Cs novdec 2013

raising awareness about retail theft

Your friend, the IT department

canada’s role in cybercrime

page 8

page 14

page 20

Canadian

1

November/December 2013

The publication for professional security management

2013

Salary Survey

www.canadiansecuritymag.com

What the survey results and experts say about security career paths and what you can do to change yours

PM# 40065710

CS dec 2013.indd 1

2013-11-27 2:22 PM

BEYOND SECURITY

With experience, service and commitment, Commissionaires goes beyond client expectations.

Commissionaires_CS_Aug.indd CS dec 2013.indd 2 1

At Commissionaires, security is more than guarding. We offer broader security services to complement security, including security consulting, identification services like employee background checks, non-core policing such as bylaw enforcement, and comprehensive security training programs. Since our inception in 1925, our clients have benefited from our veterans experience, skills and leadership.

For our 20,000 employees and hundreds of clients across the country, Commissionaires reaches beyond security. www.commissionaires.ca | 1 888 688 0715

2013-07-10 2013-11-2711:53 2:22AM PM

CONTENTS 3

Canadian The publication for professional security management

Columns

Volume 35 Number 6

Salary Survey 2013

13 RISK Perspective The road worth taking

The results are in. Experts advise newcomers to the profession on what to expect and how to achieve their longterm goals

Departments

By Neil Sutton

4 editor’s notebook Take it from the top

10

6 trending 9 ASIS update A decade of accomplishments 18 product focus Fire & Life Safety 19 book review Keeping up with the Quants 22 world watch Science museum discovers IP security; Danish daycare curbs vandalism

14 Your friend, the IT department

20 Canada’s role in cybercrime

Working with IT has become a reality for many This country has become an unwitting host to a physical security managers. Learn how to make the range of criminal activity conducted online most of the relationship

By Fiaaz Walji

By Vawn Himmelsbach

visit www.CanadianSecuritymag.com Security leaders will be dropping by our studio in 2013, so be sure to check out the video section of our website for new content.

L_MXPCLDAWA_D_CS_get into the cloud Banner 2/15/13 9:59 AM Page 1

get into the cloud MAXPRO® Cloud 3.0 meets the demand for video in the cloud Hosted video systems can save businesses an average of $1,500 a year versus a traditional DVR. Honeywell’s award-winning MAXPRO® Cloud allows you to store video in the cloud or locally, get instant email alerts using direct clip link to notify you if there’s an event or system problem. Plus, the new MAXPRO Cloud Dashboard lets you monitor facilities in real time—anytime, anywhere.

Get the facts with a Free MAXPRO Cloud infographic at www.maxprocloud.com

@SecurityEd • November/December 2013 Honeywell_CS_April.indd 1

11:53 AM

CS dec 2013.indd 3

2013-03-13 9:41 AM

2013-11-27 2:22 PM

Canadian

4 editor’s notebook By Neil Sutton

Take it from the top Why it’s so important for the industry to encourage the next generation of job seekers

I

’ve been involved with the Canadian Security salary survey, sponsored by Commissionaires, for six years now, designing questions, reading responses and writing summary articles based on the results.

Those articles have covered the gamut, from wages to training to the public perception of security. What I’ve learned in that time is that, for some people, there is a disconnect between what they want and how to get it. That’s why, in this issue, we chose to focus on upward mobility in security.

Some might suggest that is an oxymoron and I think it behooves this magazine and the industry “For some people, at large to take a step back and consider what that means. It’s true that entry-level jobs in this business there is a disconnect are generally not high-paying. Not to mention, there between what they is constant pressure created through competitive forces, the RFP process and an economy that has want and how to not truly rebounded to keep those wages low. That’s not something that’s likely to change overnight. get it.”

Salary raises, in many industries, are shrinking and people are expected to do more with less.

Within the salary survey, there are always telling comments from respondents. Perennially, there are those who would brand security as “dead-end” but equally there are people who recognize that security is what you make of it. Those are the people we’re appealing to by choosing to focus on career path.

A great many of the security leaders I have met in the course of editing this magazine started off on the front-line. I’m constantly fascinated by what drove them to move up the ranks and into management. I can tell you that they’re involved in the community. They seek volunteer roles, attend ASIS meetings, go to conferences and absorb information like sponges.

I had the privilege to hear Tony Weeks speak at our recent Focus On Health Care Security event. During his session, appropriately titled “Leader Mindset: My Strategy for Reaching the Top (and staying there),” Weeks detailed his rise from front-line security officer to his current position as CEO of Brockville General Hospital, in Brockville, Ont. In the course of his career, he crisscrossed the country in the pursuit of more experience and senior management opportunities. He even kept track of the number of resumes he sent out and the positive responses they garnered.

I’m not saying that it’s necessarily going to take that level of focus to achieve success. Let’s face it, few have that kind of drive. But there is some truth to the idea that most people don’t know what they’re capable of until they try.

It’s also fitting that we’re finishing up this issue a week before our first Security Career Expo in Toronto. We’re expecting a large turnout from students and people just entering the security profession and we have a team of experts on hand who can dispense important career advice. To the newcomers, I say, almost one in five respondents to our salary survey said they make more than $100,000 a year. There’s no reason you can’t be one of them one day.

The publication for professional security management

Group Publisher Paul Grossinger pgrossinger@annexweb.com

Account Coordinator Trish Ramsay tramsay@annexweb.com

Publisher Peter Young pyoung@annexweb.com

Circulation Nicole Cuerrier ncuerrier@annexweb.com

Editor Neil Sutton nsutton@annexweb.com

President Mike Fredericks mfredericks@annexweb.com

Art Director Graham Jeffrey gjeffrey@annexweb.com

Editorial and Sales Office 222 Edward Street, Aurora, Ontario L4G 1W6 (905) 727-0077 • Fax (905) 727-0017 Web Site: www.canadiansecuritymag.com Canadian Security is the key publication for professional security management in Canada, providing balanced editorial on issues relevant to end users across all industry sectors. Editorial content may, at times, be viewed as controversial but at all times serves to inform and educate readers on topics relevant to their individual and collective growth and interests.

Canadian Security is published six times per year by Annex Publishing & Printing Inc. Subscriber Services: Nicole Cuerrier Ncuerrier@annexweb.com P.O. Box 530, Simcoe ON N3Y 4N5 Tel: 866-790-6070 ext (208) Fax: 877-624-1940 I.S.S.N. 0709-3403 Printed in Canada Canada Post: Customer #6597297, Agreement #40065710.

RETURN UNDELIVERABLE CANADIAN ADDRESS TO CIRCULATION DEPARTMENT P.O. Box 530, Simcoe ON N3Y 4N5 Subscription Rates: Canada: 1 year $40.00 + HST; U.S.A. (payable in US dollars): 1 year $60.00; International (payable in US dollars): 1 year $75.00 The contents of Canadian Security are copyright by ©2013 Annex Publishing & Printing Inc. and may not be reproduced in whole or part without written consent.

For information on reprints of any article that appear in this publication, contact The Reprint Outsource at 1-877-394-7350.

Annex Publishing & Printing Inc. disclaims any warranty as to the accuracy, completeness or currency of the contents of this publication and disclaims all liability in respect of the results of any action taken or not taken in reliance upon information in this publication.

We acknowledge the financial support of the Government of Canada through the Canada Periodical Fund of the Department of Canadian Heritage.

