quarta-feira, 2 de dezembro de 2009

DIRECAO DEFENSIVA


DENATRAN
Educando com valores
O trânsito é feito pelas pessoas. E, como nas outras atividades humanas, quatro princípios são importantes para o relacionamento e a convivência social no trânsito.
O primeiro deles é a dignidade da pessoa humana, do qual derivam os Direitos Humanos e os valores e atitudes fundamentais para o convívio social democrático, como o respeito mútuo e o repúdio às discriminações de qualquer espécie, atitude necessária à promoção da justiça.
O segundo princípio é a igualdade de direitos. Todos têm a possibilidade de exercer a cidadania plenamente e, para isso, é necessário ter eqüidade, isto é, a necessidade de considerar as diferenças das pessoas para garantir a igualdade o que, por sua vez, fundamenta a solidariedade.
Um outro é o da participação, que fundamenta a mobilização da sociedade para organizar-se em torno dos problemas de trânsito e de suas conseqüências.
Finalmente, o princípio da co-responsabilidade pela vida social, que diz respeito à formação de atitudes e ao aprender a valorizar comportamentos necessários à segurança no trânsito, à efetivação do direito de mobilidade a todos os cidadãos e a exigir dos governantes ações de melhoria dos espaços públicos.
Comportamentos expressam princípios e valores que a sociedade constrói e referenda e que cada pessoa toma para si e leva para o trânsito. Os valores, por sua vez, expressam as contradições e conflitos entre os segmentos sociais e mesmo entre os papéis que cada pessoa desempenha. Ser “veloz”, “esperto”, “levar vantagem” ou “ter o automóvel como status”, são valores presentes em parte da sociedade. Mas são insustentáveis do ponto de vista das necessidades da vida coletiva, da saúde e do direito de todos.
É preciso mudar. Mudar comportamentos para uma vida coletiva com qualidade e respeito exige uma tomada de consciência das questões em jogo no convívio social, portanto na convivência no trânsito. É a escolha dos princípios e dos valores que irá levar a um trânsito mais humano, harmonioso, mais seguro e mais justo.

Riscos, perigos e acidentes
Em tudo o que fazemos há uma dose de risco: seja no trabalho, quando consertamos alguma coisa em casa, brincando, dançando, praticando um esporte ou mesmo transitando pelas ruas da cidade.
Quando uma situação de risco não é percebida, ou quando uma pessoa não consegue visualizar o perigo, aumentam as chances de acontecer um acidente.
Os acidentes de trânsito resultam em danos aos veículos e suas cargas e geram lesões em pessoas. Nem é preciso dizer que eles são sempre ruins para todos.
Mas você pode ajudar a evitálos e colaborar para diminuir:
■ o sofrimento de muitas pessoas, causados por mortes e ferimentos, inclusive com seqüelas físicas e/ou mentais,
muitas vezes irreparáveis;
■ prejuízos financeiros, por perda de renda e afastamento do trabalho;
■ constrangimentos legais, por inquéritos policiais e processos judiciais, que podem exigir o pagamento de indenizações e até mesmo prisão dos responsáveis.
Custa caro para a sociedade brasileira pagar os prejuízos dos acidentes: estima-se em 10 bilhões de reais, todos os anos, que poderiam ser aproveitados, por exemplo, na construção de milhares de casas populares para melhorar a vida de muitos brasileiros.
Por isso, é fundamental a capacitação dos motoristas para o comportamento seguro no trânsito, atendendo a diretriz da “preservação da vida, da saúde e do meio ambiente” da Política Nacional de Trânsito.

DIREÇÃO DEFENSIVA
Direção defensiva, ou direção segura, é a melhor maneira de dirigir e de se comportar no trânsito, porque ajuda a preservar a vida, a saúde e o meio ambiente. Mas, o que é a direção defensiva?
É a forma de dirigir, que permite a você reconhecer antecipadamente as situações de perigo e prever o que pode acontecer com você, com seus acompanhantes, com o seu veículo e com os outros usuários da via.
Para isso, você precisa aprender os conceitos da direção defensiva e usar este conhecimento com eficiência. Dirigir sempre com atenção, para poder prever o que fazer com antecedência e tomar as decisões certas para evitar acidentes.
A primeira coisa a aprender é que acidente não acontece por acaso, por obra do destino ou por azar. Na grande maioria dos acidentes, o fator humano está presente, ou seja, cabe aos condutores e aos pedestres uma boa dose de responsabilidade. Toda ocorrência trágica, quando previsível, é evitável. Os riscos e os perigos a que estamos sujeitos no trânsito estão relacionados com:
■ Os Veículos;
■ Os Condutores;
■ As Vias de Trânsito;
■ O Ambiente;
■ O Comportamento das pessoas.

FBI PUTS CYBER THEATS IN PERSPECTIVE


GovInfoSecurity.com (11/24/09) Chabinsky, Steven R.

When gauging the extent of the danger to our federal networks, the FBI examines both the sophistication and the motives of potential attackers, writes Steven R. Chabinsky with the FBI's cyber division. The most pernicious perpetrators have the ability to change our software and hardware across the worldwide supply chain route, carry out remote network intrusions, create the physical and technical presence required to reroute and spy on our wireless communications, and place pernicious insiders within our private and federal sectors. With regard to organized crime rackets, financially driven cyber crime usually does not entail acts of violence or decimation of networks. One exception to this is extortion, where cyber crooks threaten to hold networks hostage until their demands are realized. In many cases, cyber crooks have the technical know-how to carry through with their threats, especially if an insider is on the job. The FBI has not yet witnessed a high level of comprehensive cyber sophistication within terrorist cells. Nevertheless, the bureau is aware of and monitoring individuals who have connections to or sympathies with al-Qaeda and who have recognized and discussed the susceptibility of the U.S. infrastructure to cyber attack.

ROLE OF HOSPITAL SECURITY ENVOLVES


San Bernardino County Sun (CA) (12/01/09) Steinberg, Jim

Hospital security guards in Southern California are taking a number of different steps to deal with some of the problems they are facing in keeping their facilities secure. For example, Louie Hernandez, the director of security for Pomona Valley Hospital Medical Center, has organized an informal network of hospital security officers to exchange descriptions of criminals such as thieves who specialize in the healthcare environment. In addition, the hospital security officers who participate in the network exchange information with one another about the methods that these criminals use. The creation of the network came in the wake of an incident several years ago in which someone posed as a clergyman and stole valuables from the purses of employees and hospital guests at several different hospitals. Meanwhile, a number of hospital security officers at St. Bernardine Medical Center in San Bernardino and Pomona Valley have taken California's terrorism liaison officer course, which aims to help students deal with all levels of terrorism. Security guards at St. Bernardine are also taking emergency management and hazardous material/patient decontamination classes.

terça-feira, 3 de novembro de 2009

SIA TO INTRODUCE NEW LICENCE-LINCKED QUALIFICATIONS-

The Security Industry Authority (SIA) has announced that new licence-linked qualifications are to be introduced next year, bringing training up-to-date and setting in stone a modular structure.


- By Brian Sims

The news follows an industry-led review of the SIA's specifications that drive training content. The new specifications reflect current industry Best Practice so that individuals working in the various segments of the security sector undergo good basic training for their role.

A new structure with core-plus-specialist modules means less overlap and duplication in content across the sectors. This will make it easier for individuals to qualify to obtain more than one licence, as just the relevant and required training needs to be taken for each additional qualification.

The new qualifications are currently being developed by the awarding bodies, and will be offered by training providers across the UK under the following roll-out timetable:

• Door supervisors: June 2010

• Operatives in all other sectors: January 2010 (September 2010 in Scotland).

After these dates, all applicants applying for an SIA licence for the first time must hold either the new qualification or a current qualification that is less than three years old.


Reducing criminality, raising standards
Hazel Russell, the SIA's dynamic and forward-thinking director of strategy and corporate services, has been swift to offer her views on the new structure for qualifications. “Licensing for security operatives has done much to reduce criminality and raise standards in the private security industry," Russell told SMT Online. "As the roles and responsibilities of security staff evolve, it's vitally important that their training reflects these changes and equips them for the challenges they face."

