Threat Levels advice for security managers of crowded places following a change of threat level to...

8
Advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security managers of crowded places following a change of the threat level to CRITICAL. There are a number of operational and tactical options you may wish to consider. Terrorism threat levels are designed to give a broad indication of the likelihood of a terrorist attack. They are based on the assessment of a range of factors including current intelligence, recent events and what is known about terrorist intentions and capabilities. Information about the national threat level is available on the MI5 – Security Service website. 2. Threat Level Definitions There are five levels of threat which are defined below: CRITICAL An attack is expected imminently SEVERE An attack is highly likely SUBSTANTIAL An attack is a strong possibility MODERATE An attack is possible but not likely LOW An attack is unlikely There is no specific intelligence, the assessment is generic and does not identify any sector or detail of locations or timings. As a consequence of the change in threat level it is recommended that those responsible for security review their plans and operations. You may wish to consider some of the options listed below. 3. Response Levels The UK Government Response Levels provide a general indication of the protective security measures that should be applied at any particular time. They are informed by the threat level, but also take into account specific assessments of vulnerability and risk. During any incident leadership is key, make a dynamic risk assessment and take responsibility. Decisive individuals will save lives. There are three levels of response EXCEPTIONAL, HEIGHTENED and NORMAL. Response levels equate to threat levels and tend to relate to sites, whereas threat levels usually relate to broad areas of activity. There are a variety of site specific security measures that can be applied within each response level, although the same measures will not be found at every location. The security measures deployed at different response levels should not be made public, to avoid informing terrorists about what we know and what we are doing about it.

Transcript of Threat Levels advice for security managers of crowded places following a change of threat level to...

Page 1: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

AdviceforsecuritymanagersofcrowdedplacesfollowingachangeofthreatleveltoCRITICAL

1. Introduction

TheaimofthisadviceistoprovideadvicetosecuritymanagersofcrowdedplacesfollowingachangeofthethreatleveltoCRITICAL.Thereareanumberofoperationalandtacticaloptionsyoumaywishtoconsider.Terrorismthreatlevelsaredesignedtogiveabroadindicationofthelikelihoodofaterroristattack.Theyarebasedontheassessmentofarangeoffactorsincludingcurrentintelligence,recenteventsandwhatisknownaboutterroristintentionsandcapabilities.InformationaboutthenationalthreatlevelisavailableontheMI5–SecurityServicewebsite.

2. ThreatLevelDefinitions

Therearefivelevelsofthreatwhicharedefinedbelow:

CRITICAL Anattackisexpectedimminently

SEVERE Anattackishighlylikely

SUBSTANTIAL Anattackisastrongpossibility

MODERATE Anattackispossiblebutnotlikely

LOW Anattackisunlikely

Thereisnospecificintelligence,theassessmentisgenericanddoesnotidentifyanysectorordetailoflocationsortimings.Asaconsequenceofthechangeinthreatlevelitisrecommendedthatthoseresponsibleforsecurityreviewtheirplansandoperations.Youmaywishtoconsidersomeoftheoptionslistedbelow.

3. ResponseLevels

TheUKGovernmentResponseLevelsprovideageneralindicationoftheprotectivesecuritymeasuresthatshouldbeappliedatanyparticulartime.Theyareinformedbythethreatlevel,butalsotakeintoaccountspecificassessmentsofvulnerabilityandrisk.Duringanyincidentleadershipiskey,makeadynamicriskassessmentandtakeresponsibility.Decisiveindividualswillsavelives.TherearethreelevelsofresponseEXCEPTIONAL,HEIGHTENEDandNORMAL.Responselevelsequatetothreatlevelsandtendtorelatetosites,whereasthreatlevelsusuallyrelatetobroadareasofactivity.Thereareavarietyofsitespecificsecuritymeasuresthatcanbeappliedwithineachresponselevel,althoughthesamemeasureswillnotbefoundateverylocation.Thesecuritymeasuresdeployedatdifferentresponselevelsshouldnotbemadepublic,toavoidinformingterroristsaboutwhatweknowandwhatwearedoingaboutit.

Page 2: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

Tosupportyourplanningthethreatlevelandresponselevelsarecombinedinthetablebelow.