Editorial Advisory Board Jason Caissie Profile Group

Tracy Ann Kosa Microsoft

Carol Osler TD Bank

Ken Close Trillium Health Partners

Bill McQuade Final Image

Theresa Rowsell Target

Ashley Cooper Paladin Security

Clark Northcott Pelco by Schneider Electric

Tim Saunders G4S

David Hyde Hyde & Assoc.

Malcolm Smeaton Whitehorse Group

@SecurityEd November/December 2013 • www.canadiansecuritymag.com

axis_ad_ CS dec 2013.indd 4

2013-11-27 2:22 PM

Axis_CS_

m

m

.com

Make sure the bad doesn’t happen so the good can. Anywhere. Anytime.

When you’re responsible for the safety, security and everyday function of a big city, you have your hands full making sure the bad doesn’t happen so the good can. At Axis, our deep experience in city surveillance gives us invaluable insight into the complexity of what you’re facing every minute of every day.

That’s why you can rely on Axis city surveillance solutions for dependable, crystal-clear HDTV video in real time anywhere you need it.

It’s easy to coordinate your whole surveillance system centrally — and even share live video. Plus, as the world leader in network video, rest assured Axis brings you a future-proof solution that’s ready for today’s smart technology as well as tomorrow’s.

Axis city surveillance solutions — securing everyday life.

Get the Axis picture. Stay one step ahead.

Visit www.axis.com/citysurveillance

HDTV quality • Excellent zooming capabilities • Rugged outdoor cameras • Vandal-resistant • Sharable live video • Future-proof

axis_ad_city-dump_cansec_fpc_en_1305.indd 1 CS dec 2013.indd 51 Axis_CS_May.indd

30/04/2013 10:34:25 AM 2013-11-27 11:27 2:22 AM PM 2013-05-07

6 trending

Border Security Expo

Security companies recognized

by BOMA

ISC West

T

Calendar March 18-19, 2014 Phoenix, Ariz. www.bordersecurityexpo.com April 1-4, 2014 Sands Expo & Convention Center Las Vegas, NV www.iscwest.com

Canadian Technical Security Conference April 8-10, 2014 Strathmere North Gower, Ont. www.ctsc-canada.com

Security Canada East

April 23, 2014 Sheraton Laval Laval, Que. www.securitycanadaexpo.com

National Women in Security Lecture Series April 24, 2014 Ottawa Conference & Event Centre Ottawa, Ont. www.cspf-forum.ca

Counter Terror Expo

April 29-30, 2014 London, U.K. www.counterterrorexpo.com

Security Canada Alberta

May 8, 2014 Deerfoot Inn & Casino Calgary, Alta. www.securitycanadaexpo.com

Port Secure

May 13-15, 2014 Ottawa Convention Centre Ottawa, Ont. www.portsecure.ca

IAHSS AGM

May 18-21, 2014 La Jolla Hyatt San Diego, Calif. www.iahss.org

Security Canada Ottawa

June 4, 2014 Ottawa Conference and Event Centre Ottawa, Ont. www.securitycanadaexpo.com

wo Canadian security companies were the recipients of BOMA National Pinnacle awards this year: GardaWorld for “above and beyond” service and Paladin Security for customer service.

The awards were presented at BOMEX 2013, the national conference for the commercial real estate industry, in Halifax in October.

BOMA Canada’s Pinnacle Awards are awarded each year to “recognize and promote service excellence in the Glenn Thomson commercial real estate industry. It is about providing a service to a customer that was unexpected, extraordinary, unnecessary, surprising, caring and perhaps even entertaining and outrageous,” according to the organization.

This year, two out of the three winners were security companies.

GardaWorld received the award based on its work in Calgary during the terrible flooding that occurred there in June. The company supported customer Oxford Properties, which sustained damage to the parking lots of five of its buildings as a result of the floods. At the time, the downtown Calgary core had been evacuated and police were turning away traffic. Garda management obtained “essential services” status from the Calgary Emergency Management Agency, allowing its guards to access otherwise restricted areas. Several of the guards actually slept on site at the end of their shifts to allow them to return to work the next day.

Overall, it was “a very difficult situation that was handled really well. A lot of these guys were going into work every day and helping to protect a building when they knew their homes were being flooded,” says

Glenn Thomson, Garda vice-president, protective services - Central & Atlantic Canada.

In order to be eligible to win a national award, entrants first have to first win a regional BOMA competition.

Vancouver-based Paladin was the recipient of BOMA Canada’s customer service award first in B.C., then at the national competition. The company’s Edmonton branch also won an award, as well as a consumer choice award for the sixth consecutive year.

“We’ve been an active member of BOMA for quite a few years. We have a lot of clients that are members and we like to participate in that community,” says Chad Kalyk, Paladin’s director of operations in B.C. “It was pretty neat to be recognized,” he says. “That’s what it comes down to — the security officers being recognized for the hard work that they’re doing.”

Both Paladin and GardaWorld note that an award that comes from outside the security world brings with it another level of acknowledgement.

“When you get recognized by an Chad Kalyk external market . . . it gives you a message and says you really are on the right track,” says Kalyk.

“Security was always a confidential thing and always kept quiet,” adds GardaWorld’s Thomson. “We’re trying to change that whole image. Getting awards and doing things to elevate the brand” helps accomplish that, he says. “I’m looking for something to help differentiate our company.”

The third Pinnacle award, which recognizes innovation went to design and engineering firm Stantec for its work on the St. John’s, Nfld., Metrobus headquarters.

— Neil Sutton

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 6

2013-11-27 2:22 PM

G4S_C

Canada’s leading provider of security solutions

G4S offers a unique combination of risk assessments, security personnel, and security technology

1-888-717-4447 solutions@ca.g4s.com www.g4s.ca

CS G4S_CS_Nov.indd dec 2013.indd 7 1

• Guarding services

• Access control

• Mobile patrol

• Intrusion detection

• Screening services

• Video surveillance

With 10,000 employees and offices from coast to coast, let us help you see the opportunities that exist in the challenge of securing your world.

2013-11-27 2013-11-18 2:22 9:18PM AM

8 trending

Fighting back on retail crime

T

oronto Crime Stoppers has launched a campaign to raise consumer awareness on Canada’s $4 billion retail crime problem.

The campaign, which includes flyers, posters in stores and radio commercials, emphasizes the degree to which the cost of retail crime is passed on to consumers in the form of higher prices for goods. The awareness campaign began in November at a launch attended by Sean Sportun, loss prevention manager for Mac’s Convenience Stores and vice-chairman of Toronto Crime Stoppers, as well as Toronto Police Chief Bill Blair and the Retail Council of Canada.

Chief Blair stressed the importance of the consumer’s role in combatting retail theft. He cautioned that consumers who knowingly purchase stolen goods could face consequences such as a criminal record. “If you think you’re getting a bargain, you could be getting a lot more than you bargained for,” he said.

Sportun, who was recently named Canadian Security’s Security Director of the Year, said that the awareness campaign also lets the would-be criminal know that the community is taking action. The campaign is being supported by retailers including Mac’s, Loblaw Companies, TJX Canada and Sobeys. More information is available at www.itcostsusall.com.

Marston promoted at Diebold

D

an Marston has been promoted to director, electronic security at Diebold Canada.

Marston has been with Diebold for seven years and was formerly the national sales manager. In his new role he will oversee all aspects, including sales, finance and delivery of operations. Marston has more than 28 years’ experience in the security industry. He has directed numerous security firms, including a $45-million industry leader with more than 3,000 employees. He also ran his own successful fullservice security business with more than 130 employees.