Russell continued: "We now have industry-led content, meaning it is relevant and has been developed in conjunction with those working in the licensable sectors. This will benefit operatives, businesses and the public.”

The content for all of the SIA specifications has changed and been updated. For most sectors there are not major changes to the content areas included. The exception to that rule is door supervision, where significant changes have been made at the request of industry to reflect up-to-date working practices.

There are currently no further training requirements for any existing licence holders who wish to renew their licence. However, because of the changes to the door supervision area, there may - at a future date - be a perceived need for a short ‘top-up’ training session for this sector. This proposal will need to be subject to public consultation, and will not be a requirement - if at all - until after May 2011.

Any requirement will be announced a year before this date to give the industry plenty of time to do the training.


New modular qualification structure
Core units with specialist training in each cover door supervision, security, Public Space Surveillance CCTV, Cash-in-Transit and vehicle immobilisation. Only the Cash-in-Transit and Public Space Surveillance areas do not require a conflict management element. Escorting and disengagement also forms part of the door supervision training, while close protection has its own specialist path.

A full certificate for the relevant sector is still required. The new modular format means those undergoing the training (for most sectors) will take common units – core security and conflict management – followed by a specific unit for each security sector.

A licensed operative who has already passed the two common units will therefore only need to sit the relevant additional specialist unit if they wish to gain a licence for another sector.

The qualifications are taken by applicants for front line licences. Applicants for non-front line licences do not require a qualification because they do not carry out front line activities. Those applying for a key holding licence will not need to take a qualification.


The situation north of the border
As there's a different qualifications system in Scotland, the new regime will be introduced there later. The new door supervision qualification will be introduced from June 2010, and the other unitised qualifications from September 2010.

Several different types of organisation are involved in the creation and delivery of the licence-linked qualifications. The SIA sets competency standards and specifies qualifications for licensing; The Qualification Regulation Authorities accredit qualifications and approve awarding bodies. Awarding Bodies develop qualifications and operate the examination system against the SIA specifications, approve training and assessment centres, award the qualification and input data into the SIA qualifications database.

segunda-feira, 7 de setembro de 2009

UNIVERSITY ADDS HOMELAND SECURITY GRADUATE-LEVEL

TrackSecurity Director News (09/01/09)
Starting this fall, students at the University of Houston-Victoria will be able to take master's-level courses that aim to prepare them for careers in intelligence, federal law enforcement, and diplomacy. The courses, which will be part of a new concentration in international and homeland security, will cover a variety of topics, including the Koran and the Bible. Courses on those religious texts will aim to give students an understanding of the religious roots of terrorism and insurgent movements over the past 60 years. The courses in the new concentration will also cover techniques that have been used to fight terrorism. Finally, the concentration includes a language component that requires students to complete 12 hours of foreign language classes or to demonstrate proficiency in a foreign language besides Spanish. Students enrolling in the concentration are being encouraged to study Arabic, since demand for individuals who speak Arabic is high in the intelligence and diplomatic fields.
Web Link

METRICS AND MANAGING EMERGENCIES SECURITY

According to John Williams, head of security at Prince William Hospital in Manassas, Va., emergency management planning begins by providing employees with education and training on how to correctly respond and meet challenges to achieve their initiatives. Having an in-depth emergency response plan that covers all potential exposures for an area or sector is helpful. But if these plans are not shared with investors, tested for strength, and audited for improvement, they are a waste of time. To get as much as much data as possible from a security drill, Williams advises security leaders not to tone down distractions. "Build your drills with enough injects to stress your plans, resources, and team to the breaking point and beyond to see if it can stand the surge," he says. The hospital holds at least four major emergency drills once a year, which can include: mass casualty; chemical, biological, explosive, radiological, and nuclear (CBERN) decontamination; infant abduction; weather related (the most likely event); police action, which may involve an active shooter, hostage, barricade, or altercation; lock down; hazardous chemical spill, and others. "When developing an emergency management drill, staff buy-in is greater the more realistic the events leading up to the drill and the actual drill seems to them," Williams adds.
Web Link

quarta-feira, 5 de agosto de 2009

STAFF WHO VIEWED PERSONAL INFORMATION WERE SIMPLY VICTIMS OF "NATURAL CURIOSITY"

By DAN RAYWOOD - SC Magazine
Nine members of staff at local authorities have been sacked for looking at the personal records of friends and celebrities on the government's National Identity Scheme.
A report by Computer Weekly claimed that the nine were among 34 staff who had illegally accessed the Customer Information System (CIS) database that holds the biographical data of the population, and will underpin the government's multi-billion-pound ID card programme.
Brian Cleary, vice president of products and marketing at Aveska, claimed that the sackings were a clear example of the natural curiosity of employees.
Cleary said: “Most of these workplace incidents are not tied to bad intentions, they may just simply be employees taking advantage of a lack of access policy controls at the companies they work at without realising the privacy laws they are breaking and the risk to which they are exposing their organisations.
“Employees at these organisations need to realise the danger that even sneaking a peek at these records can cause to them and their employers. The real fault for these problems is not with the natural curiosity of employees however but rather with the poor controls for how user access is governed at these organisations. To be effective and consistently applied, policies need to be instantiated as a set of automated controls not just in the corporate security policy ring binder.”
Meanwhile Ross Brewer, managing director and vice president of LogRhythm, said: “These findings are not entirely unsurprising. As more inter-connected initiatives such as the Government Connect Secure Extranet (GCSx) emerge, the government has recognised the potential risk of unauthorised access of information and has mandated that protective monitoring solutions are put in place.”
He claimed that local authorities have implemented, or are in the process of implementing, log and event management solutions to allow them to track user and system activity.
“These solutions will mean that organisations are no longer reliant on ‘sample checks' to identify illegal access of information, but instead, will be flagged immediately when inappropriate access has occurred,” said Brewer.

terça-feira, 4 de agosto de 2009

LOYAL EMPLOYEES OR SNOOPING STAFF?

Five steps security managers can live by in protecting sensitive company data from desperate employees tempted to steal secrets.

