It Starts with a Profile

A safe place to park in the morning may turn out to be a dangerous area for a mugging at night.
Photo courtesy of Pilgrims Group

Chief security officers, security directors and their consultants should first determine risk profile.

Does the executive work for an employer engaged in any form of controversial work? Do they have a high media profile? Are they a director of another business or corporation? Are they involved in profile-raising community or charitable work?

A senior position can also bring with it a different profile along the lines of health and wealth. They tend to be older/senior; increased health risks can arise due to age/stress; and they will usually display a higher level of wealth. Furthermore their travel profile is different, too.

Here are bullet points for C Suite homes, at work and on the road.

IN THE HOME

There are issues and vulnerabilities in covering an executive’s home.

Their own personal attitude to risk and security. Will they accept additional protection and advice?
Can they easily be identified or located from publicly available information and records?
Residence – how many and where located? Isolated? Are appropriate security systems in place? See the article that follows this one on custom home systems.
Vehicles – how many and how are they stored?
Other family members – are they well-known in their own right (associated risks)?
Is the executive willing to involve his or her family in security awareness?
Confidence that domestic assistance and trades people are bonafide?
Attitude to privacy? Telephone listings, electoral roll, other public records?

AT WORK

Here is where the CSO can play an even greater role.

Profile of the workplace and inner offices.
Proximity to other potential high-risk targets.
Physical security of workplace – is it accessible to an aggressor, even an insider?
Public and private transport used -- competence of driver or chauffeur; protection of a personal vehicle at the workplace?
Insider threat – what confidence that employees are appropriately screened?
Sensitive company information -- databases, product information, forecasting. Loss of this can be catastrophic leaving the situation more likely to be open to extortion, blackmail or kidnapping.

The security operation should enforce policies that can cover:

Laptops, hard drives, cellular phones, use of remote systems to access documents and use encrypted information.
Screening of individuals, visitors and businesses that access the C Suite offices.
A security audit, including electronic sweeps and penetration testing.
A clear desk policy, ensure all storage units are locked with no keys left in and all laptops and handhelds are locked away.
Disposal of company information – even non-confidential information can help build a picture of your key personnel.

WHEN TRAVELLING

There are security and emergency medical help challenges when a C Suite executive is on the road, and especially outside of his or her home country.

Road travel; appropriate defensive driving and first aid/trauma skills.
Assessment of risk level of destination country.
Airlines – appropriate to region.
Hotels – surveyed.
Research and advice supplied on personal behavior - taxis, hotels, bars, downtown areas etc.
Can they be traced easily in an emergency?
Can they communicate immediately for assistance in an emergency?
Is the exec a member of any crisis or business continuity team?

About the Sources
For this article and sidebars, Security Magazine thanks security industry researcher Terry Maddry; Graham Urwin, client operational security manager at Pilgrims Group Ltd.; and Will McGuire of Global Elite Group.

Getting Personal, For Better or Worst

Top enterprise executives possess greater attention to their comfortable routines and relationships. This is also true when it comes to executive protection. An informal survey of chief security officers found that – when the boss wants or needs personal protection – a recognizable face is the best response. Will McGuire of Global Elite Group agrees. “There is a closeness and comfort level between the two people. If the relationship works, the executive wants to see the same person the next time needed. If it doesn’t work, well, the exec wants someone else. And it’s an ‘always on call’ assignment.”

When in comes to threats such as the H1N1 flu, McGuire calls for common sense. Give practical advice. And seek advice from experts that may be closer to the issue and location. But don’t go into a hot zone if you don’t have to.

He also sees value in kidnap and ransom insurance where risk makes sense for it. K&R insurance is designed to protect individuals and corporations operating in high-risk areas around the world. It covers the costs of kidnap, extortion, wrongful detention and hijacking. K&R policies are indemnity policies - they reimburse a loss incurred by the insured. The policies do not pay ransoms on the behalf of the insured. The insured must first pay the ransom, thus incurring the loss, and then seek reimbursement under the policy.

Getting Even More Personal

Call it DIY. Hospital, police, and emergency workers – often far from home or the office -- do not have a “magical database” listing the people who are important to a C Suite executive, or even emergency contact numbers. A driver’s license may be of little or slow use and cell phones are often damaged.

There are a numerous of Web-based services and third parties that can help. For example, EverybodySafe.com is a personal notification system allowing a hospital, police or emergency worker to instantly text, e-mail and call everyone on an executive’s contact list instantly and with a single call or online form.

In this scenario, the executive or his or her security executive compiles a list of the people that need to be contacted in the event of an emergency.