Visiting hours

C

anadian Security magazine’s second annual Focus On Health Security summit, held Oct. 30, was attended by more than 90 health-care security professionals. Both a networking and a learning opportunity, the event provided seminars on current trends, the leader mindset, staff safety and health-care consolidation. Event sponsors Axis Communications, Paladin Security, ASSA ABLOY, Ingersoll Rand and Bosch Security Systems provided case study examples demonstrating security technologies in action.

IAHSS president Lisa Pryse opened the event with a round-up of current trends

John Day of Contact North/Bosch discussed personal security transmitter solutions for health-care

Tony Weeks literally told the story of his life, detailing his rise front-line security to the CEO of Brockville General Hospital

ASSA ABLOY’s Nicole Parent focused on wireless locks

Each table of attendees led a discussion on challenges they face in health-care security

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 8

2013-11-27 2:22 PM

By Peter J. Heisz

ASIS UPDATE 9

A decade of accomplishments A

SIS Chapter 241-Southwestern Ontario began as a chapter in December 2002 with 17 members. Now approaching its 11th year, membership has grown to more than 80.

The geographic area covered by this Chapter includes Windsor, Niagara Falls and Owen Sound. The chapter is small but has strong leadership and support from sponsors. This year, the chapter has implemented a number of initiatives. A CPP (Certified Protection Professional) study group completed their study program and, to date, one person has written and passed the CPP examination.

There are 12 chapter members with ASIS

designations of CPP or PSP (Physical Security Professional) and one member with multiple designations.

ASIS Professional Certification Board (PCB) awarded two awards to Southwestern Ontario members in 2013. Kevin Armstrong of Commissionaires Great Lakes received the PCB Regional Volunteer Award, which recognizes individuals who Peter J. Heisz make a significant contribution to the advancement of ASIS certifications. Kevin was the leader of the most recent CPP study group.

The PCB Organization Award of Merit was awarded to Lyndon Security Services for their commitment and dedication to the advancement of ASIS Security designations.

Recent chapter events have included a golf tournament held at Pine Knot Gold Course in Dorchester, Ont. on July 11.

A raffle was held and $600 was raised for Ronald McDonald House.

The Chapter also awards at least one $500 bursary each year to a student in their final year of a security-related discipline.

The chapter committee reviews submissions and awards the bursary to the student at the December meeting. The bursary also includes a complimentary ASIS student membership.

To find out more about the chapter, please visit www.asis-swontario.org/main. cfm.

Peter J. Heisz is the chair of ASIS Chapter 241.

Security Director of the Year

T

2013 Award Night

his year’s winner, Sean Sportun, manager, security and loss prevention, Mac’s Convenience Stores, provided some sage words as he accepted his award.

He reminded the assembled crowd of friends, colleagues and industry associates, to appreciate what they have in life and that security is more than just protection and risk assessment.

Sportun was recognized for the award not only for his work in loss prevention but also for helping to develop important community outreach programs.

Mike Bagg, Crime Stoppers; Zdravko Fidanov, Reliance Protectron; Chris Jaynes, Reliance Protectron; Dion Angelini, Mac’s; Sean Sportun, Mac’s; Robert Balecki, Mac’s; Inspector Dave Saunders, Toronto Police Services; Gary Grant, Crime Stoppers; PC Scott Mills, Toronto Police Services

CS dec 2013.indd 9

Mike Bagg and Gary Grant, Crime Stoppers

Gary Mistak, Anixter Canada; Peter Young, Canadian Security magazine; Sean Sportun, Mac’s; Jeff Hofstetter, Anixter Canada

JD Killeen, G4S; Minaz Jivraj, Dufferin Peel Catholic District School Board; Martin Green, GardaWorld @SecurityEd • November/December 2013

2013-11-27 2:22 PM

10 Salary survey

2013 Salary Survey:

Onward and upward How to get ahead of the game was common theme this year, with respondents concerned about career path, raises and whether security is sometimes just a “stepping stone” to something else.

P

articipants in the 2013 Canadian Security Salary Survey, sponsored by Commissionaires, as well as industry experts interviewed after the fact, all appear to agree that front-line positions are best viewed as a stepping stone to a more lucrative career in security or possibly as a means to explore related fields.

That said, opinions differ as to how to accomplish those long-term goals and vary depending on life stage, expectations coming into the field and perceptions about variables such as security associations, accreditation and training opportunities.

There were a total of 456 participants in the 2013 survey, which was conducted by Canadian Security in October. The most common job titles reported were: security guard (22.5 per cent), security manager (22.3 per cent) and security director (12.6 per cent). The remainder included consultant (6.4 per cent), site supervisor (9.7 per cent) and president (6.2 per cent), among many others.

More than half of respondents (57.9 per cent) said they work in Ontario.

A distant second was Alberta (11.8 per cent) closely followed by British Columbia (10.9 per cent).

In terms of workplace satisfaction, 46.1 per cent said that their place of work is “average” or “needs improvement,” whereas 53.9 per cent described it as “very good” or

“excellent.” Those numbers are on par with the 2012 survey results with 56.6 of respondents describing their workplace positively.

The numbers are also remarkably similar this year in terms of response to the question: “Would you recommend security as a career to a friend?” In 2013, 76.3 per cent said yes compared to 76.5 per cent last year.

As one might expect, the answer to that question changes depending on the income status of the person taking the survey — though not drastically.

For respondents who reported income levels of $40,000 to $60,000, 77.4 per cent said they would recommend security. There is only a slight increase (78.5 per cent) for respondents who reported making $60,000 to $80,000.

The numbers begin to change more noticeably at the high and low ends of the spectrum. However, at all levels, more respondents said they would recommend security as a career than not. For people making less than $30,000 annually, 54.5 per cent reported in the affirmative; for those making six figures, it’s 87.1 per cent.

The picture changes slightly when broken down by title and there is noticeable variance based on job level.

Posed the same question, “Would you recommend security as a career to a friend?”, 65.3 per cent of security guards said yes compared to 76.3 per cent of security managers and 89.5 per cent of security directors.

When asked to elaborate on the question, survey respondents qualified

What is your income? $150+

5.1% $100-150K

Less than $20K

5.9%

13.8%

$20-40K $80-100K

18.4%

$60-80K

18%

22.4% $40-60K

16.4%

Source: Canadian Security Salary Survey 2013

By Neil Sutton

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 10

2013-11-27 2:22 PM

Salary survey 11

your current employer? than 6 months

3.5%

34.9%

6-12 months

6.6%

Source: Canadian Security Salary Survey 2013

their answers with a variety of comments.

Some said they would recommend How long have you been with security “only as a stepping stone” or Less “only as a second career” whereas others noted that security “is a growing industry” and “can be a great career with More than 10 years advancement potential.” One respondent said, “it takes time but you can keep moving up.” Another said, “you need to make it a career [and] see it beyond just a job.” One of the most telling responses was, “like any career path, you get what you put into it.”

For John Dewar, CEO of 6-10 years Commissionaires’ Victoria, B.C., and chairman of Commissionaires’ national business committee, there can be a degree of delayed satisfaction when it comes to security, at least monetarily.