By Mark Fullbrook

According to figures released in June by the Office for National Statistics, the redundancy total for the three months to April 2009 stood at 302,000 – that’s up 36,000 over the quarter and 191,000 across the year. In fact, it’s the highest figure since comparable records began back in 1995.
However anxious these times may be for employees, with many of them nervously looking round to see where the axe will fall next, employers should not be complacent and expect loyalty in return for a regular pay packet. In fact, the opposite could well be true. As the saying goes: ‘Desperate times call for desperate measures’.
In a recent Cyber-Ark survey entitled ‘The recession and its effects on work ethics’, carried out among 250 office workers in London’s busy Canary Wharf, a staggering 60% admitted they would take valuable data with them (if they could get away with it) were they faced with redundancy or the sack.
Remarkably, 40% confessed to having already snooped around the networks and downloaded sensitive company secrets from under their boss’ nose in anticipation that they could lose their job.
What’s top of the list to be stolen?
Top of the list of desirable information to steal is customer and contact databases, with plans and proposals, product information and access/password codes all popular choices and having a perceived value. That value being either monetary to an unscrupulous third party or as a negotiating tool in securing a new position.
In a separate Cyber-Ark global survey – this time conducted under the title ‘Trust, Security and Passwords’ – involving more than 400 senior IT professionals both in the US and UK (most of them from enterprise class companies), 35% admitted to accessing corporate information without authorisation.
The types of information this audience would target was proprietary data and information that’s critical to maintaining competitive advantage and corporate security. Ominously, one-in-five companies confessed to having experienced cases of insider sabotage or IT security fraud.
When staff steal data and engender a security incident, it tends to be filed away as an example of an ‘employee gone bad’. In reality, it constitutes a failure of the organisation to uphold its responsibility on behalf of the business to manage, control and monitor the power it provides to its employees and systems, or indeed have any controls actually in place to actually manage and control staff from causing breaches.
The failure stems from the ‘perception of control’ an organisation has over their most sensitive networks, systems and devices versus the stark reality that this control is most often not in place across the organisation.
What, then, can be done to protect sensitive data from an increasingly unsettled – and to some extent desperate - workforce?
Trust is not a security policy
To significantly cut the risk of these insider breaches, employers must have appropriate systems and processes in place to prevent prying personnel.
One approach to address this challenge is a privileged identity management holistic approach using solutions such as digital vaults. These are particularly valuable for users with high levels of enterprise/network access as well as those handling sensitive information and/or business processes.
Instead of trying to protect every facet of an enterprise network, digital vault technology creates safe havens – distinct areas for storing, protecting and sharing the most critical business information – and provides a detailed audit trail for all activity associated within these safe havens. This then encourages secure employee behaviour and significantly reduces the risk of human error.
For organisations serious about preventing internal breaches, be they accidental or malicious, there are five steps you can employ to protect company data from desperate employees tempted to steal secrets for gain.
Step 1: Establish a safe harbour
By establishing a safe harbour – or vault – for highly sensitive data (such as administrator account passwords, Human Resources files or intellectual property including corporate databases), security is built directly into the business process independent of the existing network infrastructure. This will help protect the data from the security threats of not only nosy employees snooping around for information they should not be privy to, but also from hackers.
A digital vault is set up as a dedicated, hardened server that provides a single data access channel with only one way in and one way out. It’s protected with multiple layers of integrated security including a firewall, VPN, authentication, access control and full encryption. By separating the server interfaces from the storage engine, many of the security risks associated with widespread connectivity are removed.
Step 2: Automate privileged identities and activities
Ensure that privileged administrative and application accounts (as well as their underlying passwords) are actively managed, secured, changed regularly, highly guarded from unauthorised use and closely monitored. This includes full activity capture and recording.
Once these privileged identities are being managed, make sure to proactively monitor and report actual adherence to the defined policies. Also, adopt the well-accepted security maxim of ‘Trust, but verify’. This is a critical component in safeguarding organisations. It helps to simplify audit and compliance requirements, as companies are able to answer questions associated with ‘who’ has access and ‘what’, exactly, is being accessed.
Step 3: Identify all of your privileged accounts
The best way to start managing privileged accounts is to create a checklist of operating systems, databases, appliances, routers, servers, directories and applications throughout the enterprise.
Each target system typically has between one and five privileged accounts. Add them up and determine which area poses the greatest risk. With this data in hand, organisations can easily create a plan to secure, manage, automatically change and log all privileged passwords.
Step 4: Secure embedded application accounts
Up to 80% of system breaches are caused by internal users, including privileged administrators and power users who accidentally or deliberately damage IT systems or release confidential data assets.
Many times, the accounts leveraged by these users are the application identities embedded within scripts, configuration files or an application. The identities are used to log into a target database or system. The fact that these credentials are traditionally hard-coded, in clear-text and usually never changed is often overlooked within a traditional security review.
Even if located, the account identities are difficult to monitor and log because they appear to a monitoring system as if the application (not the person using the account) is logging in.
These privileged application identities are being increasingly scrutinised by internal and external auditors, especially during PCI- and Sarbanes-Oxley driven audits, and are becoming one of the key reasons that many organisations fail compliance audits.
Therefore, organisations must have effective control of all privileged identities – including application identities – to ensure compliance with audit and regulatory requirements.
Step 5: Avoid bad habits
To better protect against snoopers, organisations must establish Best Practice for securely exchanging privileged information. For instance, employees must avoid bad habits (such as sending sensitive or highly confidential information via courier).
IT managers must also ensure they educate employees about the need to create and set secure passwords for their computers instead of using sequential password combinations or their first names. We don’t want to make life easy for would-be thieves.
The risk of internal data misuse from snoopers can be significantly mitigated by implementing effective policies and technologies. In doing so, organisations can better manage, control and monitor the power they provide to their employees and systems and avoid the negative economic and reputational impacts caused by an insider data breach.
It would be unthinkable to leave money on a desk. That’s an obvious temptation to anyone passing by. Instead it’s always safely locked away. The time has come for companies to give sensitive information and key systems the same consideration. As always... ‘Trust... but verify’.

Mark Fullbrook is the UK director of Cyber-Ark Software

domingo, 19 de julho de 2009

WHAT'S NORMAL IN SECURITY AWARENESS EDUCATION FOR GENERAL EMPLOYEES?

Security Director's Report (07/09) Vol. 2009, No. 7

New research on corporate security spending, administered by IOMA, indicates that firms spend a negligent amount on security awareness on a per-employee basis. It is likely that money for it will be in short supply in the near future, so implementing strategies that imbue the awareness program with the most value at the smallest cost is crucial. Some tips on getting the most bang for the buck: Standardize the program by giving it a goal, creating strategies to accomplish it, and performing regular assessments to test its effectiveness. Work toward pushing employees to embrace security as an individual responsibility. Involve senior management team members in the process, and ask them to sign off on a summary statement that the security department can use to introduce its comments. Take time to form a relationship with the audience, and devote the time and effort to making a high-quality, persuasive presentation. New hires will probably not remember every detail of the presentation, but they will cultivate an attitude relating to whether security at their new place of business is worth their attention. Deborah Russell Collins, executive director of the National Security Training Institute and former instructor of security awareness at TRW, says to that end, security's aim during new-hire orientations should be addressing employees' needs instead of inundating them with more responsibilities. Finally, give a fair presentation that underscores that all people are different and caters to a number of individual learning styles.