Threatlevelanddefinition Responselevel Description

CriticalAnattackisexpectedimminently

Exceptional Maximumprotectivesecurity.Criticalmeasurestomeetspecificthreatsandtominimisevulnerabilityandrisk

SevereAnattackishighlylikely

Heightened AdditionalandsustainableSubstantialandSevereprotectivesecuritymeasuresreflectingthebroadnatureofthethreatcombinedwithspecificbusinessandgeographicalvulnerabilitiesandjudgementsonacceptablerisk

SubstantialAnattackisastrongpossibility

ModerateAnattackispossiblebutnotlikely

Normal

Routineprotectivesecurity.LowandModeratemeasuresappropriatetothebusinessconcerned

LowAnattackisunlikely

4.AdditionalInformation

Therearesomesimple,practicalactionsyoucantakeimmediatelytohelpimprovethesecurityofyourvenue:

RiskAssessment

• Carryoutariskassessmentthatisspecifictoyourvenue

BuildingResponseLevel

• Regularlyreviewtheresponselevelforyoursiteorvenueatsecuritymeetings• Clearlydisplaysignageinformingstaffofthebuildingresponselevel.Thisshouldnotbe

displayedinpublicareas

Securityofficerspostureandactivity

• Proactiveengagementandstaffbriefings.Oneofthemostdisruptivemeasurestocounterterroristsandwidercriminalityisasecurityforcethatappearstobevigilantandproactivelyengageswiththepublic.Terroristsandcriminalsdonotwanttobespokentobyanymemberofstaffandwillactivelyavoidengagement–thisshouldbepolitebutprofessional.Iftheyarespokentoitislikelytomakethemfeelveryuncomfortableandexposed.Staffbriefingswillenableyoursecurityofficerstounderstandtheimportanceofproactiveengagementandtheyshouldbeencouragedtodothiswherepracticalandreasonabletodoso.Forexample,ifsecurityofficerspatroltoareasinacar(suchasacarpark),encouragethemtogetoutofthecarandengagewithpeople,assimpleassayinggoodmorning.

• Unpredictablesecuritymeasures.Unpredictabilityresultsinuncertaintyanderosionofconfidenceinthemindofthehostilewhoneedthispredictablesecurityarrangementssothattheycanplanforlikelysuccess.Wherepracticalandreasonablebuildinunpredictabilityforexample,timingsandtypesofassetsandsearchregimesdeployedatyoursite.

Page 3: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

• ‘Recruit’stafftobevigilantforandimmediatelyreportsuspiciousactivityanditems.Useexistingstaffcommunicationssuchasshiftbriefings,intranetetc.toinformastowhatsuspiciousactivitymaylooklike,totrusttheirinstinctsandreportimmediatelytothesecuritycontrolroom/police.Inthesecommunicationsconveyhowtheirreportswillbetakenseriouslyandinvestigatedandwherepossibleshowcasewherepreviousstaffreportinghasledtooutcomes,bothwheretherehavebeenbenignandsecurityoutcomes;thishelpspromoteconfidenceinreporting.

Thecountermeasurestobeimplementedateachresponselevelareamatterforindividualpremisesororganisationsandwilldifferaccordingtoarangeofcircumstances.Allprotectivesecuritymeasuresshouldbeidentifiedinadvanceofanychangeinthreatandresponselevelsandshouldbeclearlynotifiedtothosestaffwhoareresponsibleforensuringcompliance.Itisimportanttotrainstaffandtheconductrehearsalexercisesforeachresponselevel.Thetablebelowprovidesanumberofprotectivesecurityoptionsyoumaywishtoconsidertoconsider.Forfurtherinformationvisit:www.nactso.gov.uk,www.cpni.gov.uk,CabinetOffice,Emergencies:preparation,responseandrecovery,EmergencyPlanning.

SecurityChecklistINITIALACTIONS

1. Reviewyoursecurityplans

2. Identifyyourrisks,basedonthecurrentthreat

3. ReviewyourBusinessContinuityPlans

4. Decidewhatyouneedtoprotect,identifyingcriticaloperationsandfunctions

5. Increasestaffvigilance–throughbriefing

6. ReviewEvacuation,InvacuationandLockdownprocedures.Ensureyouhaveplansforvulnerablestaffandvisitors.Haveyoudesignatedmarshalstosupportthisactivity.

