vulnerabilities; the harsh realities of a leased facility

8/12/2019 Vulnerabilities; The Harsh Realities of a Leased Facility

1/18

White Paper

Vulnerabilities; the Harsh Realities of a Leased

Facility

HTM

12 Rosenfeld AvenueMilford, MA 01757

(508) 634-7900

www.htm.com


2/18

i


3/18


4/18

Abstract:

An important business advantage comes from owning your own building. This gives businesses the

flexibility to customize, modernize and otherwise change their appearance, services and facilities to

best suit their needs any time that requirements change. Aside from the financial freedom andconvenience, being your own landlord has more benefits than liabilities. Owning your facility gives

you control to change whatever you want whenever you want without having to get permission from

landlords or having to comply with other building standards. However, for many businesses, buildingownership is not practical.

Leased facilities introduce significant vulnerabilities simply because poor business practices from othertenants become your vulnerabilities. For example, lax visitor policies on the part of any single neighbor

leaves potentially undesirable individuals free to penetrate your space. And often the only separation

between your space and an intruder is the thickness of a piece of sheetrock.

But all is not lost. This paper will discuss many of the problems associated with leased facilities and

provide techniques and solutions that can help minimize, if not completely eliminate vulnerabilities that

are a normal part of every shared facility.

Getting To Know YouAnd Then Getting To Know Your Landlord

When it is time to obtain or expand your space, one of the few alternatives is to lease a facility. The

leased facility may be a standalone structure that is part of an office park or a suite in an officebuilding. Either way, when leasing a facility, control over basic structure, changes and modifications is

lost thereby increasing your vulnerability to a wide range of potential disasters. The most importantfactor in choosing a leased facility is to understand exactly what you really need in a space. The second

most important factor is your landlord. Having a good landlord and a good relationship with your

landlord will greatly benefit the control you will have in your facility.

Know yourself

Before you start thinking about space you need to fully understand what you are actually going to be

doing in your facility. Is your company doing something that requires security that would be impossible

in certain leased facilities? If so, you need to consider looking into the types of facilities that satisfy theneeds of your company. For example, if you are working with secret information, you need a facility

that supports this need. A building that does not provide twenty-four hour security or is located in a

high crime district will not be effective in keeping your secrets private.

Security is the most difficult problem when leasing a facility. A leased environment rarely affords the

necessary control required to minimize vulnerabilities. If you need surveillance equipment or 24 hour

guards, you may discover that certain facilities do not permit their use. If you want hardened doorframes or electronic locks, you might discover that these are not permitted because they violate

building standards. Ultimately, you have to look at the space in terms of the security that it provides for

your specific needs.

1


5/18

You may want to consider having two facilities. If the security of certain assets are crucial to the

survival of your company yet your employee base or cost structure does not permit you to satisfy both

ends of the security-cost spectrum, it may be beneficial to isolate your critical assets in a separatefacility. In any facility that has neighbors, consider the following:

Your visitor policywho can enter your facility and whenis limited to the least stringentvisitor policy of your neighbor.

Your exposure to unwelcome visitors, political activists and other hate groups is controlled bythe attraction of you neighbor.

Employee screening techniques are limited by the strength of the screening techniques practicedby your neighbor.

Access to your facilities after hours is limited by the practices of your neighbor. Deliveries and storage of potentially dangerous materials is limited to the material control

policies of your neighbor.

Your overall security is limited by the proximity of your neighbor and is often limited by thethickness of a piece of sheetrock that separates you from your neighbor.

While this list is by no means exhaustive, it points out a simple truth: Independent of how carefully you

plan for vulnerabilities, your overall risk to vulnerabilities is limited to the practices of your leaststringent neighbor(s). If you have critical assets that need protection, having neighborsor those who

may become neighbors in the futureis a factor that limits how much vulnerability to which you willbe exposed. In many situations this is not viable.

A solution to this problem is to lease a second facility that has no neighbors. A second smaller facilitythat allows you to occupy the entire building is the only practical way of eliminating neighbors.

Although this may be less convenient for some of your employees, it allows you to maintain one

facility with a higher level of vulnerability and a second with a higher level of security.

You may want to forgo the convenient location but you also need to consider where your employee

base is located. Making the location convenient for them may hinder your ability to provide adequateprotection for your companys information or trade secrets, thereby demanding a second facility.

