally dependent upon his or her decisions and plans before and during the attack. Your measures could help persuade them not to attack but I would hardly call this prevention without more quantifiable evidence.
2. Vulnerability assessment versus reconnaissance. A vulnerability assessment is a process which entails analyzing a client’s assets to determine likely avenues of approach for attackers. It could involve talking to stakeholders, physical walkthroughs of the assets, imagery analysis, and red-team exercises. Reconnaissance is a process which entails some covert surveillance resulting in a report to the target’s adversary to support a plan of attack on the target. These terms are often confused because people assume one means the other. Typically, bad actors do recon and friendly agents do vulnerability assessments. The latter could use the former as part of a red-team exercise or even as part of a walkthrough. However, the methods by which either is done are very different. Keeping this in mind prevents amateurs from thinking by doing reconnaissance, they are in some way doing a complete vulnerability assessment.
3. Security versus protection. It grates my nerves to hear people say they are “doing security”. I find most people have no true understanding of what the term means and are therefore, ill-suited for and failing miserable at the task they think they are doing. As I’ve discussed before, security is a mental construct wherein our protective measures are adequate enough in our minds to mitigate bad actors and their attacks to make us feel secure. It’s a subjective term but more of a goal and less of an action than anything else. Protection is what we do to make the environment secure enough to assuage our fears of a possible attack.
4. Arrested versus detained. It took me a while to get used to this. They both sound like they should mean the same thing but they do not. Ask anyone who has ever been arrested. Being arrested has an element of detention but it isn’t the totality of the action. You can be detained without being arrested. While this may sound like an issue of semantics, ask your legal counsel to explain what happens in security when you confuse your ability to detain versus your arrest powers.
5. OPSEC. OPSEC is one of the latest buzzwords to come into the modern security lexicon. Everyone believes they do it but few actually do to include me at times. Seriously, everyone on social media who is in our industry seems to have a burner cell phone number, 10 fake IDs, wall safes for their wall safes for the wall safes with their encrypted USB, uses TOR to hide from the NSA (as if), etc. The first rule of being good at operations security is to shut up about OPSEC. What’s the first thing people do when they think they’ve done something awesome with respect to OPSEC? They tweet about it on a source they don’t own with people they don’t know or could vet with any realistic degree of certainty, using communication they know very little about on the Internet which was created by some of their adversaries who have actively engaged in intelligence operations here since its inception. So if so few get it, why do they think they’ve adequately protected themselves? See the difference between prevention and mitigation.
6. Intelligence versus information. I often hear professionals claim they have “intelligence” on adversary, when in fact they don’t. Most often they have only raw information they haven’t vetted or analyzed. These colleagues suffer from the correlation paradigm where they mistakenly conclude correlating or parallel information to an event is the cause. In the analyst world, this is called “confirmation bias”. You believe the information because it confirms what you believe. Intelligence is the product of taking that raw information, vetting its source, comparing and contrasting that data against previous data and assumptions, peer reviews, and a final reporting of that information with an analysis centered on critical thinking. A newspaper article in and of itself is not intelligence because it says something we already thought was true. That would be akin to treating Weekly World News’ stories on aliens consulting a still-alive JFK on Elvis’ newly proposed welcome-back world tour as intelligence because you’re an Elvis-loving, conspiracy theorist who believes you’re an alien-abductee.

   

7. Guard versus officer. I’m sure to stir up something here. Let me clarify: there is NOTHING wrong with being a “guard”. However, traditionally, that word has gotten a bad reputation. Think “mall security guard”. These guys can be awesome professionals but the title does tend to minimize the extraordinary amount of work it takes to protect the thousands of mall patrons and mall assets against a variety of threats daily. It also does little to note the authority which enables them to perform certain legal actions against those threats such as trespass advisements and in some cases, arrests. “Officer” denotes they are an extension management and not merely someone who stands a post. They represent the extent to which managers are willing to go to protect their assets and their customers.

   Recently, during a discussion with another friend from the military, I recalled a conversation about semantics with a person who worked in what was commonly referred to as the “chow hall”. One day, I inquired why the name “chow hall” was such an insult to him. He explained “Do you guard planes or do you protect assets vital to national security? I don’t cook chow. I cook meals which are nutritious as per my training. We’re both professionals. I know people mean no harm but that term implies my food and what I do as a professional are sub-par and unworthy of a professional title, when that’s not true.” Vets, I hear the snickering. Stop laughing. But he had a point. One that wasn’t lost on me.

