Physical security assessment on the VA medical center - Assignment Example

Physical security assessment on the VA medical center This project entails a physical security assessment on the VA medical center in Birmingham. The project involved two main parts; (1)going through all areas of the buildings within the institution, checking for security devices such as locks, surveillance, and access control. (2) In addition to this, an interview with the institution’s security to provide a concise and complete picture of the state of security within the institution’s premises. There were interesting findings. The institution was particularly under-staffed as pertains to security. The building’s design did not adhere to CPTED. There was sparse use of CCTV to enhance surveillance while there little to no barriers from an external barrage. I am a second year student at the Eastern Kentucky University majoring in Occupational. I would like to humbly present my interest in conducting a physical security assessment on the VA medical center in Birmingham. This survey is a requisite in the APS 210 (Physical Security Assessment Project) class. The VA Medical center is my ideal choice as it offers me with the diversity required to apply all aspects, both theoretical and practical, of physical security assessment. The facility is unique in the sense that it caters to the elderly and vulnerable in the community. As such, security is an essential facet of operations. The intended survey will entail going through all areas of the buildings within your institution, checking for security devices such as locks, surveillance, and access control. In addition to this, an interview with the institution’s security manager will be essential in providing a concise complete picture of the state of security within the institution’s premises. This process should take up to 2 hours at the most. All information obtained from the survey will be treated with utmost discretion as all it is considered confidential to the parties involved. Upon agreement, all information generated from this research activity will be strictly confidential, limited to only the parties taking part in the exercise highlighted. The Eastern Kentucky University will be represented by the assigned instructor and supervisor. The other parties who will be preview to the information generated from the research will be the facility’s Senior Security Manager. Purpose This survey has been developed to investigate the weaknesses in the personnel protection system, physical protection system and other weaknesses that may pose a potential threat to the operations of the Birmingham Alabama VA Medical Center in case of an attack. This assessment is expected to produce concrete results that will be used to develop recommendations for the institution as pertains their security. These recommendations will be vital in the creation of protection strategies so as to improve the short-term protection in the case where emergencies or national crises may arise. This is also essential to be used as a benchmark for further research and potentially be used as a template for conducting security and vulnerability analyses on other medical institutions. Scope The survey examined all the security features of the facility. All aspects, physical and human were considered. The perimeter wall that protects half of the facility, towards the back. The perimeter barriers that reinforce the perimeter wall were also considered. All entrances to and fro the facility were analyzed for their adherence to building security standards for both current and future security installments. The surveillance by both human and technical units were analyzed for their coverage and their reliability. The facility’s ability to respond to fires was also analyzed and tested. This was according to the building and construction fire protection, detection, alarm and suppression techniques, preparedness and installments. The critical services and critical areas were also analyzed for any security weaknesses. Facility/Building Background The department of veteran affairs is a state body that takes care of war veterans after their time in service by providing them with support and benefits. The Birmingham, Alabama Medical Center primarily provides dental services to the veterans. However, it also offers other specialized medical services with specialized medical equipment. The institution also has its own vibrant emergency response unit. This unit has up to 10 specialized ambulances, specially designed to deliver services to the veterans. The main building complex consists of 3 buildings, a vast parking space and special emergency entry. There are a total of 4 entries and exits on every building within the complex. The institution has 8 above ground water tanks that can store up to 26,000 gallons each. The hospital also has its own helipad on one of the buildings. The primary gate fence is the main entrance into the institution’s compound. However, another entry/exit is specifically left for ambulances moving in and out of the institution. This entrance is heavily protected with double the number of guards at the point of entry. Findings After the completion of the survey. All information was collected and the following findings were derived from the data collected. Physical Security Perimeter Barriers The facility only has perimeter barriers protecting the front of the facility towards 19th Street South. However these barriers are not capable of stopping vehicles. In the case that a vehicle on University Boulevard should lose control and plunge towards the facility, individuals in front of the facility would be at high risk of sustaining serious injuries. This is also true for half of the side facing 19th Street and the side facing 18th Street South Perimeter Wall The facility has a perimeter wall that secures the back section of the facility. This is owing to the fact that this area has an open space with some important facilities found in this area. This perimeter wall extends only to half of the sides facing 18th Street South and 19th Street South. This leaves half of the facility unprotected. Anti-Ram Devices The facility has no ram-devices on either of its four sides. The front of the facility particularly lacks these crucial devices. This leaves the front of the facility particularly vulnerable to a ram attack or even a ramming accident at