Another issue to consider is whether or not 24x7 facility access is required. Many properties are full-

service only during traditional business hours, often defined as 7 am to 7 pm, from Monday throughFriday with holidays excluded. If your business requires heat, HVAC, power, building security,

elevator service and other services on a 24x7 basis, you need to have some assurance that these areavailable and at no additional cost in whatever facility you select.

Thinking About your future

Anticipating where your business will be in the future is essential when choosing a location. If you planto double your business in a year, you should consider leasing additional office space today. This short-

term investment will result in a long-term gain for several reasons. Most obvious is the disruption that

occurs during any type of move which will become unnecessary if you buy the space now. Less

obvious is the fact that when you need the additional space, it may not be available. In addition, it ismost unlikely that additional space will cost less or the same in the future. You will probably end up

saving money by purchasing tomorrows space at todays prices. Best of all, your security planning

will cover your future needs and you will not outgrow security appliances just because they are unable

2


6/18

to handle the additional space. Just insure that your lease provides an option for subletting in the event

that your future needs for additional space do not materialize.

Know your geography

Knowing the neighborhood where your office space is going to be is a critical business decision.Choosing the wrong location can be the last bad decision you make.

Verify that ordinances or zoning restrictions do not restrict your business in any way. Also, learn aboutdemographics because they play a significant role in the location for your business. Neighborhood

demographic information is available through many resources including local police departments, state,

regional and local economic development agencies or commercial real estate companies. Data ofimportance includes crime rates, median income levels and neighborhood histories. Factoring this data

into your decision to select a site is critical to your companys vulnerability to crime or problems with a

changing neighborhood. When you research crime rates, be certain that the data includes weekends.

Low rents and high crime rates are bad business partners. Even though a building may be fortified

against neighborhood activities, there is still danger to your employees who will be exposed to bad

elements when they enter and exit or try to find places to eat or shop. Exposing your employees tothese elements on a regular basis can also be tempting to some. In addition, an area with high crime

rates changes neighborhood responses and involvement. Local residents become used to minding their

own business and ignoring or at least claiming ignorance about activities and people. The witness to thebreak-in or theft simply will not come forward when illicit activities occur.

Another problem with many neighborhoodsespecially urban onesis the only come out at nightfactor. During the day, a neighborhood can be a bustling business area only to be transformed into a

high crime area with the disappearance of the sun. This makes your business the target of illegalactivities at your most vulnerable momentsthe times when your facilities are vacant. It is far better to

opt for a neighborhood where there is good citizen traffic twenty-four hours each day for seven days

a week. In communities where business and homes are interspersed, there is usually a constant flow oftraffic even when businesses are closed. This is a desirable feature because most break-ins occur when

nobody is watching. It is always a better idea to choose a neighborhood that is not exclusively business.

With residential traffic interspersed into a commercial area, there is traffic seven days a week and this

alone can be a deterrent to undesirables.

Be certain to look at crime rates and demographics for adjacent communities. Locating your business in

a good neighborhood that is surrounded by bad neighborhoods creates problems for employees whomust travel through them to get to work. In addition to the facility that is under consideration, it is

essential to look at adjacent properties to insure that they are not or cannot be used for housing

operations that may create vulnerabilities for your business.

It is always a good idea to select a facility with a substantial free zone or setback from the main road.

This prevents vehicles filled with explosives from getting near the building and also increases the

approach and escape path for anyone intending to penetrate the facility.

3


7/18

Fall In Love With Your Landlord

After demographics, the most important factor is your landlord. Before you fall in love with a space,you must fall in love with your landlord. The landlord has the ability to allow or deny nearly every

change or function required for success and a good relationship with him or her will greatly benefit any

changes or alterations that you will need. You may find a perfect facility for your company, but a shaky

relationship with the landlord quickly eliminates any advantage.

There are significant factors about your landlord that need investigation before getting serious about a

facility. Many prospective tenants fail to recognize that it is the tenant who starts in the proverbialdrivers seat. The landlord generally pays for a mortgage independent of whether or not a space is

occupied. It is in your landlords best interest to get your signature on a lease as soon as practical. But

the landlord also wants to insure that you are financially viable because your success ultimately leads tothe landlords success. Aside from needing additional space in the future, the landlord wants to be

certain that rent will be paid when due and that the landlords investment in the building will

appreciate.