“I don’t think people are looking at mobility is continuous improvement and being a standard security guard as the job a dedication to education and training, they want to hold for a lifetime, but there says Tabesh. are a lot of advantages to it as a first As such, Condor emphasizes job,” he says. education for its employees, off-setting For example, there may not be a lot some of the cost of training opportunities of glamour or financial compensation and tying raises to passing some attached to patrolling parking lots, but programs successfully. It’s so important it is a necessary function and one that to Tabesh that he can impart important says Condor is “more life skills. “You’re of a training entity dealing with the public “One’s degree of than we are a security and you’re in a form a satisfaction with the job company.” bylaw enforcement,” Among the says Dewar. “We’ve they have depends on courses offered are had a number of people handcuff and baton who have started there what they’re looking to training, a tactical and moved on to other awareness course things.” receive from the job.” that was designed in One — John Dewar, Commissionaires conjunction with a Commissionaire started police officer and a in a parking detail, “Verbal Judo” system and eventually left to that encourages become a police officer, event de-escalation through words and he says. She then became a lawyer and conversation. ultimately a judge.

More than half of survey respondents Benjamin Tabesh, president of (55.7 per cent) said that “lack of Toronto-based Condor Security, shares training” was their most immediate similar stories of guards and concierges occupational safety concern. When who made good, moving on to careers asked to rate their training opportunities, in border services, police work, the 63.4 per cent said they are “average” or legal profession and property managers. “need improvement.” However, the vast Condor employs anywhere from 150 majority (86.7 per cent) said “yes” when to 200 — the number fluctuates as asked, “Are you adequately trained for people come and go. The key to career

1-5 years

31.4%

23.7%

your current responsibilities?”

Only 38.5 per cent of respondents said they currently have a security designation, which is on par with the response to the same question in the 2012 survey (38.8 per cent). Of those that reported some form of accreditation, the most common response (27.1 per cent) was Certified Protection Professional (CPP), which is issued by ASIS International. CPP was also the most common response for people who said they don’t yet have accreditation but were working towards one.

Accreditation is a focal point for Tabesh, who has earned ASIS’s PSP (Physical Security Professional) and CPP. He says Condor will pay for employees’ membership in ASIS and encourages them to take at least their PSP. “We believe in practicing what you preach,” he says. “I think it’s pivotal.”

To a degree, Tom Robertson of TD Bank Group owes his security career to ASIS. He is currently associate vicepresident, governance and strategy, financial crimes and fraud management group, at TD’s corporate security department.

His skillset comes not from front line security but the front lines, so to speak.

He served in the Canadian military for 13 years, with tours in Afghanistan and Bosnia, as well as a number of domestic @SecurityEd • November/December 2013

CS dec 2013.indd 11

2013-11-27 2:22 PM

12 Salary survey

When was your last raise? last 3 months

13.6%

More than 2 years ago

18.1%

last 6 months

18.4% 1 or 2 years

16.4%

last 12 months

33.4%

in providing employment to veterans — people who are at a transitional point in their life. Robertson, a military officer, was able to translate his expertise into security management. For other veterans, guarding may represent a good use of their accumulated skills, at least in the short term. “We assist veterans in transitioning from service careers into civilian employment,” explains Dewar.

“These are folks that tend to be in midcareer range.”

It’s important for people coming into security to do so with their eyes open, adds Dewar. “I think one’s degree of satisfaction with the job they have

Do you currently have a professional security designation?

Yes No

61.5%

38.5%

Source: Canadian Security Salary Survey 2013

posts before retiring with the rank of Captain in 2007 to begin a private sector career.

His military training in counterintelligence seemed “a natural alignment” with the security industry, he says, and he reached out to the Toronto chapter of ASIS when he left the military to make connections. That eventually led to a job interview with Sun Life Financial and a position as a senior investigator.

After a three-year stint at Sun Life in a variety of roles — ultimately as a director of corporate compliance — Robertson accepted a position at TD. “I credit ASIS as being the bridge for me between my military life and my civilian life,” he says.

Robertson is now is a position to hire other security personnel in his department. He says one of the first items he looks for on a resume is a CPP “because it’s a baseline; it gives you some sort of benchmark to go from.”

Robertson holds CPP, CISSP (certified information systems security professional) and CFE (certified fraud examiner) certifications and has demonstrated careful planning in his pursuit of a security career.

He says he is aware that a person’s stage in life can play a large role in how they view or appreciate a career in security. He initially took a pay cut when he left the military and joined Sun Life knowing it was a short-term lost for a long-term payoff. It was also an opportunity to pursue a new lifestyle and afford him the chance to start a family.

Some survey respondents also noted that a person’s age and living arrangements can have a profound effect on how they view a job in security.

Respondents complained that shift-work and work-life balance issues are taking a toll on their personal lives. One noted that “this job is a single person’s job who is staying at home with parents.” Another said that security provides “good advancement for those that are young.”

Others suggested security works best as a “second career.”

Dewar of Commissionaires says that these are common observations.

He notes that his company specializes

depends on what they’re looking to receive from the job,” he says. “Any time that people go into an occupation or any other type of situation in which they’re not completely aware of what’s going to happen, you’re setting it up to be a not very happy experience for them.”

As such, when Commissionaires introduces a new employee to its organization, “we make it very clear what the job will entail.”

He reiterates that skills learned on the job can be applied to other fields. “As an entry-level security guard, you would have the opportunity to become familiar with the other types of occupations that are available.”

For someone who worked so hard to get into security, Robertson has found ways to expand beyond it. “As my career progresses, I’m moving away from traditional security,” he says,“ and more into areas that are more closely aligned with the profit centres of the bank.”

But, he adds, he greatly appreciates the “intrinsic value” that life safety brings to an organization. “Ideally, you add to the bottom line, but what you really do is help people that need help. To my mind, there’s nothing more rewarding than that.”

For more results from the Canadian Security Salary Survey 2013, please visit www.canadiansecuritymag.com.

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 12

2013-11-27 2:22 PM

By Tim McCreight

RISK Perspective 13

the road worth taking

T

An effective security executive can successfully read the corporate roadmap

he readers who have followed my column this year have been on bit of a journey with me.

We have looked at a new way to add value to an organization from the security team — identifying risks facing our business units and working through the lifecycle of risk management with business leaders as partners, not adversaries.

Is it worth it? I personally think it is — and I’m not alone. From international standards through to practitioners writing for this magazine, we are learning more about this new path security professionals are taking within their organizations. We’re seeing successful security executives lead their departments from reactive, response-driven structures to proactive, risk-based teams.

New security executives are focusing on how they can work with business units to understand the culture of their organization, and appreciate the company’s tolerance for risk. Some are even getting a chance to deal with executives at the C-level, presenting objective risk information that can ultimately aid the organization in achieving its strategic business goals.

This isn’t the case for every company, though. Some continue to believe that risks are best left unaddressed, or the work required to identify, document and address risks isn’t worthwhile. Some executives disapprove of the time and effort required to identify and document risks, determined to relegate the security team to their more traditional, operational tasks.

Many executives continue to cling to the notion that bad news doesn’t need to move upward — no good can possibly come of advising your senior executive about something that could maybe/ possibly/potentially go wrong. That sort of information doesn’t serve any purpose.

They will suggest that perhaps you can discuss that report in a more operationally focused meeting.

That’s truly unfortunate, not only for the security professional struggling to adapt to ever-changing threat vectors, but also to the companies themselves.

The death sentence for any program started by a security professional to identify and document risks is the ever-feared tactic of placation. Dutiful security executives conduct risk assessments, document their findings, work with project teams to vet their results and then valiantly attempt to present their objective and research-based findings to senior management. And in that meeting, crickets can be heard.

We have heard from many other writers the concept of executive support and “buy in.” That support is critical for your successful journey towards becoming a more risk-based, business-focused security team.