   How your customers see a “guard”:

   

   An image the term “security officer” typically conveys:

   

8. OSINT versus unclassified. I’m a huge supporter of open source intelligence (OSINT). This entails gathering intelligence from a variety of non-covert channels. This could include public radio, news broadcasts, social media, etc. I have noticed this word used to excuse what I believe to be gross violations of protecting classified or sensitive information. Let me explain. I certainly understand OSINT by its nature can come from unclassified channels. However, I also realize it does not negate professionals from their responsibility not to divulge information coupled with their “insider perspective” which may be tactically advantageous to an adversary. You can observe this lack of professionalism best on social media, during a critical incident. There’s seems to be a pandemic of sorts when these incidents happen which encourages its victims to feed their egos by talking endlessly about their highly sensitive “insider knowledge”. I, once, observed someone who is widely considered an “expert” tweet the locations of responding forces to a major hostage situation. Another person tweeted security measures at a base they just left. Sure, none of this was classified because it came from a radio scanner and personal experience. It was, nonetheless, highly sensitive and could have placed lives at risk, if the adversary had intercepted these messages. In the physical security, once sensitive information is compromised, we only have a precious, small amount of time to deploy mitigators. As I’m often say during these events, “Don’t let your ego and mouth write checks your a– can’t afford to cash with someone else’s collateral.”
   

   We’ve moved a table to barricade the door into this room. pic.twitter.com/FXj33EynxE
   — Federico Barillas S. (@fgbarillas) October 3, 2013

9. Active shooter versus mass killing. The best way to explain this is simply stating not every active shooter kills anyone and not every mass killing involves a gun. Yet, whether because of politics or hype, professionals and laymen still confuse these two. This may seem meaningless until you realize how information is gathered to study these two distinct events and the influence those studies have on policy.
   
10. Security theater versus threat mitigation. Look, folks, as professionals, we realize not every threat is going to attack us. We also get some of our measures are extreme. I’m certainly NOT trying to justify any abuses of authority or trust. That being said, just because you don’t see the “boogey-man” doesn’t mean he’s not there. Does this mean security should have authority to do cavity searches on everyone? No. But it doesn’t mean because that’s extreme that someone isn’t trying to do you harm. Do some threats get blown out of proportion? You bet. A vigilant public and other professionals are awesome checks against overreach, though. As every threat isn’t realistic, every threat mitigator isn’t security theater. We’d all do well keeping this in mind.

I had the privilege of working as a private security officer as one of my first jobs after getting out of the military. I did this job in one of the most disaster-prone areas of the country – Florida. During my training and my time spent with coworkers and supervisors, I had many conversations about our duty to remain on-site during a natural disaster. These conversations had me asking many introspective questions about my own personal preparedness to fulfill this obligation. I knew I was highly trained and very skilled in providing the best protection possible for our clients. I was more concerned with the stark contrasts between my preparedness from when I did similar work in the military versus this new arena as a civilian. In the military, my post was equipped with gas mask, Chemical Biological Nuclear Radiation Explosive suits, food rations, radio, and a huge support network. As a civilian, I had none of these to face similar threats. It was this realization that sparked my determination to “prep”.

“Prepping” is the application of various disaster preparedness concepts for personal and group survival in the event of a disaster. It’s that simple. No Rambo survivalist fantasies stereotypes. Just people who want to better prepare for disasters in order to survive. With that in mind, “prepping” seems to be one of the most overlooked portions of the security officer’s toolkit. Most agencies assign you a standard list of mandatory you need just to make it through a standard duty day. My hope is to provide you with a guide to get you through those not-so-standard duty days.