7. Identify‘protectedspaces’

8. ReviewyourEmergencyAssemblyPoint

PREPAREDNESS

1. EnsureFirstAidKitsarefullystockedandstaffknowwheretheyarekept

2. EnsureCrisisIncidentKits(grabbags)areavailableanduptodate

Page 4: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

COMMUNICATION

1. Briefstaff–ensuretheyunderstandtheirrolesandresponsibilities

2. Engagewithneighbours,partnersandsuppliers

3. Ensureyouareabletoalertstaffandvisitorsofanyimminentorimmediatethreatorincident

4. Providepriornotificationtostaffandvisitorsofenhancedsecuritymeasures,encouragingthemtoarriveinplentyoftimeandencouragethemtobringminimalpossessions

5. Monitornewsandmediachannels

6. Developpre-scriptedmessagingandalertsanddeterminehowthesewillbecommunicatedtostaffandvisitors

PERSONNEL

1. Maintainanuptodatelistofpersonnel(DoHRupdateleaversandjoiners?)

2. Considerextendingstaffshiftswhereappropriate

3. Considercancellingleavewhereappropriate

4. Considercancellingnon-urgentbusinessorvisitorswhereappropriatetoyourvenue

5. Identifyifyouhavesufficientstaffforcriticalrolessuchasyourcontrolroom

6. ReviewrequirementsforPersonalProtectiveEquipment(PPE)forsecuritystaff

TRAINING

1. Ensurestaffunderstandhowtorespondtoaterroristincident.seeETHANE

2. Arestafffirstaidtrained

3. Reviewanddelivertrainingtoyourstaffandconductrehearsalexercises

STAFFVIGILANCE

1. DoALLstaffunderstandhowtorespondeffectivelytoreportsofsuspiciousactivity,behaviouranditemswhenreportedbythepublic.Whotheyshouldreporttointernallyandwhentoreporttopoliceusing999

2. Disruptinghostilereconnaissance:Ensurestaffunderstandhowtoidentifysuspiciousbehaviour(Doyouhaveachallengeculture?–seeCPNIwebsite)

Page 5: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

3. SuspiciousItems:Ensurestaffunderstandhowtorespondtosuspiciousitems.DostaffknowtheHOTprinciples?

4. Ensureallstaffandvisitorswearpasses

5. Whereentryisrestricted,checkthevisitorsidentificationpriortoallowingaccesstothesite

PHYSICALSECURITY

1. Enhanceyoursecuritypresencewhereappropriate,considerstaffpatrollinginhighvisibilityclothing

2. EnsureCCTVisworkingeffectivelyandmonitored

3. Reviewyouraccesscontrols.Whereappropriatecloseunnecessaryentrancestopreventunauthorisedaccess

4. Ensureinfrastructure,suchassignage,lighting,floorlevelsigns,stairsetc.areclearlymarkedandlabelled.

5. Preparefloorplans

6. Establishifyourcontrolroomiscapableofbeingoperationallyeffectiveagainstdifferentattacktypesandcanbesecuredandprotected

7. CheckcriticalsystemsandequipmentsuchasPAsystems

8. Ensurecontrolroomshavealternativemeansofcommunicationsuchasmobilephoneswithsparebatteries,chargersetc.

9. Considertheprotectionrequirementsforanyqueuesofpeoplecreatedbyadditionalsearchmeasures(CCTV,positionofthequeueetc.)

SEARCHANDSCREENING

1. Businessasusualsearchandscreening(lookingforprohibiteditems)should,whendonewell,provideaverygoodcapabilitytodetectlargerthreatitemsconcealedabouttheperson

2. Youwillhaveafiniteamountofsecurityandscreeningresources,focusonaddressingyourhighestprioritythreats

3. Beclearaboutwhatthesearchprocessisaimingtodetect,whoyouneedtoscreenandwhereyouwillconducttheprocess

4. Definelistsofprohibiteditems.Communicatethisbothtocustomersandpersonnelconductingthesearch

5. Priornotification(atpointofsaleormedia)oftheseextrasecuritymeasuresandencouragingpeopletoarriveearly,willsmoothpeaksandallowsafeandeffectivesearching

6. Provideeffectivepublicaddressmessagingtopeopleastheyapproach,askingpeopletoprepareforadditionalsearchandscreening.Thisshouldreduceunacceptabledelay

Page 6: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

7. Considerinitialsearchandscreeningontheapproachoroutsidethevenue,forexampleavisualcheckinsidejacketsandbags

8. Conductsearchandscreeningmeasuresefficiently,effectivelyandpolitely.Aimtomaximisescreeningthroughput(tominimisequeuesthatmaybetargeted)

9. Bagsandotheritemsshouldbesearchedtotheextentrequiredtoprovideconfidencethatnoitemsofconcernarepresent.Manualbagsearchesshouldbe,proportionate,systematic,consistentandsafeforthepersonconductingthesearch.Alwayslookwhereyouaresearching