Without this ongoing executive commitment, any progress you make is at the whim of your executive, leaving you stranded without any assistance. It can be a very lonely, unsatisfying walk back to the start of the path, taking an incredible amount of effort, time, and good will as well.

I’m not saying this journey isn’t full of potential obstacles, roadblocks and misconceptions from non-security professionals. It is a worthwhile adventure but I want to leave you with some hardearned advice.

I appreciate our role in many organizations is changing. We have traditionally held a position akin to the gatekeepers of old — none shall pass, unless we allow them to. That mindset and role have changed, and security professionals who see the value of what they can bring to an organization realize managing the risk lifecycle is an important contribution to any organization.

Find executive advocates and supporters for your move to risk-based, business-focused security and keep them apprised of your progress. Just make sure you also get their written approvals along the way.

Trust me.

Tim McCreight is a managing consultant at Seccuris (www.seccuris.com). @SecurityEd • November/December 2013

CS dec 2013.indd 13

2013-11-27 2:22 PM

14 SECURITY MANAGEMENT

Your friend,

the IT department Physical security managers have, by necessity, developed a closer working relationship with their IT counterparts. Managing that relationship is more than just a networking skill

By Vawn Himmelsbach

O

nly a few years ago, the physical security team operated in relative isolation — if not complete isolation — from the information technology team. Their paths rarely crossed.

But the changing nature of security — including the evolution of standalone, analogue equipment to IP-based security systems — means that physical security managers are required to incorporate some tech savvy into their jobs. And that means working with their IT department.

In the past, the two departments worked in silos because they could, says

Brian McIlravey, co-CEO of Edmontonbased PPM 2000. Even five years ago, the security department could run its own systems without any reliance on the IT department.

“These days, you can’t,” he says.

“Everything is connected, everything is on networks, everything is about data.”

Whether they like it or not, physical security managers are entrenched in IT. “We sell to physical security managers, but it’s a computer system so it has to go on the IT side,” says McIlravey, who also holds ASIS International’s Certified Protection Professional (CPP) designation and sits on the organization’s IT security council.

Over the past few years, he’s seen the

battles that occur between security and IT — but also the successes. The key?

Security has to work with IT, but in turn IT has to be able to work with security.

When it comes to infrastructure and installation, the physical security department has to lean on IT. But, in turn, the physical security department has to own the system from a functional standpoint. “This is where IT has to work with physical security to get an understanding,” says McIlravey.

Problems can occur if the IT department only cares about the infrastructure and installation — without an understanding of what the physical security department needs the technology to do.

Often, there’s a disconnect between the two. “We in security have to take most of the share of the responsibility for that disconnect,” says Jeff Hannah, director of safety and security services at Conestoga College Institute of Technology and Advanced Learning in Kitchener, Ont. “We have to change with the times,” he says. “What security managers need is to be able to hold their own in multidisciplinary meetings and represent their interests.” But, he adds, “we don’t need to be networking experts.”

CCTV systems, in particular, eat up a lot of networking resources. That means physical security managers need to understand how bandwidth, topography and design affects networks — and how it can support the security systems that need to be on it.

“It’s not fair to leave IT responsible for figuring out how many resources we

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 14

2013-11-27 2:22 PM

15 from security, IT and project management need to be effective,” says Hannah. sitting around the table.

ASIS International’s Physical Security “Right in the middle is an independent Professional (PSP) designation, he project manager — that’s the person who’s says, provides functional knowledge of going to make sure they work together.” networks, including a peek into network In some cases, systems integrators can act topography. But, depending on the as an independent third party, helping to organization and its needs, this may not bridge the interests. be enough.

While the two departments may be “In terms of traditional education, working on the same project, they’re I can’t think of any resources that are usually approaching it from different specific to that,” says Hannah. “You have perspectives. to piece it together.”

Anything that goes There are, on the network will however, numerous “Everything is draw the attention of resources available the IT department, says to physical security connected, everything is Paul Everett, senior managers, whether R&A manager at IHS, they want to learn on networks, everything a research firm based in more about network Austin, Tex. design or Cloudis about data.”

Oftentimes, the based solutions. This — Brian McIlravey, PPM 2000 security manager wants includes seminars, to lock everything down webinars and while the IT manager conferences from is concerned about security associations, whether the system will slow down the technology associations, various councils network or impact access to data points. and independent vendors.

“They need to find some kind of Even LinkedIn groups can be a medium in the middle that can make valuable resource, says McIlravey, such as things work,” he says. “There’s a TechSec, the Security Executive Council balancing act (where) you need different and the Canadian Advanced Technology people with different backgrounds Alliance. involved in the conversation.”

Ultimately, says Hannah, gaining And that can have an impact on that knowledge comes from working which products are chosen. Indeed, recent with the people who deal with networks research from IHS found that factors such day in, day out — the IT department. as training, IT skills and bandwidth were And meetings, in particular, can be good impacting or limiting the use of IP-based learning exercises.

“We have to ... come to those meetings products.

In many cases the physical security prepared, having done our homework manager buys a security system and then with the ability to have a competent tells the IT department to make it work discussion to move through the design or — or gives the IT department a wish list upgrade process,” says Hannah. and lets them do all the work finding a “It can be a big disconnect and be a solution. But physical security managers big deal if the security department can’t should try to understand their needs be as effective as they ought to be because and options before approaching the IT they failed to identify the tools they department. needed.”

The best solution for their needs When that disconnect is there, the might cost more in the short-term — IT department will do its best to find so make sure you can justify the cost the right solution, but it’s much easier to (and extra work) to the IT department, get the job done properly when security says Edward Swetleshnoff, president of comes to the table prepared.

Vancouver-based SCSI, which performs These days, when going to client security consulting and compliance work. meetings, McIlravey often sees members

“If you’re a physical security manager, you have the right to buy the best product,” he says. But, he adds, you should be willing to back down if provided with better information; the IT manager’s opinion is also valuable.

That’s why it’s important for the two departments to work together, he adds. The physical security manager might not understand all the intricacies of the network; on the other hand, the IT manager may be able to connect a camera to the network but not explain why it’s there and what it does. Or IT installs a system in the field that doesn’t work when a security guard goes to use it — because they don’t understand the use-case.

“IT has to understand what physical security is trying to do with the system and help them with the infrastructure,” says McIlravey. Do they need a server?

Should they go to the Cloud? Should they consider shared services? This is where IT can help — but sometimes the physical security department doesn’t push IT hard enough to get what they want. A project manager or even a systems integrator can be beneficial in that regard. But the relationship with IT doesn’t have to be a difficult relationship.

“The IT people will have concerns, but they’re more an ally than a foe,” says Swetleshnoff.

Hannah has a good relationship with his IT department; he explains physical security to them, and they explain IT protocol to him. There’s a mutual sharing of knowledge that takes place.

“I have a fantastic IT director,” he says. “We talk our way through things.

It’s easy to be frustrated by somebody who needs something from you but they haven’t put the work into understanding what they need, and there are people in security who are guilty of it, but also people in IT guilty of the same thing …

We have to represent our disciplines.”

The two departments can educate each other, he adds. “There’s no shame in letting the person who does that all day, every day, explain it to you.”

Vawn Himmelsbach is a freelance writer based in Toronto. @SecurityEd • November/December 2013

CS dec 2013.indd 15

2013-11-27 2:22 PM

The 2013 Innovation Zone line up The Canadian Security Association (CANASA) partnered with Canadian Security magazine to produce the Innovation Zone — a showcase of new and innovative security products which were featured at Security Canada Central in Mississauga, Ont., Oct. 23-24, 2013.