One of the first areas to investigate is the landlords financial stability. A landlord who is approaching

bankruptcy or is financially shaky is unlikely to be receptive to changes that you may need to make.

Likewise, a landlord who is likely to sell a facility in the near future is equally unlikely to approvechanges. Virtually every lease requires that you sign an authorization for the landlord to perform a

credit check on your company. You should request the same authorization and perform a credit check

on the landlord. If the results look shaky, find a different landlord.

Does Your Landlord Understand Your Needs?

Another area to investigate is the landlords involvement with the facility. If the landlord does not visitor show interest or pride in the facility, it is likely that needed changes and modifications will be

difficult to get approved. Conversely, if the landlord takes pride in the building and wants to see its

value appreciate, improvements are more likely to come easily. Another related issue is the landlordssensitivity to security and security issues. This is fairly easy to recognize. Good security practices are

easily observed and include many factors including good lighting, clear sight lines, good building

security and the like. Likewise, no lease should be signed before discussing security with the landlord.

If the landlord seems unconcerned or unaware of security issues, it is time to find a different landlord.

You should also have a conversation to insure that your landlord understands your business. If the

landlord thinks the business is strange or cannot understand the rudiments of your business, he or shewill probably be difficult to work with. The landlord must be able to demonstrate a sensitivity to your

changing needs or your relationship with the facility will be difficult. Since you best understand the

direction in which your business is going, you need to be sure that your landlord is a partnernot anadversaryin trying to move your business into the future.

Involved in Reactions

An important part of maintaining a safe environment is the involvement of building management and

the landlord in security issues. It is important to investigate how the building management deals withproblems including break-ins, reported thefts and other activities that represent potential vulnerabilities.

4


8/18

Because new vulnerabilities appear on a regular basis, it is essential that building management review

property operating and policy procedures regularly. If the landlord and building management have no

established procedures for dealing with these problems, including notifying all tenants of problems andchanges to policy, you need to look for a different facility

You Are Only As Secure As . . .

The adage that a chain is only as strong as its weakest link applies to facility selection. Understanding

the infrastructure of a building key to selecting a proper facility. Careful consideration of how thingsget done and who is involved in daily activities can give you the comfort level that you need. Critical

areas including the perimeters of your space and construction zones need to be understood and made

clear.

In a facility owned by you, control of the perimeter, neighbors and maintenance, repair and renovation

are under your full control. None of this is true of leased/rented spaces. This makes you vulnerable.

Without guard shacks, long driveways and an area surveillance capability, the facility perimeter

becomes your first line of defense. Your ability to move or harden walls, doors and other perimeter

barriers is limited and probably prohibited by the lease agreement. Therefore it is important to examineall six sides of your potential space before choosing a facility. For each side, the possibility of

unwanted penetration should be evaluated.

Start At The Beginning

Of primary concern is entry control. This concern includes doors, windows, floors, ceilings and HVAC,

plumbing or wiring access points or other conduits that could be used to gain entry. Consider even theoften overlooked ones including dumbwaiters, laundry chutes and air ducts. If these could be used as

points of entry and you have no control over them, they represent vulnerabilities. They often connect to

neighboring offices where security may be inadequate.

Consideration should also include stairwells and other shared spaces where people can hide or hide

packages. These areas should be as far away from your space as possible. When evaluating a space,

you must create a list of all possible entry points for all six sides. Then, the landlord and representativesfrom all points should be questioned about their awareness of security.

Another problem is key control. Although you may have a strong key control policy, your neighbormay not. It is necessary to clearly understand who has keys to doors and windows and how they

acquire them. Construction, maintenance and service personnel are often given complete access to a

facility allowing them to enter wiring or electrical closets and air ducts. They are generally given keysto non-public areas and this means vulnerability. These workers are concerned about keeping these

areas accessible rather then being concerned about keeping these areas secure. This is a potential

problem for you because you cannot be aware of every construction or renovation project that is going

on in your building. And the bigger the building, the more likely that these activities are taking place.Safeguarding against open closets and other non-public accesses into your facility must be a high

priority and can be difficult to police. Once again, your landlord is the most important factor. If the

landlord is truly concerned about security, this should not be a problem.