quarta-feira, 15 de julho de 2009

PROBITY, COMPETENCY AND SECURITY CONSULTING


By David Gill
The Association of Security Consultants’ chairman Roy Sutherland, his business partner Chris Roberts and I discussed the whole question of consultant licensing at IFSEC, with SMT Online’s Editor Brian Sims serving as an interested umpire.
Having listened to each other’s points of view, it’s fair to say we concluded our deliberations with a warm and friendly handshake, and then duly agreed to differ on a number of key points.
Of course, the Private Security Industry Act 2001 clearly sets out the categories to be licensed. Both Roy and Chris consider it was the legislator’s error to have included security consultants in its future plans.
While Roy and Chris are resolutely against the notion of licensing security consultants, I take a contrasting view. However, one key area where we all do agree is that the Security Industry Authority (
SIA) has failed – and continues to fail – in grasping the consultant nettle.
Controlling those who would advise
In my view, there simply has to be a means of controlling those who deliver security advice. We should follow the established and widely recognised professions – among them the law and accountancy – whose overseers demand that individuals must possess a recognised certificate in order to practise.
Key elements for such professionals include formal academic qualifications (and not a reliance purely on practitioner experience), formal Continuing Professional Development (CPD) structures, professional indemnity insurance and current membership of a recognised professional body (one that’s empowered to suspend licences to practice if it deems that course of action to be necessary given certain circumstances).
Some of you will be aware that I’ve just completed a Masters degree in Security Management at Loughborough University. My chosen dissertation subject was: ‘What is a security consultant, and what controls are in place to guarantee an acceptable level of expertise?’
An integral part of the research was obtained through an online survey. This was sent out to the main UK private security membership organisations, regulatory and training bodies, academics in the field of security, end users and deliverers of security consultancy services as well as business professionals with no direct link to the security sector.
The survey questions were complied by working in collaboration with a select number of high profile security practitioners and academics, all of whom were asked to contribute one question they felt was relevant to the title of the research.
Such was the level of response to the survey (many respondents submitted more than one question) that it was impractical to include every question. However, those questions not used in the main online survey proved very useful during subsequent one-to-one interviews.
My survey attracted responses from almost 200 individuals, whereas the SIA received 89 responses from a similar consultation exercise conducted in May 2007.
Arguments to support the view
As Roy and Chris correctly pointed out in their article, the Regulator has adopted the view that says: “There is little or no evidence of risk to the public from consultants not being regulated”. By contrast, 64% of respondents to my survey disagreed with the SIA’s view, while a further 78% were of the opinion that security consultants ought to be licensed.
From my perspective there are two strong arguments supporting these majority views. First, by failing to regulate consultants, unscrupulous or simply inept operators can exploit current legislation to undertake security-related activities under the label of them being a ‘security consultant’.
Second, the public can in many instances be directly and adversely affected by poor security advice provided by an inadequately qualified individual. Obvious examples include organisations supplying goods or services to the public, such as banks, retail outlets and event organisers.
There remains widespread concern within the private sector and among law enforcement agencies that anyone – regardless of their background, experience or qualifications – can lawfully advise, specify or consult on security matters. Indeed, the overall consensus from interviewees and survey respondents was that the SIA is wrong to suspend licensing of security consultants.
The absence of security consultant licensing has created a vacuum, and presents opportunities for unsuitable individuals to exploit what is clearly a legal loophole.
Many of the respondents to my survey provided optional free text comments, deriding the SIA for its perceived feebleness, indecision and what some regarded as ineptitude caused by weak leadership and a failure to understand the sector. Strong views indeed.
We’re told it’s all about definitions
My research also exposed significant uncertainty on the issue of defining a security consultant. Indeed, for some within the UK security consulting sector reaching a consensus on defining a ‘security consultant’ is akin to discovering the sector’s ultimate Holy Grail!
While defining the term ‘security’ was to a large extent not overly problematic, by contrast attempting to define the term ‘consultant’ was particularly difficult. It also exposed a fundamental problem, in that most traditional definitions merely refer to consultants as those engaged in a specific area of medicine.
However, Wikipedia lists a number of unusual – some might say bizarre – types of consultant but, you’ve guessed it, there’s no mention of a ‘security consultant’. Other than medicine, as a general rule the term ‘consultant’ tends to be associated with a person having expertise in a specific subject – not a generalist.
So would it not make life a little easier when it comes to trying to define what a security consultant is to actually drop the word consultant and replace it with either advisor or practitioner?
The average text book on security will list numerous specialist areas such as access control, biometrics, policy and procedures, crisis management, IT security, risk assessments and so on. Take the person who sells CCTV systems. Often, they will market themselves as a security consultant, but what is the extent of their knowledge and qualifications aside from technological specifics related to products or systems?
What does this CCTV security consultant know about the vetting of staff and prospective trading partners, risk management, employment law and the importance of the privacy laws (most notably the Human Rights Act)? The list is endless, and those of us involved in the delivery of security consultancy services know it.
Core skills and knowledge pinpointed
I believe core skills and knowledge should be identified by the SIA, in conjunction with the leading industry sector bodies (in particular The Security Institute and the Association of Security Consultants). The aim must be to identify a ‘general security practitioner’ – or, if you prefer, a ‘general security advisor’ – qualification and seek to amend the Act accordingly.
As is the case with the ASC, which presently has 80 members on its books, The Security Institute promotes the raising of standards across the wide spectrum of security disciplines. The Institute has made it clear it aims to seek Chartered status but, in order to achieve this goal, the Privy Council has indicated current membership will need to triple to 3,000 (and 75% of that cohort must hold a first level degree or equivalent).
We have some way to go, but with The Security Institute’s introduction of a new category of membership for students, together with mentoring opportunities and the Institute’s Certificate and Diploma in Security Management (delivered by Perpetuity Training), the tanker is turning in the right direction.
Emboldened by the Institute’s example, I very much hope that smaller specialist groups will look to become a part of a constellation of security professionals, and that the SIA reconsiders its position on the issue of consultants such that the existing legal loophole may be closed.
Licensed to practise: how might it happen?
How would someone become licensed to practise as a general security practitioner or general security advisor? Based on my own experience of over 30 years, supplemented by this latest and very extensive research, I believe the key requirements are:
a security consultant (advisor/practitioner) qualification set at a minimum of Level 4
adherence to a formalised CPD framework
membership of a recognised body (such as The Security Institute or the ASC) that has a strict validation process
a Code of Ethics and disciplinary procedures that include the power to suspend or revoke a licence to practise
In the Australian state of New South Wales, co-regulation has been adopted with their equivalent of the SIA devolving inter alia inspection powers to the main sector membership body. This system reportedly works very well indeed.
I believe we can learn from other sectors, and not just from the engineering model proposed by Roy and Chris. The answer is to select the best and most appropriate elements from a number of other entities.
The approach adopted by the Centre for the Protection of National Infrastructure (CPNI), which operates a register of qualified security professionals (interestingly managed by the Institute of Chartered Engineers), is one good example. The CPNI has identified core areas of expertise aligned with experience, appropriate qualifications and CPD which differentiate members of its Register as being either a specialist security advisor or general security advisor.
There are also lessons to be learned from the way in which accountants and lawyers qualify – a system whereby trainees follow a prescribed course covering the essential elements of the subject followed by examination and, thereafter, a two-year work experience period played out under supervision. It’s only after the completion of this supervisory period that the lawyer or accountant is eligible to provide advice to clients.
An unmanageable and unrealistic goal
Attempting to include the myriad of ancillary security disciplines such as CCTV specifiers and electronic counter-measures operatives (‘bug’ detecting) within regulatory controls is unmanageable and unrealistic. Their exclusion would greatly simplify attempts to define a security consultant (or general security advisor/practitioner).
Ancillary service providers would be required to meet agreed industry standards and Codes of Practice, but without the need to be licensed. Accountability of the service provider in a specific trade or expertise would be the responsibility of the licensed general security practitioner.
For example, CPNI registrants can in certain circumstances engage others on their behalf if they are satisfied the contractor possesses the relevant competency and experience, with the registered advisor being responsible for the sub-contracted party.
By engaging a ‘cowboy’, the registrant runs the risk of being removed from the CPNI register and disqualified from tendering for public sector contracts – a powerful reason to ensure sub-contractors are competent and fit for purpose.
Roy and Chris believe security consultants stand “shoulder to shoulder” alongside Chartered bodies such as surveyors, engineers, accountants, architects and so on. I disagree. We need to bring our sector into the 21st Century if security consultancy (and indeed the various specialist services that fall under the security industry umbrella) is to be considered a recognised and highly respected profession.
Probity and competency must be shown
If we want to be taken seriously, probity and competency have to be demonstrated, not assumed. Like it or not, this industry does not have the same status as the established professions. The requisite professional frameworks are not yet in place.
To reiterate, those delivering security consulting services must possess a recognised qualification alongside the other core elements that established professions require. These include formalised CPD, significant experience (a minimum of two years), membership of a recognised professional body, adherence to a strict code of professional ethics and the requirement for practitioners to have professional indemnity insurance cover.
Sounds good doesn’t it? However, without these requirements we run the risk of remaining inward-looking, fixated with pseudo self-regulation and acceptance, as is so often the case, of a first career in the military or the police as the primary requirement to justify the label ‘security consultant’.
I fully accept that, in many cases (yet certainly not all), those who have served in law enforcement or the military possess some excellent transferable skills, but in this day and age that alone is insufficient.
As one senior member of the ASC remarked during my recent research: “Security consultants should have nothing to fear from regulation”.
Regulation surely has to be seen as one of the essential steps towards acceptance of security consultancy as a true profession.