NNOVATION

ZONE

INNOVATION

ZONE

Brought to you by:

Canadian The publication for professional security management

Access Control Management Software With a completely redesigned user interface Aurora delivers a new experience that entrenches Keyscan’s commitment to innovation and forward-thinking. Aurora unleashes the expanded power and capability of Keyscan’s new line of access control units. Together, it offers native support for 45,000 credentials (with impressive expansion to 90,000); 10 assigned groups to a single cardholder; multiple credentials assignable to a single user; unlimited user-definable optional fields, an all new communication structure and impressive panel-to-panel global communication. Aurora will support any small or mid-size access control installation while also exceeding the demands of large-scale access control deployments. Contact us for more information or a demo. Toll Free (Canada/USA): 1-888-KEYSCAN (539-7226).

www.keyscan.ca

Integrated Property Management Solutions TX3 Community portal is a web-based property management tool for property developers, managers, and end users.

Part of Mircom’s TX3 Unified Solution, TX3 Community portal works seamlessly to create a customized building environment that enhances the occupant experience and allows property managers to do what they do best.

The TX3 Community platform features: Occupant details database including parking stall assignment, emergency contact information, access card permissions and ID numbers, and requests for trade services; Building communications tool including bulletins and notices for fire alarm testing and community news; Issue awareness and promotion; and Community Watch with a selection of cameras to view common areas.

www.mircomgroup.com

Flush Mount Keypads With selectable stand alone and Wiegand output and an optional plug-in Lazerpoint RF™ 2-channel wireless transmitter, Camden Door Controls’ CM-120 Series take keypad performance to a whole new level. ‘Camden Tough’ flush mount CM-120 series keypads includes CM-120i, indoor model, and the CM-120wV2 outdoor model, featuring a vandal resistant, back lit, metal keypad. All models feature 999 users, fixed or variable 1 – 8 digit code lengths (with up to 10 million possible code combinations), (2) 3 Amp. Form ‘C’ relays, 1 - 255 second time delay, request to exit (REX) input, door contact input, anti-tailgating, latch mode and global lock out.

www.camdencontrols.com

Home Connect™ Technology Kwikset, the leader in residential security, introduces the NEW SmartCode™ 914 deadbolt with Home Connect™ Technology! This deadbolt is a new addition to the SmartCode family, and is the most robust SmartCode lock ever made. The metal housing delivers quality that can be felt for added security and durability. Expanding your security system solution with Home Connect Technology, a Kwikset SmartCode keyless entry lock will talk wirelessly to security and home automation systems via Z-Wave to enhance your customer’s lifestyle.

www.kwikset.com

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 16

2013-11-27 2:22 PM

IP Solution Digital Watchdog’s complete IP solution is a compilation of the state-of-the-art Blackjack™ network video recorders, industry-leading 2.1 and 5 megapixel IP cameras from the MEGApix™ series and the one of a kind DW Spectrum™ IP and analog video management software. DW’s Complete IP Solution shatters the boundaries of conventional surveillance with limitless scalablity, unmatched bandwidth savings and superior image quality.

www.digital-watchdog.com

Network Video Optimized for IP surveillance, D-Link WebSmart, EasySmart and SmartPro Switches are now equipped with Auto Surveillance VLAN, which lets you quickly, easily, and automatically create a reliable hybrid network that can handle both data and surveillance traffic. Auto Surveillance VLAN automatically creates a separate VLAN for surveillance traffic and sets QoS for that traffic to high-priority. This allows surveillance traffic to be secure, and ensures that surveillance video continues to stream smoothly and reliably, even during periods of heavy data traffic. Doing this normally requires you to manually add and configure each device to your network. Auto Surveillance VLAN makes this process automatic and configuration-free.

www.dlink.ca

Sarix Professional Range Within the Sarix Professional Range, the Sarix IBP Series bullet cameras feature an autofocus remote zoom lens for wide angle or long range surveillance needs. Additionally, the Sarix IBP Series features advanced colour science, a mechanical IR cut filter, and advanced integrated adaptive IR illumination for increased sensitivity in low-light installations. All Sarix Professional cameras integrate with major third-party video management systems through the Pelco API, and other third-party software and systems through the open ONVIF Profile S standard, and they work seamlessly with Pelco video management systems. Features: Up to 5 Megapixel (MPx) Resolution; Up to 30 Images per Second (ips) at 1080p; Autofocus Motorized Remote Zoom Lens; Integrated Adaptive IR Illumination.

www.pelco.com

SECURITRON ICPT Securitron uses its expertise in electro-magnetic solutions to deliver power in a whole new way. The PowerJump uses inductive coupling to send energy wirelessly across the door gap to power electrified locks and latches.

Retrofitting electrified locks into existing openings just became easier – no core drilling the door. The PowerJump protects your power pathway by making it invisible, eliminating wires across the gap that are vulnerable to vandalism or breakage.

www.assaabloy.ca

Wall Mount Rack The Hammond Wall Mount Rack (HWMR) series was designed to easily mount network equipment in IT environments with limited floor space. Unlike similar racks, Hammond has integrated both depth adjustment and pivoting swing out capabilities in one quality open rack system. Available in 12U, 20U, 24U and 32U rack unit options the HWMR easily adjusts from 18 to 24 inches in depth to accommodate a wide range of equipment sizes.

Canadian made, the HWMR is constructed of 12 and 16 gauge steel and has been tested to nearly double the suggested load rating of 220 pounds.

www.hammondmfg.com @SecurityEd • November/December 2013

CS dec 2013.indd 17

2013-11-27 2:22 PM

18 product focus

Fire & Life Safety Wireless exit stopper

Aspirating smoke detector

STI The Wireless Exit Stopper with four-channel voice receiver (STI-V6400WIR4) helps solve problems of unauthorized exits and entries of fire or emergency doors. If the protected door is opened, the Exit Stopper emits an ear-piercing alarm (95 or 105 dB) for 30 seconds, three minutes or continuously and transmits a signal to the four-channel voice receiver. www.sti-usa.com

NOTIFIER The XAS detector provides a flexible solution to meet the challenges of protecting hard-to-reach areas, or areas where the smoke detector must be mounted outside of the protected area. Its use of aspiration technology makes it suitable for correctional facilities, elevator shafts and HVAC ducts. As part of NOTIFIER’s ONYX Advanced Detection line, the XAS detector responds rapidly to incipient fire signatures while reducing the occurrence of nuisance alarms. www.notifier.com

Mobile alert application Elpas The Eiris Go mobile application, for both Android and Apple smartphones, is designed for use with Elpas’ Eiris RTLS Management Software. Eiris Go brings Eiris real-time location alert monitoring and management to first responders. Emergency field personnel can receive immediate, up-to-date indoor location positioning data about the location of a security situation as the incident unfolds. The application includes voice-based emergency calling and has a speed dial feature so that the responder can place a voice call into the location of the incident. www.elpas.com

Paging module Talkaphone The VOIP-500 Series Phone / WEBS Paging Module includes new self-diagnostic and reporting features. With the latest release of the VOIP-500 firmware, these devices can now perform a number of self-diagnostics on a scheduled basis: check the status of the built-in button(s); check the status of the built-in microphone and built-in speaker; check the status of the WEBS speaker array; and report via an email, a phone call, or an activation of the Auxiliary Output interface. www.talkaphone.com

Stand out from the crowd!