10. Manualpersonsearchesshouldbeconsideredtotheextentrequiredtoprovideconfidencethatnolargerthreatitemsarepresent.Engagethecustomerandobtaintheirpermission.Considerwhethersearchshouldbeaconditionofentryifitisnotalready.Searchsystematicallyfromheadtotoe.Payparticularattentiontobulkyandbaggyclothing.Continuethesearchtotheend,evenifsomethingisfound.Donotbeintimidatedordistracted.Usehandsinafirmslidingmotion.Screenersshouldalwaysbethesamesexasthecustomer.Whereappropriateaskthecustomertoremovepocketitems.Considertheprivacyneedsoftheindividual

11. Ensureyoursiteorvenueissearchedonaregularbasisbutnotatpredictabletimesorinapredictableway

12. Ensureyoumaintainyoursearchregimeforthelifecycleoftheeventincludingpriortothecommencement,duringandpostevent

13. Determinewhetheryouallowvehiclesintoyourvenueandifyouintendtosearchvehiclesenteringyourvenue

14. Trainsearchstafftosearchsafelyandeffectively

15. Ensureallstaffareawareoftheresponsewhentheylocatethreatitems

16. Thereanumberofothertacticaloptionsavailableforsearchandscreening,specialistadviceshouldbesoughtfromtheCPNIwebsiteoryourlocalCounterTerrorismSecurityAdvisor.

SECURITYPERSONNEL

Dependingupontheirresponsibilitiesaneffectivesecurityguardmustbeabletodemonstratetheycanrespondeffectivelytoanumberofscenariosincluding:

1. Doyousecuritystaffunderstandhowtorespondeffectivelytoreportsofsuspiciousactivity,behaviouranditemswhenreportedbythepublic.Whotheyshouldreporttointernallyandwhentoreporttopoliceusing999,101orcalltheAnti-TerroristHotline0800789321

2. Initialactionsataterroristincident,seeETHANE

3. Ensureyoumaintainyoursearchandpatrolregimeforthelifecycleoftheeventincludingpriortothecommencement,duringandpostevent.Considerapatrolsweepofthepublicareasbefore,duringandafteraneventlookingforsuspiciousitemsandbehaviours.Patrol

Page 7: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

areasmightincludeareasclosetothesite,pickupzonesandtransporthubs.Ensurethosestaffcancommunicateeffectivelywithacontrolroom.

4. Thedifferentterroristthreatlevels,buildingresponselevels,anddifferentactivitiesrequiredshouldtherebeanincreaseinthreat

5. Hostilereconnaissance,howtopatroleffectivelytodisruptactivity,identifyandrespondtosuspiciousbehaviour

6. Suspectitems,the‘fourCs’protocolsandtheHOTprinciples

7. Chemical,biologicalandradiologicalincidents,howtorecogniseandrespondusingSTEPS123

8. AfirearmsandweaponsattacksandtheRun,Hide,Tellprinciples

9. Evacuation,invacuationandlockdownproceduredemonstratingknowledgeoftheemergencyassemblypoints

10. Howtosearchasiteeffectively

11. Thebasicprinciplesofgoodhousekeepingandhowitreducestheopportunitiesforanattack

12. Howtorespondappropriatelytoabombthreat

13. Usingemergencyequipmentsuchasdefibrillatorsetc.

14. Useofincidentlogsandcheckliststhatfacilitateaneffectiveresponsetoincidentssuchasterroristincidents,bombthreatsetc.

GOODHOUSEKEEPING

1. Whereyourriskassessmentdeterminesitisnecessary,examineopportunitiestoreducingreasonsforcrowdstodwellsuchasreducingorremovingorrelocatingactivitiesthatareattractive,suchasstreetentertainers,mobilefoodoutletsetc.Considerincreasingpatrolsintheseareas.Considercarefullywheretheseactivitiestakeplace.

2. Haveyoureviewedtheuseandlocationofallwastereceptaclesinandaroundyourvenueorevent,takingintoconsiderationtheirsize,proximitytoglazingandbuildingsupportstructures?Considerrepositioningtoareasthatarenotcrowded

3. Arethebinsemptiedregularly?

4. Areexternalareas,entrances,exits,stairs,receptionareasandtoiletskeptclean,tidyandwelllit?Wherepossiblereduceareaswhereitemscanbeconcealed

5. Doyoukeepfurnituretoaminimumtoprovidelittleopportunitytohidedevices,includingunderchairsandsofas?

6. Doyouuseseals/lockstosecuremaintenancehatches,compactersandindustrialwastebinswhennotrequiredforimmediateuse?

7. Considerarrangingvehicledeliveriesfortimeswherethefewestnumberofpeopleareonsite.Consideradoptingtimewindowswherenodeliverieswillbeaccepted.

