Part One: Access Controls
John Randall Dennis is an ASIS ESRM Certified Security Risk Consultant and security advocate based in the Nashville, Tennessee area.
Randall Dennis: Bruce, your perspective is truly exceptional, shaped by your experience in three distinctly different roles: law enforcement, leadership at a large district, and now as head of education for Genetec. We're discussing
Bruce Canal, CPP, is Executive Lead for Education at Genetec and has served in law enforcement and as Director of Security for Orange County Public Schools.
Bruce Canal: If you were to ask any school Security Director, senior leader, or superintendent about their security measures, you know what they would list first and foremost? Cameras. Most leaders equate cameras with security. They may not have anything else, but they'll tell you all about their camera system as part of their security. But ask them about access controls? “Yeah, we lock our doors.” Well, it absolutely must be more than that.
What I profess and what a lot of professionals are proposing is moving to a single point of entry at K-12 schools, meaning two things: First, all guests should be coming to one place. As a general guideline, we'll ask, “Where is your flag located? That should be your main entrance.” At that entry point we should secure guests on the “outside”, using audio-video intercoms to communicate before ever letting them in.
It is vital that glass exterior doors feature protection-resistant film. That delays assailants who attempt to enter a building by shooting out the glass, which, tragically, is exactly what happened at Sandy Hook Elementary. The staff vetted the shooter and told him he couldn’t come in, so he shot his way in.
But there's a second part to having a single point of entry: all of your other exterior doors must be locked, all of the time, for this to be effective.
The natural next questions are: How do we lock all doors? And how do we know they're locked? Technology can answer those questions. Today we have technology that can lock doors remotely and can tell us if they’re all locked. Even further, technology can tell us when somebody is trying to get in a locked door. Technology can tell us when specific doors open, and when doors have been left open for a long period of time.
Dennis: These are all critical. Without a single point of entry, we have multiple points, and we've created a lot of problems.
Canal: Exactly. And that leads to the next level of the conversation about access control: policies and culture.
For example, all staff members have to accept and take seriously their responsibility to keep those doors closed and locked. Yes, the third-grade class might go out to the playground, but the policy should be that the door should lock and remain locked behind them. A staff member should need an access card to open it when they want to go back in.
Dennis: Or if a teacher's going out to get something from their car, they never prop a door open. They should have an access card, and the door should close and lock behind them. That also creates an audit trail of who did what when.
Canal: Another important element is proper training of receptionists, desk clerks, or whomever greets visitors. They must be empowered to ask people, “Why are you here? Are you scheduled to be here? Who are you coming to meet?” Give them the power to deny access if necessary. It can create a weak link when someone walks up to the door, presses the video intercom button and the electric strike is immediately released without asking any questions. The tendency can be to think, “He looks like a decent guy,” and they open the door. You can't rely on a quick judgement based on appearances.
It's not about looks, it's not about race, it's not about gender, it’s not any of those things. I wish I had a nickel for every time I had a desk clerk or receptionist say, “Well, I think I can look at him and I can tell if there's cause for concern.” You can't and you shouldn't. That's not a good approach.
In the bigger picture, it's imperative that we all recognize we're building fortresses. We're not building a prison to hold people in, but a fortress to keep threats out. Policies should be clear and clearly communicated. The student handbook should say: “All doors will be locked from the time school begins to the time school ends.” Parents should know staff members are not permitted to allow anyone in the building without going through the main door where the flag flies - and the same should go for students visiting from other schools.
All kinds of issues and the school or district's liability increases when a “single point of entry” policy is not adopted.
There are valuable technologies available today, such as electric door strikes managed by card readers and access control software, to ensure that only people who've been vetted have permission to enter any school building.
Dennis: Definitely. And I’m a big proponent of access cards as opposed to PIN pad access. I advise the same thing to hospitals securing their facilities. You need to have programmable access, unique cards, and an audit trail.
Canal: That's right. The beauty of card access is the admissibility or deniability are both instantaneous.
One stroke on a keyboard when there’s a new employee and they’re in. If an employee or vendor is terminated, the lockout is instantaneous. You can even “double authenticate” with biometrics or a touchpad. Everything is controlled from a smartphone, on a desktop, or a laptop. These solutions make it easy for the administrator to control access to their building.
Dennis: Are there advantages to access cards when there’s a threat incident as well?
Canal: Yes. Let's say there’s an active assailant. An administrator could unlock all exterior doors immediately to allow first responders access to the building. Or you can provide local first responders with their own access cards. You can lock interior doors inside the building if those doors are typically locked and shut, and first responders can utilize those access cards to move around the building.
John Randall Dennis is an ASIS ESRM Certified Security Risk Consultant and security advocate based in the Nashville, Tennessee area. He can be reached at: [email protected]