Represent security industry excellence, knowledge and integrity by becoming a Canadian Accredited Security Contractor company today!

canasa.org • 1 (800) 538-9919 November/December 2013 • www.canadiansecuritymag.com Canasa_CS_Nov.indd 1

CS dec 2013.indd 18

2013-11-18 9:20 AM

2013-11-27 2:22 PM

By Derek Knights

Book review 19

In a quandary? Consider quants Keeping Up with the Quants: Your Guide to Understanding and Using Analytics

By Thomas H. Davenport and Jinho Kim Harvard Business Press Books ISBN - 10: 142218725X ISBN - 13: 9781422187258

I

first learned of the term “quant” when I read Harry Markopolos’ book about tracking Bernie Madoff.

But now I finally understand it, after reading “Keeping Up with the Quants,” by Thomas H. Davenport and Jinho Kim. The authors explain the steps of “quantitative analysis” in seven plainly written chapters. They start with the statement, “We live in a world awash in data,” and then tell us how to make that data work. And they do it in a university-math book that elementary-school-arithmetic people (like me) can comprehend.

Quantitative analysis is nothing new. The authors tell how Crimean War nurse Florence Nightingale used data and statistics to show soldier’s deaths were due to disease or infection rather than the war wounds that sent them to hospital in the first place. Another military example is how WWII fighter-plane crashes increased after engine overhauls.

Analysis indicated the likelihood of untightened bolts or missing parts rose the more times engines were taken apart.

Thus fewer overhauls counter-intuitively became fewer crashes.

But back then, we had limited information — now we’re awash in data. Computers have entered the picture, allowing us to analyze millions of records instead of dozens or hundreds. Usually this is in a business or marketing sense.

Did you know that revenue increases at seafood restaurants with moderate renovations at a greater rate than those with extensive renovations?

But there are sociological and criminological implications too. Fraud investigators are familiar with Benford’s Law, which deals with the mathematical probability of the first digit in a number. The “law” was discovered through 19th century astronomical studies. Quants use it today to examine financial statement and transactional data to detect fraud.

The writers explain how to frame a problem, what data to review, how to formulate and test hypotheses, and ultimately how to present findings and conclusions. And here’s where

there’s an ancillary value to this book: it’s actually also a special lesson on clarity and presentation. The authors discuss this in the chapter, “Communicating and Acting on the Results.” Florence Nightingale, for example, successfully used pie charts to explain the relationship between wounds and infection, long before PowerPoint.

The authors provide a number of more contemporary case studies, including ones on credit scores and shopping habits.

It shouldn’t take too much imagination to see that this same consideration could lead to predicting fraud, or shoplifting and pilferage.

Security professionals can gather lots of data from patrol logs and incident reports. There’s much that we can do with it once properly processed and analyzed. It’s likely many of us aren’t doing that. This book will help you understand concept, and might just put you one step ahead of the competition.

Derek Knights, CPP, CISSP, CFE CIPP/C, PCI, is the senior manager, strategic initiatives, global security and investigations, at the TD Bank Group (www.tdbank.com).

BRC Members Deliver Accurate, Verifiable Inspection Results For all your Fire and Life Safety inspection requirements be sure to request Building Reports Canada’s innovative web-based system and be confident that the inspections, testing and maintenance you contracted are being performed to industry standards.

BRC provides third party validated device inspection that is fully documented in accordance with regulatory requirements. Reports are accessible online 24/7.

www.BuildingReports.ca @SecurityEd • November/December 2013

BuidlingReport_CS_Nov.indd 1

CS dec 2013.indd 19

2013-11-14 10:28 AM

2013-11-27 2:22 PM

20

Focus on IT & network security

Canada’s role

in cybercrime Criminals are taking advantage of the polite and peaceful Canuck image to facilitate attacks

By Fiaaz Walji

W

hat does being a country manager for an IT security company mean?

Well, for one thing it means understanding the specific IT risks and trends prevalent in your region. To help me and the broader Canadian security industry better understand and protect against cybercrime, our researchers have been tracking Canadian cybercrime activities and trends. Even with Canada’s glowing reputation in the eyes of the rest of the world, we found that cyber criminals are using Canada’s squeaky-clean image to facilitate cyber-attacks.

For example, did you know that foreign companies and governments are increasingly setting up virtual bases in Canada to drive corporate espionage attacks? In fact, last year Canada hosted the third largest volume of servers that communicate with highly sophisticated malware — and most of it is responsible for stealing valuable corporate data.

That is ahead of Korea, Germany, Russia and even China.

Why are cybercriminals choosing Canada to host their advanced malware command and control (C&C) servers?

Malware authors don’t want to do things that are predictable. They will have more success in their malicious plots by disguising their transfers from a “trusted” server in Canada, as opposed to Russia and China.

Malware hosted on Canadian websites is also on the rise by 25 per cent — bumping Canada into the top 10 list for global cybercrime offenders.

This could be for a number of reasons including a hosting company or internet service provider (ISP) compromise. The increase in malicious sites could also be due to large-scale compromises of Canadian sites built on vulnerable content management platforms.

Here is some good news — sort of. In the last year, we actually saw phishing decline by 67 per cent.

However, don’t get too excited.

Hackers are just looking for better watering holes. Why? Many cybercriminals are moving from a “spam everyone” approach (making pennies each click) to a much more targeted attack scenario where social engineering of the user comes into play (and millions of dollars in a potential jackpot). Exploit kits have made the higher payday attacks much more obtainable, even for the entry-level hackers, or those with novice skills.

This methodology has the potential to net a much bigger profit.

For most people, this news comes as a complete surprise and that is the problem. No one suspects Canada of harboring such digital behaviour. And cybercriminals are betting on it.

So what can we do? Here are a few things to consider: Protect outbound and inbound channels • In today’s borderless enterprise, it’s not enough to defend against realtime threats coming from outside your so-called perimeter. An effective

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 20

2013-11-27 2:22 PM

###### ####### 21 solution must stop the latest malware, while providing visibility and control of corporate information as it enters and exits an organization.

• Look for anomalies, like unusual scripts. If you don’t allow iframes and you have multiple iframes being used, something is wrong.

• Secure your internal infrastructure.

Make sure you have passwords on FTP servers, and that you are looking through your logs to see if there are any brute-force attacks occurring.

Understand what data is important to you • Understand what is important for your business, and what damage it would cause if it went missing.

Implement an effective DLP solution, so even if the bad guys get in, that doesn’t mean they can walk out with your data.

Make sure your enterprise is content secure — and aware • Blended and data-stealing attacks

are on the rise. Content security is crucial for defending against modern threats, which often bypass traditional perimeter and endpoint security.

The companies that host websites have a responsibility to monitor malicious behaviour. ISPs need to make it harder for the bad guys to take them offline.

Legislation can certainly push this along.

Legal enforcement teams need to work together and share information and resources to fight cybercrime. We can no longer look at cybercrime as a regional problem. I’m seeing businesses take this step and join various groups to share intelligence. Law organizations need to follow this example.

Despite its perception as “nice,” Canada continues to top the charts as a global cybercrime offender. By following these guidelines, we can work together to help keep Canada’s infrastructure safe.

news & notes

SMBs lacking data disposal policies The 2013 Shred-it Information Security Tracker revealed that 59 per cent of small businesses believe that if data from their company were to be lost or stolen, it would not seriously impact their business. Forty per cent indicated they do not have a protocol for storing and disposing of confidential data.