5


9/18

Construction and Repairs Are A Problem, Not an Improvement

A basic fact of occupying a shared facility is that there are construction, renovation and repair activities

on an ongoing basis. This is a significant vulnerability. The service personnel performing these

activities generally move throughout a facility unhindered. They are often present after hours because

their presence (or the noise they create) can be annoying to building occupants. Because they leave atthe end of every day with unfinished work, they often leave barriers that should be guarded or doors

that should be locked unsecured. Further, the chaos that they create including unclaimed boxes,

packages and the like leaves a building open to problems. Building materials are stacked in areas thatshould be secure and often block the view of guards and security cameras.

While it is difficult to organize construction and renovation activities, it is possible to guard againstsome of the vulnerabilities that they create. Construction personnel should be screened. In addition,

they should be supervised. Both of these mandates may be impossible to achieve because the personnel

do not work for you and are therefore not under your supervision. However there are a few things thatyou can do. First, you should demand that the landlord take all possible steps to insure safety. This

means that construction materials need to be stored in an area where they cannot cause harm to people

who use public spaces in the facility or be confused with unattended packages. You should also

demand that building security which includes entrances and access paths (air vents, cable runways,etc.) be locked, secured or otherwise guarded. Finally, you should consider having guards in your

facility as long as necessary to watch for suspicious behavior.

If the renovations or repairs directly involve your space, you must be even more diligent. You should

specify in your lease that you want specific levels of screening for all service personnel who enter your

facility. Even if the landlord provides supervisory personnel, you should provide your own supervisionfor anyone who enters your facility. The additional cost is easy to justify because a single construction

worker can cause considerable damage or loss. You should insist that work be done during your normalworking hours when your own employees are present and you should coach your employees to be

cognizant of any strange behavior and provide them with a means of reporting it quickly. You should

also hire your own security guards. You will want to insure that there are points where guards can bestationed to monitor and verify all personnel entering and exiting.

Randomly appearing service personnel including plumbers, electricians and telephone service people

pose the same risks. The fact that they are often working alone makes them an even greater threat.Keep in mind that suspended ceiling tiles are often the only barrier between your facility and a

neighbors facility. And it would not be unusual for a service person to be accessing that space.

Are You Naturally Vulnerable?

Finally, consider the nature of your business. Are you a natural target for terrorists, hate groups or other

politically active organizations? If this is the case, you need to consider the dangers of being in a

crowded or large building. It may be more prudent to locate in a facility that is easier to protect, has

less traffic and less building activity. This makes monitoring and guarding your facility easier and morepractical.

6


10/18

Construction & Maintenance: Not Your Own Doing

The realities of not owning your facility can be disconcerting but not bleak. Much like renting anapartment, there is a detailed restrictive legal document that defines more limitations than privileges.

Designed to protect the landlords investment, commercial leases contain restrictions ranging from

hours of operation to how many employees can be present. Further, if the landlord decides to change

the carpet or remodel an adjoining suite, any adjustments, odors, construction noise and dust are not thelandlords problem but certainly have an effect on the normal pace and environment of your business.

Additions or changes that you might requireincluding alarm or surveillance equipment installationcan only be done under the auspices of the landlord. This means that reactions to changes in crime or

security will be done on the landlords time, using the landlords staff and at the landlords

convenience. This applies to every aspect of the facility.

Your Visitors Are No Longer Your Own

Visitor policy is a significant part of security because most crimes and security breaches are caused by

human beings which happen to be the composition of all visitors. Without a guard shack, perimeter

fence and other protective devices that are directly under your control, anyone entering an officebuilding or industrial park becomes a potential intruder.

Although large downtown office buildings have lobby security guards, the reality is that their primaryfunction is to provide directions to visitors. There may even be security cameras, but these are not

under your control and their primary function is to protect the landlords propertiesnot yours.

Anyone dressed in a business suit or perhaps even a uniform is provided with virtually unlimited access

to the building. The visitors privilege is based on the entire buildings lowest common denominatorvisitor policy. This means that the tenant with the softest visitor policy allows your space to be the next

target. Further, there is generally no provision in office buildings that guarantees that a visitor has left

the building. After gaining access, any visitor could hide in a public or private space until normalworking hours are over. Then the visitor has unlimited access to any place in the building.

Neighbors: The Weakest Link

Because most office spaces have six adjacent sides, there are an additional six points of vulnerability.

