Door Security - What Can Possibly Go Wrong?

Mr. Shawn I. Reilly, CPP, PSP, CPD, CHPA

Early 1980’s Crime Prevention Efforts• Broken windows Theory

• James Q. Wilson and George Kelling

• Caring about how your facility looks, can discourage small crimes

• If you stop small crimes you can keep bigger crimes from occurring

• Broken Doors Theory ( I just made that up)• Broken doors generate these conditions:

• Access is granted to everyone and you don’t know it

• If one door is broken having another one broken is no big deal

• If door alarms are numerous none of the alarms will be assessed

• Employees prop doors because there is no consequences for doing it

Overview• Access Control is both a very valuable component of the Physical

Protection System (PPS) and a very vulnerable layer of protection.

• Through numerous risk assessments we have come to see many of the same vulnerabilities repeated over and over again.

• Today you may even see access control failures that have happened at your location.

• The key is to be aware of these vulnerabilities and look for them in your own PPS

Today We’ll Look at

• Access Control Issues as They Relate to:• Improper Installation or Maintenance

• Poor Procedures and Practices

• Man Machine Interface

• Some Good News

• If we have time, other areas of interest

Improper Install or Maintenance

• The design of access control features along with neglected maintenance can create vulnerabilities that no one may even be aware of.

Isolated Doors Can Be Neglected

In your lower levels, where only

employees go, you will find doors like

this. They are obviously broken and

have been that way for a long time.

Access to employee areas can lead

to other areas that are high

risk/sensitive.

Auto Openers and the 22 Second Windowof Vulnerability

Another favorite in

healthcare and on most

loading docks…the auto-

open door. Once open, it’s

a free-for-all to enter until

the door is set to close.

Doors that Fail to Close

Users are not motivated to call in

a work order— “Not my job.”

If security is not checking doors,

it may never get fixed. If security

does not have an easy and quick

way to report broken doors it still

may not get done.

Looking for a good metric to track. Broken

doors is one that has a great benefit and is

easily checked.

Finger pointing: Engineering and security

integrator; who's job is it anyway?

Sliding Doors on the Egress Path

Visitors and employees force doors

apart to gain access because of the

break away function on the doors for

emergency egress

It goes something like this

Other Door Type Breakaway Features

How Do you Fix The sliding Glass Door Issue?• Shawn, The existing lock (should be fail safe) is basically a pin that locks the door holder and

keeps it from sliding. The door actually sits in the door holder and is allowed to swing out for emergency. I would put electric deadbolts on the inside of each door and tie in to the existing fail safe lock. The electric deadbolts would lock in to the header. You could have oversized strike holes to help with alignment.

• Good morning Shawn, I’ve heard back from a couple of people with several different ideas on this. They ranged from replacing the doors with ones that have panic exits (which would prevent opening from the outside), to adding magnetic shear locks on the doors. I think the former is cost prohibitive and the latter not a good solution in my opinion. I would certainly do doors with panic exits for any new construction doors, but retrofit will be very expensive.

• I believe an astragal would be cheap and keep an honest person HONEST, but would not help against a determined intruder or doors that breakaway vs slide apart.

Access Double Doors from Secure Side

Video of vulnerability

The Solution(s)

Are there ghosts in this place?

Over pressurization between hallways,

breezeways and buildings.

How do you fix that?

Increasing the door closure can be dangerous.

Not easy to fix without Facility/Engineering

support.

Video of how too much air flow

from one building to the next can

leave doors open

Loading Docks: Home Depot without Registers

Doors to loading docks many times do

not have any alarm if they are forced

open. The areas can be in isolated

locations away from any activity and, as

a result, no one detects the forced entry.

Estimated time to force a door like this ranges from less

than a minute to 3 minutes

Poor Procedures Can Increase Vulnerabilities• The following are examples of how poor procedures impact

security through access control element.

Remote Door Release From the Outside

Long distance door release can add to a

door’s vulnerability.

Here the distance from the reception

desk to the door is over 60’ and there

are two uncontrolled hallways in

between.

Which button is the door release and which is the panic button?

The panic button is tapped over so it

can’t be used by accident or on

purpose!