Fiaaz Walji is the Canadian country manager for Websense (www.websense.com).

Cyber Monday driving both sales and threats

cool

s

t u

f

f

Flash drive

RFID-enabled locker

Antivirus solution

Integral

Traka

AVAST

Courier Dual FIPS 197 USB 3.0 is a FIPS-certified and AES 256-bit hardware encrypted Flash Drive with SuperSpeed USB 3.0 data transfer. The product features dual passwords, PC and Mac operating system compatibility and is certified to the FIPS 197 military-level encryption standard by the National Institute of Standards and Technology. They are available in 8GB, 16GB and 32GB. www.integralmemory.com

The Intelligent Laptop Locker is designed to control and automate the process of issuing laptop tablets to students or employees and ensuring they are returned and stored securely.

The locker features 30 individual compartments, each offering data synchronization and battery charging capability. RFID tagging technology is able to track that the device has been returned correctly. www.trakausa.com

Avast! 2014 is an antivirus solution which offers a new Do Not Track function in the avast! browser plugin. This technology lets users decide which companies they will allow to track their online behaviour. avast! also provides protection with DeepScreen technology, which is able to clear away false code, misdirections, and other techniques used by malware creators. It is able to observe the binary level commands within the malware to better understand the hidden instructions embedded in it. www.avast.com

According to a new study

by RSA and the Ponemon Institute, Cyber Monday (Dec. 2) represents an average 55 per cent surge in daily online/mobile revenues for retailers. But a corresponding surge in attacks drives losses, on average, as high as US$8,000 per minute.

Mobile security not hitting home According to Juniper Research, more than 80 per cent of the enterprise and consumer-owned smartphone device base will remain unprotected through 2013, despite an increasing awareness of mobile security products.

However, almost 1.3 billion mobile devices are expected to have mobile security software installed by 2018, up from around 325 million this year. @SecurityEd • November/December 2013

CS dec 2013.indd 21

2013-11-27 2:22 PM

22 world watch Hungarian transport company updates trolleys

Science museum discovers IP security

In response to transportation modernization, Szeged Transport Co. Ltd. (SZKT), a stateowned Hungarian trolleybus operation company, has acquired numerous new trolleybuses. Through a consultation with transportation systems integrator New Line Technologies, advanced technologies and surveillance systems have been incorporated into these new trolleybuses. In this project, 110 units of VIVOTEK’s MD7560D network camera were employed. With support from VIVOTEK’s local distributor IP Cam Technologies, New Line Technologies has successfully introduced VIVOTEK’s MD7560D network camera to SZKT’s new trolleybuses for internally and externally monitoring the bus cabins.

Interactive science museum Exploratorium has chosen its video and access control technologies as part of a unified security solution for its new state-of-theart facility on San Francisco’s historic waterfront. The solution includes American Dynamics’ video management system, which provides security personnel the ability to view, search and export video from VideoEdge NVRs as well as manage the museum’s network of Illustra IP mini-domes. The video platform also unifies access control operations from the museum’s C•CURE 9000 security and event management system, ensuring that museum security officials can centrally manage security operations of its new US$220 million-dollar facility from one user interface.

JFK Airport takes off with IP

Bus company overhauls security in new facility

John F. Kennedy Airport in New York City had run on an analogue solution which was failing to meet the demands of security personnel in the facility. Most of the complaints had to do with lack of image quality for investigation, narrow field-ofview, and overall resolution of the camera. After a product evaluation, Sentry360 was selected as the vendor for a surveillance upgrade. Insight IS-IP500DN and IS-IP10K cameras were used on the exterior of the building to secure the tarmac and loading bay. The inside of Terminal One was a challenging environment. The architecture alone, consisting of large windows, high ceilings, and pillars made this deployment very challenging. By utilizing Sentry360’s FullSight 360 camera, the airport was able to gain full situational awareness.

Miller Transportation has been providing charter bus service to the Indiana and Kentucky region for more than 25 years. To leverage higher demand for chartered bus service, Miller built a $5 million state-of-the-art facility in Louisville, KY in 2013, consisting of a 26,000 square-foot bus maintenance centre and a 24,000 square-foot administrative office connected by a walkway. Miller turned to Toshiba authorized dealer, Indatus of Louisville, a full-service data communications contractor, to provide phone systems, network infrastructure, cabling, building access and video surveillance for the new building. “Because it was new construction, we were able to install cuttingedge infrastructure and network cabling for both the company’s LAN and for the video surveillance system.

We also put in an access control and phone system,” says Scott Langley, project manager for Indatus.

Danish daycare curbs vandalism The staff at a daycare centre in Alleroed, a suburb north of Copenhagen, Denmark, had complained that a young group was causing destruction on its grounds after hours. The vandals had free rein for their misdeeds because no one was in the area after dark. To solve the problem, Alleroed decided last year to install video surveillance in the institution in cooperation with Milestone certified partner Atea.

In total, the municipality now has more than 100 cameras in seven locations, most of them Sony SNC network cameras, which are controlled with Milestone XProtect Enterprise IP video management software (VMS) and accessed using the Milestone Mobile client.

Another initiative taken to prevent vandalism and violence is the hiring of eight security guards who patrol the municipality in shifts. They access the video surveillance from their iPads using Milestone Mobile to determine whether they have to drive out to prevent criminal activity. In severe cases the guards will call the police.

Ad Index Axis Communications Building Reports Canada CANASA Commissionaires

5 www.axis.com 19 www.buildingreports.ca 18 www.canasa.org 2 www.commissionaires.ca

G4S HID Honeywell March Networks

7 www.g4s.ca 24 www.hidglobal.com 3 www.maxprocloud.com 23 www.marchnetworks.com

November/December 2013 • www.canadiansecuritymag.com

CS dec 2013.indd 22

2013-11-27 2:22 PM

MarchN MAR.13

Protecting assets, preventing loss and catching bad guys are what March Networks does best. We combine the highest quality video with powerful fraud investigation and case management tools to create the world’s most trusted surveillance solutions for financial institutions.

With over 120,000 systems installed, we’re the #1 provider of video surveillance solutions to financial institutions in the Americas. Find out how we help our customers.

SEE MORE at marchnetworks.com

MAR.13.010 MarchNetworks_CS_April.indd - Canadian Security18 x 10.75.indd 1 CS dec 2013.indd 23

2013-03-13 3/5/13 12:17 10:37PM PM AM 2013-11-27 2:22

Move to the secure platform that grows with you.

Leverage HID Global’s extensible iCLASS SE® Platform to keep your access control optimized, today and tomorrow.

With constantly evolving access control concerns and demands, how can you ensure your investments today will be operable tomorrow? Go with the new standard in access control — HID Global’s iCLASS SE® Platform, the open and adaptable solution that easily integrates smart cards, mobile devices and whatever tomorrow brings, for greater security and flexibility. Now no matter where technology goes, your access control is always growing with you.

Learn more about the iCLASS® SE Platform’s advantages at hidglobal.com/grows-cansec © 2013 HID Global Corporation/ASSA ABLOY AB. All rights reserved. HID, HID Global, the HID Blue Brick logo, the Chain Design, and iCLASS SE are trademarks or registered trademarks of HID Global or its licensor(s)/supplier(s) in the US and other countries and may not be used without permission.

iclass-se-platform-grows-cansec.indd 1 HID_CS_Nov.indd CS dec 2013.indd 24 1

11/7/13 10:27 AM 2013-11-18 2013-11-27 9:23 2:22 AM PM