Knowing your neighbors is often impossible. They may represent foreign corporations. They may becompetitors. Their business may not be sensitive in the same ways as your own or they may not be

interested in your security concerns. All of these situations result in the same conclusion: If neighbors

represent a security lapse, their lapse becomes your concern. Hardening adjacent walls or surfaces isgenerally impossible leaving your business with the difficult task of managing vulnerabilities that can

literally pop through the walls. Although you might be able to negotiate with the landlord about who

your neighbors are, it is more likely that the landlord is concerned with his/her own occupancies than

your vulnerability concerns.

7


11/18

Its OK To Be A Loner

The fewer neighbors the better. Seek out building corners when possible or the top floor of a buildingbecause it eliminates having a neighbor above you. Exterior walls in the corner of a building are easier

to monitor, better constructed, harder to penetrate from the outside and impossible to penetrate from the

inside. But there is a caveat: Are the exterior walls well lit and monitored? An exterior wall on a

darkened alley may be the perfect location for a break-in.

Dont be fooled into thinking that adjacent janitor closets and non-public areas provide security. They

are easier to break into than other areas because nobody is watching them.

Off-hours Vulnerabilities

Most vulnerability experts would agree that non-business hours represent times of the greatest

problems. Without the presence of employees, attackers can move undetected throughout a facility.Experts also agree that building ingress during non-business hours should be limited. This is not

practical with office buildings. Although the landlord generally defines business hours, tenants usually

have key or card access during non-business hours. With no tailgating policy, a perpetrator can stand at

an entrance waiting for someone with a key and simply feign having lost his/her key or left it at home.If the perpetrator looks or sounds convincing, building access is guaranteed. In extreme situations, a

perpetrator simply takes a (perhaps temporary) job with another tenant and finds a reason to gain access

during non-business hours easily gaining access to a legitimate key or entry card.

Loading Docks and Delivery Problems

One of the most vulnerable points in a facility is the loading dock. Without a strong policy ondeliveries, anyone with a truck (or a pizza!) can gain access to a facility. Even if the truck is not filled

with explosives, a delivered package can be. Further, deliveries often contain important or confidential

materials or documents. Strong delivery policies control what goes in and out of a facility and alsoprotects the confidentiality and integrity of packages. Of course, the same can be said about mail

deliveries.

When an office building has a loading dock, it will be shared by all tenants. Once again, this results inlowest common denominator mentality. Aside from the fact that important packages are easily mixed

up and delivered to the wrong tenant, the security of deliveries is limited by loading dock employees

who do not work for you. In an urban location, attractive to most businesses, loading dock employeesare not likely to be sophisticated responsible educated people. With a large number of packages

arriving daily, it is fairly easy to have a few attractive looking ones disappear. To make matters even

worse, there is no reconciliation process for deliveries meaning that any packageregardless of theaddresseewill make it into the facility where it could remain for days until someone gets around to

sending it back or disposing of it. Also, there is no check to verify that a package addressed to you was

really anticipated. Anyone can now ship you a bomb, chemical or radiation hazard and it will be

delivered to your space. Insure that the facility has an enforced policy of refusing packages that areaddressed to previous tenants or tenants who do not exist. They are a liability.

An added problem is the screening of mail and special delivery packages (FEDEX, UPS, DHL, etc.). Ingeneral, mail and delivery personnel bypass any kind of guard or surveillance and are lead directly to a

8


12/18

facility where they can deliver (or pick up) anything. The federal government has a better idea. Mail

and packages addressed to federal buildings are delivered to an off-site or remote scanning location

where they are screened, tested or otherwise evaluated before being delivered. While it can be normalpractice to do this in a private facility, it is hardly ever practiced in a shared office environment. The

result is a huge vulnerability because anyone claiming to be a delivery person gets in.

Defense In Depth: A Vanishing Act

Defense in depth, that is, fences, guard shacks, standoff barriers, long circuitous entry roadways, andother mechanisms that control access to a facility literally vanish in an office or industrial park

complex. The very same things that provide the first and most important protection for most privately

owned facilities are eliminated because they are considered expensive, unattractive, slow downemployee and visitor access and do not fit in with the aesthetics of an office building or complex.

Even building safeguards such as non-opening first floor windows or alarmed/monitored emergency

exits do not exist.