David Gill is managing director of Linx International (Corporate Security Services) and vice-chairman of The Security Institute

terça-feira, 30 de junho de 2009

EL COSTO POTENCIAL DE LA OPERACION DE SEGURIDAD


Si no se tiene el personal idóneo, las pérdidas pueden ser irreparables

por José Luís Romero*

Algunas experiencias en la región dan cuenta de la poca formación y profesionalismo con que se manejan y operan los más altos y sofisticados sistemas de seguridad de los edificios inteligentes.
¿Llevarías tu Mercedes Benz último modelo con el maestro de tuercas del taller mecánico de tu vecindario? Nadie en su sano juicio contestaría con un enfático “sí” a esta pregunta. Sin embargo, esto es precisamente lo que está sucediendo con los mejores sistemas de seguridad integral que existen en el mercado para los inmuebles inteligentes.Dadas las condiciones y necesidades de los edificios contemporáneos, los mejores sistemas de seguridad centralizan la información para poder tomar acciones correctivas, tanto con asuntos administrativos como con asuntos de seguridad. Es por ello que estos sistemas de seguridad cuentan con una plataforma con la capacidad para integrar todos los subsistemas que componen el inmueble:
Sistemas de seguridad (intrusión, acceso, CCTV)
Sistemas de detección de incendio
Sistemas eléctricos
Sistemas hidráulicos
Sistemas de comunicación (voz y datos)
Sistemas de iluminación
Sistemas de calefacción y aire acondicionado
Sistemas de transportación
Sistemas de automatización
Conocimientos apropiadosAsí como los ingenieros mecánicos que trabajan en las agencias Mercedes Benz tienen las habilidades requeridas para trabajar con un automóvil de lujo último modelo, los operadores de sistemas de seguridad en estos inmuebles inteligentes deben tener el conocimiento apropiado para manejar estos sofisticados sistemas de seguridad integral. Desafortunadamente en la mayoría de los casos no es así.
Para poder desarrollar su trabajo de una manera efectiva, un operador de un sistema de seguridad integral de un inmueble inteligente –– debe de tener estas habilidades:
Tener conocimientos generales satisfactorios en el manejo de equipo de cómputo.
Tener la capacidad de identificar situaciones de riesgo – tanto fuera del inmueble como dentro del inmueble – ya sean amenazas naturales (inclemencias del tiempo) como amenazas ocasionadas por el ser humano (vandalismo, sabotaje, actos terroristas, etc.)
Tener el criterio analítico para distinguir entre las situaciones críticas que es necesario aceptar, y las situaciones de riesgo que pueden ser contrarrestadas vía procesos específicos diseñados para evitarlas.
Debe tener la capacidad y la iniciativa para analizar y explotar la información recopilada por el sistema (archivos de eventos históricos) para mejorar procesos de seguridad existentes, o para implementar nuevos procedimientos – ya que los inmuebles son entes cambiantes.Cuando el operador de un edificio inteligente no tiene la capacidad adecuada para manejar el sistema de seguridad del inmueble en el que trabaja, las consecuencias pueden ser potencialmente desastrosas y sumamente costosas como las que se detallan a continuación:
Sumas considerables de dinero desperdiciadas: se desaprovecha casi en su totalidad la compra millonaria del equipo de seguridad.
Vulnerabilidad: a pesar de contar con un sistema de seguridad de punta, el inmueble y la gente dentro del inmueble se expone a robos, vandalismo y sabotaje, tanto dentro como fuera de las instalaciones.
Pérdidas irreparables: muertes humanas como consecuencia de la ejecución deficiente de los procedimientos de seguridad en un atentado o en una catástrofe natural que no tienen precio.
Pérdida de credibilidad: cualquiera de los puntos anteriores repercute en pérdida de imagen de la institución. Por ejemplo, un banco saqueado con toma de rehenes, una farmacéutica saqueada para obtener materia prima para drogas, un estadio amenazado por un acto terrorista donde cunde el pánico masivo,entre otros.
Una experiencia positiva
A modo ilustrativo y como contraste, veamos lo que ha pasado en los países industrializados, en la Gran Bretaña por ejemplo: Hasta hace algunos años – hasta antes del 2004 – cualquier persona podía trabajar en la industria de seguridad privada, incluyendo a personas con antecedentes penales, o sin ninguna capacitación para hacer su trabajo adecuadamente. Por lo mismo, esta industria tenía una reputación pobre y muy poca gente la veía como una opción para hacer una carrera que valiese la pena. El público, el gobierno y la industria misma reconocieron que era necesario retirar al personal con antecedentes penales y elevar los estándares profesionales. Se creó un Acta de la Industria de Seguridad Privada y la figura de un regulador en esta Industria que se avocara a darle una solución a esta situación. Desde entonces, algunos de los beneficios de esta regulación incluyen:
Mayores niveles de profesionalismo y de integridad
Reducción en la rotación de personal
Una relación más estrecha con el gobierno en cuanto a esfuerzos coordinados de seguridad nacional
El ABC del puesto de operador
¿Qué podemos hacer nosotros por nuestra parte, sin estar esperando pasivamente hasta que sea creado un organismo regulador? ¿Qué puede hacer la organización de una manera activa para asegurarse de que sus operadores tengan las habilidades y las cualidades necesarias para desempeñar de una manera efectiva este trabajo? La respuesta es muy sencilla:
Inicialmente, es indispensable hacer una lista de las funciones esenciales del puesto de operador de seguridad. Las funciones esenciales son los quehaceres básicos que son primordiales para un desempeño apropiado en el puesto.
Una vez que se sabe cuáles son las funciones del puesto, entonces se hacen explícitas las habilidades y las cualidades necesarias que el operador debe poseer para poder desempeñar satisfactoriamente dichas funciones.
Y una vez que se tienen las habilidades y cualidades necesarias para desempeñar las funciones del puesto, entonces se pueden hacer dos cosas según sea el caso.En el caso de que ya se tenga al operador de seguridad contratado:
Se determina la brecha entre las habilidades y cualidades que tiene el operador y las habilidades y cualidades requeridas por el puesto.
Una vez que se determina esta brecha, se pueden desarrollar programas de capacitación adecuadas para el operador.Y en el caso de que se vaya a contratar a un nuevo operador de seguridad:
Todo lo que hay que hacer es asegurarse de que el proceso de selección y contratación nos garantice que el candidato a contratar tenga efectivamente las habilidades y cualidades requeridas por el puesto.Realmente no vale la pena depositar una inversión millonaria de seguridad en las manos de personas deficientemente capacitadas. Sobre todo cuando la solución a esta situación es tan sencilla y cuando los riesgos, las consecuencias y los costos son tan altos.

*José Luís Romero es especialista en la construcción de culturas de alto desempeño con una ventaja competitiva sustentable a través del desarrollo de liderazgo. Para contactarlo visite: www.Skills2Lead.com

SEGURIDAD PARA LOS MAS DEBILES


Tal vez una de las más admirables labores de la humanidad es cuando logra que la tecnología esté al servicio del hombre, pero especialmente, de los más débiles y necesitados.
Y en estos tiempos modernos, la salud ha estado en la mira de diferentes sectores involucrados con la seguridad.
Recientemente leía con interés el experimento que una compañía aseguradora realizó cuando diseñó un traje que simulaba las limitaciones de las personas mayores al conducir.
Dicho traje constaba de lentes, vestidos, guantes y diferentes objetos que limitaban los sentidos, movimientos y reacción del conductor, de la misma forma como limita a las personas de la tercera edad.
“Ponerse en los zapatos del otro” fue una buena forma de entender hasta dónde está capacitada una persona mayor para hacer las actividades cotidianas.
Tal vez por esta misma razón, un segmento que crece aceleradamente en algunos mercados es el de los dispositivos de
tele salud y el de los PERS (Personal Emergency Response System, o “Sistema de Respuesta a Emergencias Personales”).
El primero consiste en una serie de dispositivos que le permiten a los médicos rastrear la salud de sus pacientes.
Se trata de dispositivos inalámbricos que automáticamente envían estadísticas cuando sus pacientes han medido su presión arterial, peso, etc.
En mercados como EE.UU. compañías de telecomunicaciones como
AT&T ya están sacando ventaja de esta tecnología y están ofreciendo los servicios de tele salud como parte de su portafolio gracias a alianzas con las empresas fabricantes de los dispositivos.
La tele salud es presentada como la próxima generación del cuidado de la salud. Además de los dispositivos, el sistema se basa en un software que permite monitorear los signos vitales del paciente sin ningún contacto físico.
En el caso de los PERS, el uso de sensores inalámbricos en el lugar de habitación permite que los patrones de la salud puedan ser rastreados y transmitir información sobre su estado y posibles emergencias a un comunicador.
Pero aquí no termina todo. Las instituciones de salud como clínicas y hospitales están sacando ventaja de la tecnología disponible para asegurar también la salud e higiene, no sólo de pacientes sino también de sus empleados.
Un
Sistema de Cumplimiento con la Higiene de las Manos fue presentado recientemente como una solución que emplea tecnología RFID e IR (infrarroja) para controlar los hábitos de higiene del personal en el hospital.
Y llevando el tema de la seguridad en los hospitales a una dimensión más especializada, las instalaciones pediátricas cuentan ahora con
sistemas de avanzada específicamente diseñados para garantizar la integridad de los pacientes más pequeños.
Sin embargo no todo es color de rosa para este segmento: la integración de los diferentes dispositivos y tecnologías disponibles continúan siendo el principal reto.
Sin embargo, hay buenas noticias. Por ahora, ya este segmento cuenta con una alianza que reúne a alrededor de 200 compañías de tecnología y salud para establecer soluciones que operen entre sí y poder extender el bienestar y la seguridad a más personas. Una buena forma de asegurar el negocio y la seguridad de los pacientes.