Page 8: Threat Levels advice for security managers of crowded places following a change of threat level to CRITICAL 1. Introduction The aim of this advice is to provide advice to security

8. Doyouscreenallyourmailandcanyouisolateyourmailprocessingarea?

9. Haveyoutestedandexercisedforaterroristincidentinthelast12months?Dostaffunderstandtheirrolesandresponsibilities?

10. Arerelevantstaffanddeputiestrainedandcompetentinmanagingbombthreats?

11. Doyouregularlycheckthecontentoffirstaidkits,crisismanagementpacksandfirefightingequipment?

12. HaveyoucheckedyourCCTVtoensureitisworkingeffectivelyandhassufficientcoverageinsideandoutside?

13. Haveyoutakenintoaccountthelocationofstreetvendors(e.g.flowersellers,newsstandsandrefreshmentstalls)soasnottoimpactuponevacuationroutes,assemblypoints,exitsorentrances?

14. Arecycleracksandlockerspositionedawayfromcrowdedareas?IsCCTVmonitoringnecessary?


Computer Security threat

Computer Security threat

Threat Modeling: Security Development Lifecycle

Threat Modeling: Security Development Lifecycle

Security Threat

Security Threat

WASC Threat Classification - ZenK-Security

WASC Threat Classification - ZenK-Security

Threat Levels advice - assets.publishing.service.gov.uk · protective security measures reflecting the broad nature ... security measures should be identified in advance of any change

Threat Levels advice - assets.publishing.service.gov.uk · protective security measures reflecting the broad nature ... security measures should be identified in advance of any change

Sophos Mobile Security Threat Report - Technology …i.crn.com/bestofbreed/sophos-mobile-security-threat-report.pdf · Sophos Mobile Security Threat Report ... phones. Spreads from

Sophos Mobile Security Threat Report - Technology …i.crn.com/bestofbreed/sophos-mobile-security-threat-report.pdf · Sophos Mobile Security Threat Report ... phones. Spreads from

Sophos Security Threat Report 2013

Sophos Security Threat Report 2013

Virtualization security and threat

Virtualization security and threat

Information Security Threat Assessment

Information Security Threat Assessment

Insider Threat Security Reference Architecture

Insider Threat Security Reference Architecture

SECURITY ENDPOINT THREAT REPORT 2019€¦ · evolving landscape. SECURITY ENDPOINT THREAT REPORT 2019 SECURITY ENDPOINT THREAT REPORT 2019 The research covered a total of 15 markets,

SECURITY ENDPOINT THREAT REPORT 2019€¦ · evolving landscape. SECURITY ENDPOINT THREAT REPORT 2019 SECURITY ENDPOINT THREAT REPORT 2019 The research covered a total of 15 markets,

Security Threat Report 2014 - climbcs.com

Security Threat Report 2014 - climbcs.com

WEBSITE SECURITY THREAT REPORT 2016 - Symantec · WEBSITE SECURITY THREAT REPORT 2016. Symantec WSTR 2016 2 Contents ... is the annual Symantec Website Security Threat Report, which

WEBSITE SECURITY THREAT REPORT 2016 - Symantec · WEBSITE SECURITY THREAT REPORT 2016. Symantec WSTR 2016 2 Contents ... is the annual Symantec Website Security Threat Report, which

Sophos Security Threat Report 2014

Sophos Security Threat Report 2014

Security and Threat Awareness Training

Security and Threat Awareness Training

Cyber Security Intelligence & Threat Mitigation

Cyber Security Intelligence & Threat Mitigation

Homeland Security Threat Overview

Homeland Security Threat Overview

INFORMATION TECHNOLOGY SECURITY THREAT MANAGEMENT … · Information technology security threat management combines IT security disciplines of threat detection, incident management,

INFORMATION TECHNOLOGY SECURITY THREAT MANAGEMENT … · Information technology security threat management combines IT security disciplines of threat detection, incident management,

Security Standards and Threat Evaluation

Security Standards and Threat Evaluation

Routing security against Threat models

Routing security against Threat models