In fact, many architectural accoutrements including skylights and inappropriate glazing on building

facades, all intended to make the appearance more appealing, only serve as points of vulnerability.

Without natural and important defense mechanisms, organizations are put at risk with few options.

Although an individual tenant can sometimes create a locked or guarded lobby (check the lease to see if

this is even permitted), the notion of defense in depth is shattered because of the elimination of thenatural delay that these accoutrements would have in an effectively protected facility.

Park Only In Designated Areas!

Parking presents another problem. Unless the landlord has taken special precautions to create standoffs,

safe zones and route building services (electrical, water and telephone) away from the parking or

perimeter access, parking is an issue. Lessons learned from the parking garage explosion in the WorldTrade Center and the Oklahoma City bombing prove this point. Most landlords design parking areas to

provide convenience, not security, and the lack of control over designated parking spaces simply adds

to the problem.

Independent of whether they are underground, above ground or adjacent to the building, parking lots

are ideal staging areas for illicit operations. Be certain that your building management has an actively

enforced policy of removing unclaimed vehicles or asking those with no business to vacate. Whilesome facilities permit overnight parking, it will be necessary to determine whether this represents a

vulnerability to your business. Most parking is designed for client and visitor convenience with little or

no regard for security.

Surveillance

Surveillance, through the use of guards, video cameras, intrusion detectors, barrier alarms and a whole

range of electronic and human systems is, at best, limited in office buildings and industrial complexes.

Posting a guard may actually be a violation of lease conditions that limit standard operating hours. Byhaving a 24-hour guard without proper building lights, heat and air conditioning, the guard may be

9


13/18

ineffective.

In the cases of electronic surveillance equipment, even if the landlord can be convinced to permitinstallation, the ability to properly armor and route emergency power and network wiring is virtually

impossible. This potentially neuters the effect of this equipment. Creating the proper command center

may also be a problem because of construction limitations. Unless all six sides of a command center

can be reinforced, the effectiveness is reduced. In a shared facility, neighbors above and below affecthow secure the command center can be. And just like the guard situation mentioned above, if the center

is not manned 24 hours each day, its effectiveness is limited.

Another problem with surveillance equipment is installation location. Defense in depth requires that

surveillance begin at the outside perimeter and in a shared facility, this perimeter is not part of the

rented space. Placing surveillance equipment in common areas or locations outside of the rented spaceis often prohibited and, even if it is not, securing cabling outside of the rented space is generally not

possible.

Alarms

The effectiveness of an alarm is only as good as the ability to make it tamper-proof. As long as thetenant is in complete control of the physical installation and its security, the building wiring and its

security and the remote access capabilities and its security, all is well. However, a neighboring tenant

need only call the landlord and complain about water, smoke or noise, and physical security becomesmeaningless. The landlord, acting on the basis of a potential emergency, dispatches a low-level

maintenance person with a master key thus destroying any concept of security.

Likewise, because power and telecommunications are shared, or at least their pathways are shared in an

office building, anyone who can gain access to wiring ducts is able to tap into or cut power orcommunications cables thereby neutering the ability of the alarm to detect or inform.

Common Services Create Common Problems

When designing any shared facility, one of the design goals is to try to centralize building services such

as water, sewer, power and telecommunications. This simplifies changes or repairs when a new tenantmoves in or an existing tenant experiences problems. By combining building services into a single

route, access to these services is simplified for service and installation personnel. In addition, when

changes or repairs have to be made, there is less inconvenience or interruption to existing tenants.

But there is a significant downside. By using common areas such as wiring closets for critical services

such as alarm notification or power, any tenant can create havoc simply by reporting imaginaryproblems. Since repair personnel are generally focused on repairs rather than security, the opening of

wiring closets or service shafts invites disaster. While the plumber creeps around on the third floor

looking for an imaginary leak, anyone with a pair of wire cutters and a little experience can enter the

shaft and destroy valuable security measures. To make matters worse, these service areas are designedto be as easily-accessible as possible with security as only an afterthought. Of course, asking the

landlord for permission to route your cabling separately is bound to be met with outright refusal.