Lyda Durango
lyda.durango@alas-la.org

Editora Zona de Seguridad

terça-feira, 16 de junho de 2009

EVOLUTION OF CSO


From incident reaction to proactive risk assessment, the CSO role has evolved dramatically. Next stop: new services and business operations intelligence.

By Joan Goodchild, Senior Editor

It's been almost 15 years since David Kent first came to Genzyme, a biotech firm headquartered in Cambridge, Mass., that develops medical treatments for ailments such as certain genetic diseases and some forms of cancer. In 1994, the company had less than $200 million in sales, and only about 1,000 employees—a stark contrast to its worldwide workforce of 11,000 today and the $4.6 billion in revenue it reported in 2008.
Kent's first experience with Genzyme was as a consultant. The company had lost some of its
intellectual property through a theft, and Kent—then working for Bolt Beranek and Newman as a security manager—was called in to help evaluate the situation. His work with the firm grew into a job offer to be Genzyme's director of security. The goal was to have someone aboard with an intense focus on the security position of the organization to prevent other thefts from occurring.
"At that time, I think there were about nine different
card access systems. One person was handling their voice and data and their office services," says Kent. "It was an organizational design reflective of a rapidly growing business. There was no thought put into security, it was a lower priority. It was sort of a barren landscape from my viewing."
His first project was to look at the situation around laboratory and notebooks in order to ensure there would not be a repeat theft incident. After that, he moved on to assessing the physical security of the building and addressing the multiple card reader situation by implementing a single card solution. Kent and his team began pushing for security standards around the corporation, slowly picking away at information systems security challenges as well. It was a forge-ahead and forward-thinking philosophy for security that had not been seen before in the firm.
"Left to its own devices, we wouldn't have the program we have today. We would have separate silos. There had to be someone in the organization to drive this stuff."
As the company grew, more emphasis was placed on security. But it was the Bio International Exposition held in Boston in 2000 that gave Kent the perfect opportunity to show how his department could go beyond reactive protection to proactive security.
"It was the first major East-coast meeting following WTO [the World Trade Organization meeting] in Seattle. The members of the Genzyme senior management team were the chairs for the meeting in Boston. We were asked to coordinate security around the meeting. There were about 14,000 people expected in for this event, and demonstrators could shut down the show." Kent says for several months he talked with area law enforcement agencies and other companies that might be targeted for demonstration and urged them to prepare. By the time the event arrived, Genzyme security officials had coordinated the work of 80-plus agencies and was holding regular meetings with multiple organizations.
(See another case study on event security planning, in this profile of Boston's 2004 Democratic National Convention.)

quarta-feira, 10 de junho de 2009

FRENCH SUBMARINE BEGINS BLACK BOX CRASH SEARCH


By Gerard BonReuters Wednesday
PARIS (Reuters)
A French submarine with advanced sonar equipment began searching on Wednesday for the flight recorders of an Air France airliner that crashed into the Atlantic last week, the French military said.
The nuclear-powered submarine Emeraude was sent to the area to hunt the "black box" recorders, which may help explain the disaster and which are believed to lie on the ocean floor.
Investigators face a long search for clues to what went wrong when the Airbus A330 jet disappeared on a flight from Rio de Janeiro to Paris killing all 228 people on board, French military spokesman Christophe Prazuck said.
"Up to now, the time frame for the search for victims and debris has been of the order of days or a week. Here, at the very least, it's going to be of the order of weeks or months," he told LCI television.
The Air France flight is believed to have run into trouble when it hit a violent storm midway over the Atlantic Ocean and potential problems with speed sensors have become one of the focal points of the inquiry.
But other causes have not been ruled out and on Wednesday, the web site of the French weekly L'Express said that two potentially suspect names had been identified on the passenger list by French intelligence services.
It said the names "correspond to people known for their links to Islamist terrorism," but a French military spokesman said he could not confirm the report.
Authorities have seen no credible claims of responsibility and have said the crash was unlikely to have been caused by an attack but they have not excluded one entirely.
In the search zone, where scattered pieces of debris including a large section from the aircraft tail have been recovered, vessels are trying to comb a rugged area of the ocean floor, thousands of meters below the surface.
Prazuck said searchers had taken two weeks to locate the black box recorders after the crash of a Boeing 737 at Sharm el Sheikh in
Egypt in 2004, despite much easier conditions.
"That aircraft crashed very close to the coast, there was no doubt about where the accident happened and it took 15 days to recover the black box," he said. "Here the accident happened 1,000 kilometers from the coast. The situation is very complex."
He said the Emeraude was searching an area of 36 square kilometers and the search zone would be changed daily.
If the recorders are found, miniature submarines from the Pourquoi Pas, a French exploration and survey ship also deployed to the area, could be used to bring them in.
Brazilian military search teams have recovered 41 bodies and moved some of them to the archipelago of Fernando de Noronha off
Brazil's northeastern coast, which is being used as a base for the search operations.
The doomed plane sent 24 automated messages in its final minutes on June 1, detailing a rapid series of systems failures.
The speed sensors that gauge how fast an aircraft is flying have become the focus of the investigation after some of the messages showed they provided inconsistent data to the pilots.

(Writing by James Mackenzie; Editing by Charles Dick)

quarta-feira, 3 de junho de 2009

INSEGURIDAD INFORMATICA

por Jose Camilo Daccach T.
¿Puede darse el lujo de perder el acceso y toda su información?