Pin Pad Locks

Worn out buttons or the

combination written down

by the lock.

7,8,9,0

What would you guess was the combination to

the emergency room from the ambulance bay

Door Maintenanceand Security Checks

This door has the strike completely

removed and waiting on parts. No

one but engineering knew this and

it was unsecured for weeks

Too many instructions Can Lead to Violations

If I can’t figure out how to get in,

I’ll wait for someone to come along and

I’ll piggy-back in with them.

Push Button Locks and Training

Operator Headspace: How to make a lock,

lock

Are your employees trained?

What happens if you push the

thumb lock in and turn to the

right or to the left how is it

different?

Locking One Side and Not the Other

Failing to lock the flush bolts in place at the

top and bottom of the door leaves the door

unsecured.

Man Machine Interface

• The next series of slides show how people can impact negatively on the access control systems

• These are different from poor procedures in that they are not authorized interactions with the access control system

• The culture of the organization can also impact the how well access control systems work.

What you permit you promote

Warning! This Door Will Never Alarm

The alarm has been removed. It

made too much noise.

In other words, it did what it was

supposed to.

If it’s a good idea to let employees

use the door, then let them use it

and set the door to function as it

should.

Why wont this door

alarm?

Shipping and Receiving Access Control

Frequently, we find that the

pharmacy uses a high

security bank window at the

front door and the back door

receiving door is fixed so it

won’t lock, and in such a

way that no one can tell, so

they don’t get into trouble.

Doors Propped Open

Good security is inconvenient—that’s when human

nature takes over and we prop doors open

What is this?

Remote Release from the Secure SideIf all a unit staff member does is

release the door when a visitor

actives an intercom what good is it

Why would they do that?

• Busy, Lazy, Thinks it’s a waste of

time, Scared to say “no”, Not sure

who can’t be let in

• In any case there is usually a set

o f instructions laying around

someplace.

Gate Openers Without visualization of Who is Requesting Entry

Buzzz… and the gate

magically opens. If you

can’t ID who is out there,

what good is the gate?

Piggy Backing, and Open Doors During High Traffic Times

Organization Culture:

Employees open--and many times

hold--a door for a person they don’t

know, and who may not even have

an ID badge.

Other times, it’s just too slow

(throughput) to have everyone

badge in. So we just unlock the

door.

What’s the Difference?

• Tailgating and Piggybacking

• Hint: one involves two authorized persons and one involves an authorized and unauthorized person

From Public Space to Private Space

Crime Prevention Through

Environmental Design Strategies

dictate a clear delineation between

private space and public space.

Here two locking doors are left

open for convenience.

“Good security is inconvenient.”

Paper Records Rooms

Paper is old school we are now electronic, but are due just as much

security

Paper records are stored with no door or lock. Another condition is the

area is accessed by all employees all hours of the day and night.

Security Alarm Monitors

Do your dispatcher/alarm

monitors ignore forced door and

door held alarms?

If they don’t react to these alarms you are doing

more than wasting their time alarming the

perimeter. You are saturating them with alarms

they never act on.

Yes, There is some Good News

• Some organizations:

• Spend time and money designing the right system

• Create a culture of security through security education and awareness

Positive Culture Example

• Aflac

• Revolving doors

• Employee culture

• Many attempts to get employees to let a visitor in through an access controlled door were turned down

The Most Successful Security Programs

Do the hard thing…enforce door alarm

policy and send an officer to each event.

Use camera call up for immediate visual

assessment.

Turn off alarms that are not going to be

responded to.

Report employees who violate

Securing Corporate Offices

The best new trend is that corporate

offices are going access-controlled.

Securing these offices is based on the

culture of the organization.

Learn Door Terminology and the Many Door Functions

Lessons for Good Door Security• If some doors are part of a popular employee exit don’t try to deny

it make it work through technology policy and procedures.

• Take time to do a perimeter check making sure to locate those isolated seemingly unused doors.

• Commit to responding to door alarms (forced and held open) discover the culprit and fix it.

• Are your departments practicing good door security. Have you checked with them?

• A metric on door issues can be a great value add to your organization.

Discussion/Questions