the junction of 19th Street South and University Boulevard. Parking The designated parking spot at 2128 Fourth Avenue North provides the facility with a good distance between the building and parked vehicles. This also helps reduce the security threat that comes with potential car bomb as vehicle are parked away from the facility. Only having the facility’s shuttle services ferry patients to and from the parking space reduces traffic and helps with controlling vehicles within the facility’s complex. Landscape The landscaping provides no spaces to hide. This is because there is little space for one to hide in as it is generally open at the back and closed at the front. CPTED Adherence The site’s planning fails to incorporate strategies from a crime prevention through environmental design perspective as envisioned in CPTED. There are toilets that are located in non-secure areas. Such as toilets right at every exit. Critical building Components are not located close to any main entrance, vehicle circulation, parking, maintenance area, loading dock, interior parking. All doors and walls meet the requirements of UL752 “Standard for Safety: Bullet-Resisting Equipment” Computer Network Physical Vulnerabilities and Threats Given the technical and physical layout of the institution, there exist numerous potential points of vulnerability, which also pose given threats to the security of the institution. The following is a comprehensive analysis of these given vulnerabilities and threats. Vulnerabilities Desktop Computers The desktop computers do not have any visible physical vulnerabilities due to their secured location and reinforced security behind the server windows. Dedicated T1 Connection This connection serves as the network through which information is shared and transferred throughout the whole facility. The connection is received from the outside, therein lies the threat of an external attack should the connection be compromised from the outside. File Server The location of the file server together with the server 2008 domain controller causes the file server to be particularly vulnerable. This is because in the case where the server 2008 domain controller is compromised, all the ePHI will be compromised. Windows 2008 Active Directory Domain Controllers The windows 2008 active domain controller completely relies on the firewall for protection. As such it is vulnerable to external and physical attacks in the case where the firewall is down. Firewall The firewall is particularly vulnerable to an internal physical attack should the server computer be compromised. Threats Desktop Computers Should the desktop computers behind the service window be left on, connected to and logged into the dedicated T1 connection, there lies a threat of an external attack should the dedicated T1 connection be compromised. Dedicated T1 Connection Should the connection be left on, with all the computers logged into the file server, the connection poses a threat to all ePHI. This threat is particularly compounded in the instance where the firewall is down either through an external or internal attack, or in the case of maintenance procedures occurrences. File Server Though the file server lies behind the caged area, there lies the threat of a physical attack on the file server should the backdoor and the cage door be left open. This threat also poses a further threat of theft of the file server in the instance when the back door and the door to the server room are left unsecured. Windows 2008 Active Directory Domain Controllers The windows 2008 active domain directory domain controllers all houses all the SMTP, HTTP and DNS (Domain Name System) servers. In the case where the back door and the access door to the server room are compromised or left unsecured, all these servers could be compromised. In such a case all the servers would be affected, disrupting the distribution and flow of information within the facility. Firewall In the case of maintenance services on the firewall, the firewall will be down and inactive. At this time the firewall ceases to protect the dedicated T1 connection and the file server. This will pose a threat to all ePHI and violate the HIPAA security rule. Areas of Refuge Areas if refuge have been determined within the building. All fire exit routes have been clearly demarcated. In the case of an emergency, the designated fire exits lead to the open space outside the facility. Elevators and Rooftop Access There is little access to the elevators and the roof except for designated individuals. These areas are specially protected by a security cardkey control system that require a user to either swipe or insert a keycard. This keycard is only held by middle-level and top-level medical practitioners and personnel such as security and the janitor. Surveillance The facility has been fitted with CCTV cameras that monitor only the sensitive sections of the medical facility. Such as the Emergency Room, the Intensive Care Unit and Surgery. There is lack of sufficient surveillance equipment to offer adequate security. Guard Security Security at the Entrances There is only one guard manning the entrance to the facility. This poses a huge security threat as the entrance experiences considerable traffic. The other entrances or exits to the outside are not manned, which possesses a potential security threat. There is a guard at the entry/exit point to the emergency wing. This is a crucial security asset as they protect, and watch over the patients within the emergency wing. Emergency Response The security wing of the institution is in direct contact with the city’s police department on issues pertaining to security. This provides the facility with a potential emergency response team in the case of an attack. Availability of Security Personnel The institution is clearly understaffed as pertains to security. There are too few security personnel manning crucial entry and/or exit points throughout the facility. Security Awareness and Emergency Preparedness There are numerous instances when the staff have been found to be lagging when it comes to security issues. Some of the staff were found to leave their security keycards unattended to. This possess a huge security threat in the case of an attack from the inside of the facility. Information obtained from the staff revealed the lack of preparedness towards a potential emergency situation where