Hemos seguido de cerca las tendencias de uso de las tecnologías informáticas y de comunicaciones durante nuestra carrera profesional, y a pesar de ser este nuestro oficio, no dejamos de asombrarnos con algunas de las aplicaciones que van surgiendo a medida que la tecnología gana ubicuidad.Desde el punto de vista de la información en si misma, la premisa es que el usuario debe poder acceder a la información que necesita, cuando la necesita, y en la forma en que la necesita, sin importar de donde y con qué dispositivo. La tecnología no ha sido menos para este reto y hoy tenemos múltiples dispositivos de conexión, desde un PC poderoso, hasta un minúsculo celular, pasando por las PDA's y demás elementos en el intermedio. Es claro, por el avance de estas tecnologías, que cada día nos sorprenderán con un anuncio nuevo, que hará esta tarea aún más fácil.Por otra parte, las tecnologías que Internet ha ayudado a desarrollar, como la Web, la telefonía por IP y otras similares, permiten que los departamentos encargados de desarrollar las herramientas informáticas tengan acceso a estas tecnologías y las puedan implementar en forma relativamente fácil. Esto cuando las aplicaciones que producen la información están en nuestra empresa.De la misma manera tenemos la posibilidad, con los movimientos que se vienen gestando hace varios meses, de tener nuestra información en la Web, bien sea en servidores de archivos donde simplemente podemos guardar una copia de nuestra información para cuando la requiramos, o en sistemas enteros basados en la Web en los cuales ni siquiera conocemos cómo opera este almacenamiento. El uso del correo electrónico en la Web (Gmail o Hotmail), el uso de las aplicaciones de Mensajería Instantánea, como el Internet Messenger o el Google Talk, la utilización de hojas electrónicas y documentos en Writely o Google Spreadsheets, implican el almacenamiento de alguna o toda la información en servidores que no conocemos. Prestan un servicio increíble, y adicionado a la posibilidad de unir muchas herramientas como la Pizarra o Compartir Aplicaciones en el Messenger, permiten el trabajo en grupo que desde hace mucho rato venimos oyendo genera sinergia y permiten que uno mas uno sea tres, pero que a la fecha no se había podido concretar en algo mostrable.Esto avanza a pasos agigantados, con muchas manos en el proceso, desde el usuario final que quiere que su lista de contactos esté en la Web, compartirla con su agenda electrónica, el celular y el correo en la Web, hasta el programador en la empresa generando sistemas que permitan colocar a tiempo y con calidad la información corporativa requerida por los usuarios. Son muchos los que intervienen, un proceso difícil de detener.Sin embargo, se nos olvidan algunos grados de riesgo que se van incorporando, cuando no tenemos "control" sobre la información fuera de nuestro "perímetro de seguridad", es decir, cuando se "pierda" la información de contactos en la Web, o cuando esa hoja de cálculo con la cual los vendedores cotizan a nuestros clientes ya no esté más, ¿tenemos algún procedimiento que permita recuperar esa información?Muchos de los correos que los empleados bajan en sus dispositivos móviles, si no están bien configurados, terminarán borrados para dejar espacio a los siguientes, sin la debida precaución de guardar copias en el servidor. Los documentos creados en el procesador de palabra en la Web tampoco estarían disponibles si el servidor del proveedor decide "estar fuera de línea, estamos trabajando fuertemente para reestablecer el servicio, perdone el inconveniente" o simplemente su conexión a Internet no funciona.Ya la seguridad deja de ser solo el cuidar que no accedan a información confidencial de la compañía las personas que no deben hacerlo, sino también garantizar que quienes requieren acceder a la información lo puedan hacer, sin tiempos de recuperación, sino en tiempo real. Se hace indispensable proteger la información que se genera fuera del perímetro de control de la compañía, mediante procedimientos que permitan por lo menos recuperar la que es sensible. Decidir no participar de esta "nueva forma de trabajar" donde ya no requerimos muchos recursos informáticos en forma local, sería como querer tapar el sol con un dedo, pero no podemos participar irresponsablemente.

quarta-feira, 20 de maio de 2009

TO CATCH A THIEF

Risk Management (05/09) P. 40 ; Bellinger, G. Michael

When dealing with a potential embezzlement case, it is not always wise for companies to immediately call the police and fire the employee who is believed to have participated in the theft, since doing so can often result in internal scrutiny and negative publicity, which in turn can hurt employee morale and the company's reputation. Instead of immediately calling law enforcement and firing the employee suspected of the embezzlement, companies that believe that one or more of their employees may have stolen money from them should immediately launch an investigation into the suspected theft. The investigation should be conducted by outside counsel rather than the company's general counsel or others. During the investigation process, outside counsel should interview the suspect and try to get them to admit to the theft--something that can be easily done when proper, legal interrogation methods are used. After investigators obtain an admission of guilt from the suspect, they should then try to determine how much money was stolen, how much remains of what was embezzled, and the total value of the assets the employee owns free and clear. Work should then begin on restoring what the company lost. This can involve negotiating with the employee for the return of the stolen assets, as well as negotiations with the suspect's family members, who may be willing to help make the company whole again. These family members may be willing to help if the company promises not to go public with the theft. Companies may still need to notify police about the theft, particularly in the event their investigation does not result in the closure of the case. Notifying law enforcement is necessary if companies want to make a claim with their insurance company.(
go to web site)

quinta-feira, 16 de abril de 2009

CREAN SISTEMA DE IDENTIFICACION FACIAL PARA SEGURIDAD BANCARIA


(Instituto Biométrico de Reconocimiento Facial), creado en España y con presencia en Nueva York, desarrolló un software de biometría por reconocimiento facial, afirmó el portal www.biometria.gov.ar
Con esta tecnología, la cara se convierte en la llave de acceso que permite a cada usuario operar por internet, sin el riesgo de la suplantación personal con sus datos o que se hagan con la clave de acceso mediante prácticas de fraude.
“Nuestro software elimina la necesidad de claves de acceso, utilizando tecnologías de reconocimiento facial que son virtualmente imposibles de suplantar y a un costo inferior a otras soluciones de biometría”, explicaron los creadores del proyecto.En algunos bancos se han realizado ya pruebas con otros sistemas de biometría como la dactilar o el iris, pero sin fructificar, ya que es más compleja para los usuarios por necesitar dispositivos, que en el caso de la lectura de ojos, se hace todavía menos viable por su encarecimiento económico.La nula inversión que requiere el invento de F7 es lo que le hace más atractivo a la hora de estudiar su implantación. "Nuestra aplicación se cimienta en la inteligencia artificial y redes neuronales, que es lo que nos hace únicos", asegura Salvador Martí, uno de sus creadores.

segunda-feira, 6 de abril de 2009

POR QUE OS PROCESSOS SAO IMPORTANTES


Por José Ernesto Lima Gonçalves*
O futuro vai pertencer às empresas que consigam explorar o potencial da centralização das prioridades, ações e recursos nos seus processos. As empresas do futuro deixarão de enxergar processos apenas na área industrial e serão organizadas em torno de seus processos não fabris essenciais e centrarão seus esforços em seus clientes. Os processos industriais, especialmente os de manufatura, sempre tiveram seu desempenho acompanhado de perto pelas legiões de engenheiros de produção e técnicos da área industrial. Os processos típicos da área não fabril e das empresas que não têm área fabril, no entanto, passaram despercebidos por décadas.Parte do sucesso que as empresas japonesas tiveram com relação às suas concorrentes americanas nas décadas de 80 e 90 decorreu do fato de terem as empresas japonesas descoberto (ou pelo menos implementado) o gerenciamento de processos muito antes das empresas ocidentais entenderem a que o assunto se referia. O papel de destaque dado ao gerenciamento de processos na cultura corporativa japonesa garantiu que, em diversas ocasiões, muitas empresas daquele país tenham desenvolvido processos rápidos e eficientes em áreas chave como desenvolvimento de produtos, logística, vendas e comercialização.A utilização do conceito de processos nos fornece um conveniente nível de análise, menos detalhado que o do estudo do trabalho, mas muito mais descritivo que o modelo da “caixa preta”. Além disto, nos permite ter uma visão melhor do comportamento gerencial, mais integrada e abrangente. É indispensável também para permitir a análise adequada dos processos administrativos e gerenciais, tão importantes para o funcionamento dos processos essenciais da organização.A definição dos processos básicos é essencial para algumas estratégias de aperfeiçoamento do funcionamento das empresas, já que grupos de recursos serão alocados a eles, tanto para execução como para gestão. Os times horizontais, por exemplo, são criados a partir de unidades que naturalmente se aproximam para completar uma parte do trabalho a ser feito ou um processo dentro da empresa.Identificar o processo como a maneira típica de realizar o trabalho é importante para definir a forma básica de organização das pessoas e demais recursos da empresa. O processo é um conceito fundamental no projeto dos meios pelos quais uma empresa pretende produzir e entregar seus produtos e serviços aos seus clientes. Além disto, muitos dos processos nas empresas são repetitivos e envolvem, no seu conjunto, a maioria das pessoas da organização. Os processos são a fonte das competências “específicas da empresa” que fazem a diferença em termos de concorrência, além da influência que podem ter a estratégia, os produtos, a estrutura e a indústria. Os processos não criam apenas as eficiências de hoje, mas também garantem o futuro por meio de habilidades que se aplicam aos novos produtos. A rápida inovação dos processos pode resultar em capacitações organizacionais melhoradas que permitem, por exemplo, que os novos produtos sejam desenvolvidos mais rapidamente. É conhecido o caso das empresas industriais japonesas, que investiram 70 % dos seus fundos de Pesquisa e Desenvolvimento (P&D) em inovação de processos ao contrário das americanas, que investiram essa mesma proporção, mas no desenvolvimento de produtos. Os resultados muito superiores da indústria japonesa durante o período considerado, provavelmente, refletem as consequências dessa decisão.Nas empresas de serviços, por exemplo, o conceito de processo é de fundamental importância, uma vez que a sequência de atividades nem sempre é visível nem pelo cliente, nem por quem realiza essas atividades. Para o pessoal de serviços, os processos são sequências de atividades que são necessárias para realizar as transações e prestar o serviço. A importância dos processos de trabalho aumenta à medida que as empresas ficam com conteúdo cada vez mais intelectual ou nas empresas de conteúdo puramente intelectual, afastando-se do modelo fabril. No caso dos serviços, o tratamento dos processos é indispensável para o aperfeiçoamento significativo da qualidade do que é oferecido e dos resultados obtidos, pois é o que garante uma abordagem objetiva e prática dos serviços prestados.Uma das mais importantes aplicações da ideia de processos é a simulação do funcionamento de novas formas operacionais de obtenção dos resultados da empresa, sejam eles produtos, sejam conquistas de qualquer outro tipo. Em projetos de redesenho de processos, por exemplo, uma das etapas de trabalho é o teste do protótipo do processo que está sendo redesenhado. Outra aplicação importante ocorre na implementação das mudanças previstas para a operacionalização de um novo processo. O sucesso do novo desenho para o processo depende fundamentalmente da sua operacionalização e o desenho do processo é o “blueprint”, o mapa essencial do caminho a ser percorrido.
*José Ernesto Lima Gonçalves - Especialista em estratégia empresarial, mudança organizacional e uso estratégico da tecnologia de informação. Atua em empresas de médio e grande porte, nacionais e internacionais. Professor da Escola de Administração de Empresas de São Paulo da Fundação Getulio Vargas. Mestre em Administração de Empresas pela Universidade de São Paulo. Curso de mestrado pela Stanford University e especialização em planejamento no Japão.