1. Flashlights. This goes without saying almost but I HIGHLY recommend carrying at least two more flashlights. In the picture above you will note two flashflights. I keep one for map reading and other minimum distance tasks. The other I use for longer distance tasks such as room clearing, site exploration, target acquisition, and signaling.
2. Compass, binoculars, and maps. Loads of security guys will carry the flashlight and maybe a knife and first aid kit. Few see the utility of having additional roadmaps and a compass. These tools are valuable for a variety of reasons in disaster scenarios that range from giving directions and position location to rescuers, navigation from one point on-site to another, and mapping terrain features and other locations as temporary shelter locations should they be needed.
3. Knives. I can’t overstate why having a knife is a good thing in a disaster. There’s practically an encyclopedia’s worth of knowledge of the best utilities for a knife. I won’t go over any of them here. However, I would like to specify the types of knives you should consider. I carry a defensive knife, three multi-tool knives, and a hunter’s knife. These knives each serve a multitude of purposes and have served me in more ways than I can articulate in this space. Suffice it to say, if you don’t get how these could benefit you in a disaster, then I suggest you get yourself in a situation where you need to cut, pry, hold, clamp, or stab something without them.
4. Notepad. Keep a notepad handy should you need to keep track of people in your area, emergency responders you’ve made contact with, how many people are on-site, etc. Anything and everything you feel you need to keep track of you should use this notepad for.
5. Tape. In my photo, you will notice electrical tape. I keep this tape in my kit mostly because this is my go-to tape for work and I keep it in the bag I take with me most in the field. It’s also handy to have in my car for various vehicle breakdown scenarios. Before you ask, I also keep duct tape handy. It’s another bag but I do have it and would use it over the electrical tape. The most important thing for security officers to note are the practical uses tape could have in a survival situation. In most cases, we use tape to keep things stuck together. There are a few more uses for tape other than this. I have used tape to close bandages, mark areas I cleared, hastily label items, etc. Just like knives, tape is another subject where the uses in a disaster are too large to discuss here. To say the least, if you don’t already, keep some tape in your gear.
6. Cottonballs. I keep cottonballs in my kit for two reasons. The first is to have it to use as a dressing for wounds. The other is to use it for kindling in case a fire is needed. You may scoff at the idea of needing a fire in a standard duty. However, remember this list is for those non-standard duty days.
7. Whistle. It’s a secondary communication device.
8. Lighter and “strike-anywhere” matches.
9. Signalling mirror. This is another communication device.
10. Address book. I keep all of the important numbers and information I may need in case cell service is out or my phone is dead. Most people are caught off-guard by how fast cell services goes out in disaster scenarios. Having a copy of your most important numbers is very important. You should consider having the numbers for:
    (a) Your local police and fire departments
    (b) Your home numbers and those of family members you may need to inform.
    (c) Your employer’s numbers
    (d) The National Weather Service Dial-A-Forecast for your local area
    (e) 511 and 311. This will provide local government information and traffic information.
    (f) Local friends who may have some situational awareness about what’s happening.
11. Debris mask. This is no substitute for a full respirator or gas mask but it could prove vital if the need arises.
12. Gloves. I normally carry both latex and work gloves. The latext I use to mitigate exposure to bloodborne pathogens, while I use the work gloves to mitigate exposure to various temperature fluctuations, rain, sharp or abrasive materials, and to gain better traction when gripping certain objects.
13. Paracord. Seriously, I don’t have enough space in the world to discuss paracord. Get educated on how useful just a few feet can be, if you’re not already, and I guarantee you’ll be carrying it daily as a part of your kit.
14. Basic tools. Screwdriver with multiple bits and a hex lock tool. Also, if your bag allows, consider carrying a hammer and camp axe.
15. Emergency blanket.
16. Miniature towel.
17. Portable poncho.
18. Basic first aid kit with bandages, supplies for tourniquets, and other items you have been trained to use in a medical situation.
19. Food. I pack food for sustainment and morale purposes. In other words, in my kit, you will find food for meals like MREs and other high calorie food meals and morale like snacks and some candies. Anyone who has ever had to eat the same meal over and over again or who has to “stretch” a meal out over a few days knows the power having some variety in between can have on your morale.
20. Water and purification tablets. The water goes without saying. There could be a situation when you’re stuck on site but with limited water options. Having water on hand and having the ability to purify the available water on-site will ensure you’re meeting one of the most important survival needs.
21. Clothes. Ever been on a patrol and got rained on? I have and the impact it has on you physically and mentally is taxing. Physically, you can suffer from hypothermia and all the ugliness associated with that. Mentally, there is nothing better than knowing you can periodically change clothes if needed. Anyone who has ever been rained on during a foot patrol can attest to this.
22. Boots. See clothes.
23. Rucksack or versatile tactical bag. The bag you see pictured above is what my wife has deemed my “tactical man-bag”. All joking aside, having a good bag to store your gear is of the utmost important. If you don’t or can’t go with a bag, then I suggest obtaining a pouch wherein you can carry your basic personal survival stuff in a pocket or some other storage compartment. You should test any bag to its limit. My recommendation, if your budget can handle it, buy a rucksack from the folks at GoRuck and evaluate the bag through their course. I have been meaning to do a GoRuck Challenge just for this purpose. No better way to see how your bag holds up other than through some stress. GoRuck puts on challenges that will do just that and give you some idea as to where you stand with another critical survival tool.
    
24. Conditioning. I hated this word in high school. It meant long runs and grumpy coaches. It also meant I would be better prepared for whatever the opponents threw at us that season. The same goes with disaster prep. You should be engaging in enough physical activities daily to prepare yourself for situations wherein your body could easily be the leading cause of death. Remember the first rule in the movie Zombieland was Cardio.
    
25. Train. The items on this are dependent on the most important tool you always carry with you – your mind. Please, don’t buy any of the items on this list unless you feel you can adequately use them to save your life or the lives of others. In other words, if you don’t know how to use the tool, find some training to figure it out or practice with the tools until you get it right. These items require the same amount of dedication to master as your firearm or other relevant security tools.