security of the institution is compromised. There are a number of safety drills that are specifically tailored for a fire situation. However, there is the general lack of an official safety drill in the event the security of the institution is compromised. Staff and personnel within the building would be oblivious of a security threat that may take place in any given section of the hospital, given the general lack of sufficient security at the strategic entry/exit points within the building. Entry/Exits Office entry and exists are generally left open as this makes workflow easier and communication. However, this is the case in other sensitive areas. Recommendations CCTV It is essential that the facility installs extra CCTV cameras to offer adequate surveillance cover both inside and outside the facility. These CCTV cameras will be installed strategically to offer adequate surveillance to all points of interest including the helipad. Security Personnel It is vital to the security that there is an increase in the number of security personnel guarding the entry and/or exit points at the facility. The understaffed security may find it hard to cope with a security threat in the event of an attack. Staff Security Awareness and Emergency Preparedness It was identified that a considerable number of staff were violating some security procedures either knowingly through negligence, or unknowingly due to lack of knowledge on the criticality of the facility. There is need for all staff to undergo through security training and emergency response procedures. It is essential that all staff members are taken through drills that will simulate a security emergency and test their ability to handle such situations. This is integral in developing a culture that is conscious about security within the facility and within the working environment. The institution may issue a mandate to carry out different types of safety drills that are specific to a given threat, be it physical security, fire, explosion or natural disaster. These drills will entail specific evacuation procedures that are to be adhered to so as to mitigate the number of injuries and/or fatalities in the case general security is compromised. Existing employees have to be accustomed to these drills, while new employees will have to go through a course at the inception of employment with the institution. This is to ensure that the security standards within the institution are maintained at a high level. Shelter-in-place and institution-wide evacuation drills should be conducted at least four times in a year. This should be done on two platforms; (1) in adherence to the Occupation Health and Safety standards, and (2) as part of developing a corporate culture that upholds security. Material Safety Data Sheets (MSDS) The Material Safety Data sheets are essential in providing the staff and employees with the critical information pertaining to the procedures to be employed in working or handling a given special substance in a given manner, especially in the event the substance poses a security threat to the institution. The institution requires these sheets installed in all areas within the institution that contain or house any given substance that may pose a threat to the security of the institution. These sheets should contain vital information such as; Physical data (flash point, melting point, boiling point) Health effects Toxicity Disposal Storage Reactivity First Aid Spill-handling Procedures Protective Equipment Structure-design Features Management has to consider and determine the building design features that may either be helpful or dangerous at the event of a shooting or bombing at the downtown campus. The age of the building. Features such as power supplies and emergency lighting would be an advantage in the case of a shooting and/or bombing. Management is also obligated to determine an exit route should a shooting or bombing take place. The best exit route would have to be to a designated exit that leads away from the traffic on 18th Street South and University Boulevard. However, in the case of inaccessibility of the police station, traffic or students should seek refuge away from University Boulevard. Emergency Communication Systems There is need for the installation of a dedicated and unique emergency communication system. This system has to be distinct and separate from the buildings main communication systems. This is to ensure integrity of the system is not compromised. This communication system will allow limited access to a limited number of people. Individuals with access to this communications network will include the security personnel, high ranking officials within the institution and any relevant individual. Corporate Culture There is a general lack of commitment to the security status of the institution. This may become a potential and definitive threat itself. By virtue of having a general culture that does not observe or uphold the level and quality of security, the institution and its structures are at risk of a security attack out of ignorance. This points out to the management’s, and thus overall company’s culture showing the system of expected behavior (Manuele, 2008). Workers would only devoted towards keeping a safe working environment if management is dedicated to the same. Management gives direction to the company, and in this case, management failed to guide the company towards the most profitable path. Management can only remedy this by identifying employees that are dedicated towards ensuring a safe working environment and integrating emergency response training in the event of a plant-wide evacuation. Management can achieve this through the implementation of safety policies. References Fennelly, L. J. (2004). Effective Physical Security. Boston: Elsevier Butterworth Heinemann. Manuele, F. A. (2008). Advanced Safety Management: focusing on Z10 and Serious Injury Prevention. Hoboken: Wiley-Interscience. Philpott, D., & Einstein, S. (2006). The integrated physical security handbook. Arlington: Homeland Defense Journal. Tucker, G., & Broder, J. F. (2011). Risk Analysis and the Security Survey. Burlington: Elsevier Science. United States Office of the Inspector General for Tax Administration,. (2013). The physical security risk assessment program needs improvement. Washington: Department of the Treasury, Inspector General for Tax Administration. Read More