terça-feira, 3 de março de 2009

HOW TO SHARE WITHOUT SPILLING THE BEANS


Technology Review (03/02/09) ; Naone, Erica

A new protocol designed to allow organizations to share important information without compromising privacy through the use of smart cards was recently unveiled by Bar-Ilan University professor Andrew Yehuda Lindell. The protocol's usage involves the first party's creation of a key with which both parties could encrypt their data. The key would be stored on a secure smart card to be given to the second party. Both parties would employ the key to encrypt their respective databases, and then the first party would send his or her encrypted database to the second party, who can see what information both parties have in common. In addition, the second party would only have a restricted window of time to use the secret key on the smart card because the first party deletes it remotely using a special messaging protocol. University of Haifa professor Benny Pinkas says that Lindell's system demands far fewer computing resources to shield private information. However, RSA Laboratories chief scientist Ari Juels says that because the smart card serves as a trusted third party, finding a manufacturer that both organizations trust completely could be problematic. "Assuming that a smart card is secure against an individual or modestly funded organization may be reasonable, but not that it's secure against a highly resourced one, like a national-intelligence agency," he notes. Lindell says that in the event the chip is compromised, high-end smart cards can be designed to self destruct.

sábado, 7 de fevereiro de 2009

LA VERDAD SOBRE LAS SOLUCIONES DE EXTREMO A EXTREMO

por Frans Kemper*

Muchas compañías dicen que entregan soluciones de extremo a extremo pero yo me atrevería a retar este planteamiento. ¿Son de verdad estas soluciones de extremo a extremo? Hasta ahora no pero esto está a punto de cambiar.
Cuando una compañía afirma que ofrece una solución extremo a extremo ¿en realidad la compañía que hace este fuerte planteamiento controla todo el proceso? ¡No creo! Pero hay una solución a la vuelta de la esquina y usted es una de las primeras personas en saber sobre ella.
El CCTV ya no es más CCTV sino OCTV (Circuito Cerrado de Televisión vs. Circuito Abierto de Televisión) gracias a la llegada de las cámaras IP. De esta forma, un nuevo fenómeno entró a nuestra industria: la protección de la transmisión y de los datos.
Cuando el CCTV todavía era CCTV, éramos los reyes de nuestro sistema y podíamos controlar cada centímetro de él. No había amenazas porque el sistema era cerrado. Ahora la industria tiene que compartir la corona con los chicos de IT, porque ellos están, cada vez en mayor medida, controlando nuestras transmisiones. Hasta ahora todo va muy bien, cuando se trata de un sistema que está sobre una LAN.
Esto todavía es controlable, por lo tanto ciertamente podemos hablar de una solución extremo a extremo. No voy a profundizar aquí, pues se trata del preludio a la verdadera historia.
Todo fuera de control
Lo que de verdad quiero decirles es esta columna tiene que ver con las transmisiones por WAN o, mejor dicho, las transmisiones de alarmas que van por la “nube”. Bien sea POTS, ISDN, X.25, IP, son muchos protocolos. Pero ¿cómo podemos controlar las transmisiones que van por fuera de nuestra influencia?
He aquí un ejemplo. Una estación central tiene su enfoque en la industria bancaria y monitorea en alrededor de 3.000 agencias de diferentes bancos. Utilizan paneles de alta calidad, procesos de alta calidad y son 100% redundantes. Incluso utilizan varios proveedores para las transmisiones de alarmas.
Una alarma es enviada desde una de sus cuentas y no llega a la estación central. El daño ocurre y el banco acusa a la estación central de ser responsable, haciendo grandes reclamos. Y ¿ahora qué? Esto está por fuera de nuestro control. No podemos controlar la transmisión y no podemos demostrar que el proveedor de la transmisión está entregando lo que prometió.
Entonces aquí es donde la solución extremo a extremo no es tal porque hay una gran dependencia de los proveedores de la transmisión.
Cada vez más y más datos son enviados a diario a través de la “nube”. Recientemente nos presentaron la transmisión de televisión como una opción, esto requiere una gran carga en el “sistema” disponible. Y no podemos olvidar todas las cámaras de seguridad y todos los videos observados desde sitios como YouTube, por ejemplo.
Próximamente cerca a usted
A todos nos ha ocurrido que nos llega un e-mail retardado. Algunas veces un año más tarde. Bueno, con eso uno puede vivir, pero ¿qué pasa si se trata de transmisiones críticas reales?
Aunque me alejé un poco del tema regresaré a él porque los nuevos productos en el mercado ofrecen soluciones sobre este tema.
De lo que estaba hablando es de un nuevo estándar desarrollado y establecido en Europa (EN 50136) que describe exactamente lo que son los estándares para transmisiones de alarmas. Esto es clave aquí, porque de repente se vuelve medible lo que es aceptable y lo que no lo es.
Vincule esto a un servicio que mide el rendimiento y tenemos una herramienta para demostrar que la transmisión fue operada de acuerdo (o no) a las especificaciones del estándar. Mensualmente los reportes muestran el tiempo de actividad, los retrasos, etc. Es llamado VoP (Verificación del rendimiento).
Esta es una información extremadamente valiosa para las tres partes involucradas: el que envía, el que recibe y el que transmite.
Una herramienta de verdad útil
Con este estándar aceptado por todas las partes involucradas, es fácil asignar responsabilidades en un contrato con un proveedor de transmisión.
En mi ejemplo anterior, la estación central habría sido capaz de analizar dónde yace el problema en esta transmisión de alarma en particular.
Esto no salió del panel de la alarma, fue captado en la nube o tal vez no fue seguido por la estación central. En este caso, una solución de extremo a extremo se convierte realmente de extremo a extremo porque podemos verificar el rendimiento de la nube.
La próxima vez regresaré con el manejo de transmisiones críticas, desde mi extremo al suyo.

Frans Kemper Consultor