Disaster Due Diligence March 13, 2009

Workplace violence

HEADLINE: U.S. to get new Workplace Violence Prevention and Intervention American National Standard

SUMMARY: ASIS International and the Society for Human Resource Management are collaborating on a new standard for developing an approach to help minimize workplace violence. The standard will provide an overview of policies, processes and protocols organizations can adopt. While workplace violence incidents may often seem unforeseeable, there are steps to take to mitigate this threat.

STORY LINK: http://www.continuitycentral.com/news04451.html

ANALYSIS: An employer owes a ‘‘general duty’’ to protect employees against ‘‘recognized hazards’’ that are likely to cause serious injury or death. Workplace violence has been identified as one of those hazards, and both federal and state OSHA agencies have issued citations to employers under the act’s general duty clause for failure to protect employees against workplace violence. Seventy percent of workplaces have no formal workplace violence program, despite findings that there are thousands of threats of violence every workday.

According to research, 43 percent of those threatened and 24 percent of those attacked at work do not report the incident. The economy has added increased pressure. Businesses are bracing for more crimes committed by both external and internal perpetrators in a rough economy. The worry is that poor market conditions will result in more burglaries, and company layoffs could increase cases of embezzlement, theft and workplace violence by disgruntled workers.

-- Jim Satterfield, Firestorm President/COO

Homeland security

HEADLINE: Top U.S. military officer: Mexico violence a crisis

SUMMARY: Joint Chiefs of Staff Chairman Adm. Mike Mullen, returning from a six-day trip to Mexico, has referred to the recent increase in violence as a crisis. The U.S is identifying ways for its military to help the Mexican government with training and resources to help battle the violence. More than 1,000 people have been killed in drug-related violence already this year.

STORY LINK: http://www.midwestagnet.com/Global/story.asp?S=9964586&nav=menu1585_4

ANALYSIS: We take safety at home for granted. We take vacations and manufacture products in Mexico. Mexico is in a state of civil war between the drug cartels and the government. The cartel’s army is larger than the Mexican government’s army.  This is not drug dealer on drug dealer violence. Rotary clubs have to change where they meet weekly in secret to avoid kidnapping and assassination. The problem has spilled over into the US. Recently 750 people were arrested in the US. US hospitals in Texas have had the violence come into the hospital. Mexico and its related problems will impact a wide range of US businesses and families. Supply chain risks to personal safety are in jeopardy, now. Mexico represents a real problem on our border rapidly spiraling out of control.

-- Jim Satterfield, Firestorm President/COO

HEADLINE: D.C. sells gear at auction despite terrorism concerns

SUMMARY: Disposal of surplus police and fire department gear at a Washington D.C. auction raises concerns that this material can benefit terrorists. Uniforms and gear are regularly auctioned and can be potentially used by terrorists to potentially blend in and allow them to gain access to restricted areas.

STORY LINK: http://www.firerescue1.com/fire-department-management/articles/458009-DC-sells-gear-at-auction-despite-terrorism-concerns/

ANALYSIS: The potential for a terrorist to use a first responder’s uniform is real, but it is only one of many concerns.  Ambulances have been used in Israel by potential bombers.  Conversely, the 1993 World Trade Center and 1995 Oklahoma City bombers wore plain clothes, as did the 9/11 hijackers.

The authorities quoted have to acknowledge the degree of risk.  Whether it is a significant danger is debatable.  There is no standardization between departments; state, county, and local police wear different uniforms.  There is even variation within agencies – police, fire, and EMS can be seen wearing traditional service uniforms, utility uniforms (akin to military fatigues), and even bicycle shorts.  Uniforms and simulated credentials can be bought on the internet, so there is little need to go to a government auction.  Moreover, when you consider that there are approximately 40 different police agencies in Washington, D.C., assuming the appearance of a first responder becomes easier.

Individuals with ill intent are typically detected as a result of their behavior.  Do they fit in?  Is there something unusual about their actions, including a mismatch between the uniform and the vehicle?  Having well defined and practiced roles and procedures not only makes response more effective, it also causes those who do not belong to stand out.  Positive identification is another aspect of ensuring security.  For high-security events such as the recent inauguration, all potential participants were prescreened and credentialed.  Proper identification was mandatory for entry into an area, with no exceptions.

As an aside, the article carried a comment recommending donation of excess public safety property to developing nations.  While this is a wonderful idea, there is nothing to preclude terrorists from obtaining these items in those locations and re-importing them to the United States.  Threats will always be too numerous to entirely counter.  The danger comes from lack of preparedness.  An investment in Firestorm’s Predict. Plan. Perform. philosophy optimizes safety and security – and delivers significant return in prevention and response capabilities. 

-- Don Donahue, Firestorm Expert Council member

Communicable illness

HEADLINE: Scientists say pandemic is certain

SUMMARY: While no one can predict the timing, some experts consider a pandemic as no longer an issue of "if," but "when." While the government is taking steps to prepare, such as increasing the production rate of antivirals, there is concern that citizens won’t begin to prepare until a pandemic arrives and it’s too late. Many scientists believe that a version of H5N1, or the avian flu, will be the cause.

STORY LINK: http://www.disasternews.net/news/article.php?articleid=3856

ANALYSIS: If your house catches fire, you need the fire department to respond now, not in four years. That’s how long it is estimated to take before an avian flu drug is brought to market. Disaster Denial is real. The public does not understand the history of pandemics or the potential of a communicable illness to flash into a worldwide health crisis. The public has a false sense of security in modern medicine and the ability of drug manufacturers to develop, test, and provide a “cure.” We are not prepared for a pandemic today.

-- Jim Satterfield, Firestorm President/COO

Data security

HEADLINE: Every Student's Guide to Beating Identity Theft

SUMMARY: College students have become a prime target of identity thieves. According to the Identity Theft Resource Center, one out of every five data breaches occurs at a college or university. Despite lax security standards among higher education institutions, students can take steps to protect themselves.

STORY LINK: http://www.mainstreet.com/article/career/students/gen-y/every-students-guide-beating-identity-theft?page=1

ANALYSIS: At some point in their lives most people are exposed to the old adage that if you don't like the answer you should have not asked the question.  That recommendation applies to the focus of this article as it touches upon IT security within the university environment.  One question I would never want to ask a university is: "How robust and bullet-proof is your network security?"  About 85 percent of the time the response would surprise and alarm most folks.

Typically, the security of a university’s internal network and the servers on it leaves something to be desired, especially when compared to the levels of security normally found in the corporate world.  Weak network security makes universities easy targets for wannabe hackers.  I say "wannabe" as most hackers will not even bother hacking a university as it is akin to "taking candy from a baby."  It's just way too easy.  The hacker mindset is: that which requires no skill, receives no recognition. But that was the old days before identity thieves.  Identity thieves are motivated by profit, where hackers were motivated by increasing their reputation. 

Today's threats are primarily from identify thieves and universities are easy targets.  While this article makes some great recommendations on what you can do as an individual to protect your non-public personal information on your PC, it never gets to the root of the real problem -- the exposed databases maintained by universities.  These databases not only contain data on the student, but also their family (student loan information, etc.).  So when network security is lacking the student is not the only victim. 

If you have a son or daughter attending college it might be worth while asking two simple questions: (1) How many university databases store non-public personal information about my family? (2) What levels of network security exist to protect those databases from identity thieves?  If you get a chance to ask these questions, I am guessing you will not like the answers, but that was my point to begin with.

-- Bill Spernow, Firestorm Expert Council member