10


14/18

Sharing and Security Are Mutually Exclusive

One of the biggest advantages of a shared facility is the cost savings that accompanies the creation ofcommon areas such as lobbies, restrooms, cafeterias, mailrooms, loading docks and the like. For

organizations of all sizes, the economies of scale that can be achieved are enormous. Aside from the

cost of such physical facilities, the management, labor and associated burden and support costs are

eliminated from the budget allowing a company to focus on key functions instead of ancillaryactivities. Making the supply of soap and toilet paper someone elses concern is a great relief to the

company that wants to run lean and at the same time never run out of toilet paper.

But this is where convenience ends and vulnerabilities start. Aside from maintenance and operations

not being up to your companys standards, the issue of security becomes significant. Without direct

control over shared facilities, anyone who does not appear to be out of place has free access torestrooms, cafeterias and hallways where (s)he can remain, roam freely or hide avoiding detection or

observation. It is unlikely that the building owner/operator is going to be overly concerned with visitors

who utilize a buildings cafeteria or restrooms. With little or no check-in/checkout procedures,saboteurs and industrial spies can hide throughout the common areas until the coast is clear at which

time they have virtually unlimited access to whatever they desire.

The situation is even worse in the mailroom where lowest common denominator thinking reigns.Although your company may not have enemies or disgruntled employees, the same cannot be

guaranteed for the other tenants. As a result, any disruption to mailroom activities affects your mail.

The same is true for common hallways. Angry or disgruntled people are free to wreak havoc in thesecommon areas which might just coincidentally be adjacent to your facility.

Trying to isolate your facility by prohibiting employees from using common restrooms or cafeterias isnot practical.

An Emergency on Your Part May Not Be An Emergency To Someone Else

Most businesses that are concerned about functional security recognize the need for emergency power

and emergency lighting requirements to maintain the integrity of any security plan. Conversely, from

the landlords perspective, emergency power and emergency lighting are necessary evils that are

required by building codes and insurance companies. This significant contradiction in purposes(although the landlord may publicly deny it) virtually guarantees that security can be compromised

during any kind of electrical disturbance.

Locating an emergency generator in your facility or filling a room full of batteries is not only a safety

risk, it is impractical unless you happen to be located on the top floor and can install an emergency

generator on the roof. And even this has security problems. Yet emergency lighting is mandatory ifsecurity is to be maintained. And even if you can convince the landlord to allow the installation of

sufficient emergency lighting, it will be ineffective without power to other surveillance equipment

including computers, cameras, alarms and the like.

Perhaps the worst part of this scenario is the fact that without emergency power, business will have to

stop and this is probably the biggest security risk of all. Of course, having the landlord understand this

is at best a paradox. Everyone involved is interested in safety and security, but the landlords primarypurpose is to make a profit.

11


15/18

One Mans Trash is Another Mans Treasure

Dumpsters represent a treasure trove for many. Dumpster diving is a profitable profession for those

interested in obtaining business information. But there is a greater risk: Employees can easily discard

important information or materials in well-marked bags only to retrieve them from the dumpster later ata time when they will not be discovered.

A good dumpster policy provides for controlled access to trash storage areas. But when the dumpster isused by all building tenants, access control is both expensive and a nuisance to users. Ultimately,

businesses can be their own worst enemies unless some form of trash inspection and control is in place

and this is at best, wellmessy to say the least.

Although a paper and media shredding policy can be in place within your own facility, it is

troublesome to enforce and of no value whatsoever if trash bags contain disk drives or other materialsthat a problem employee plans to remove from the dumpster after hours.

Storage

Most businesses cannot afford prime real estate for storing old records or equipment. Therefore, many

building owners supply storage areas for that purpose. While this certainly helps a business controlclutter and costs, it also creates a risk because storage areas are generally not properly secured. The

only alternatives are to use off-site storage or not use common storage areas. Neither of these

alternatives are particularly attractive.

HVAC Havoc

Chemical, biological and radiological (CBR) threats are now a reality. Introduced into an HVACsystem, these weapons silently make their way throughout a facility creating new dangers that most

businesses are not prepared to handle.

Although most tenants in a shared facility have individual temperature controls, the heated or cooled airshares a common source and if not properly constructed, anyone with the means and the desire can

introduce CBR elements into a building. While new construction can more effectively control air flow,

recent or old construction cannot. And the cost for retrofitting an entire building is prohibitive.

There are mechanisms that can help, but they are of limited value. Electrically controlled dampers that

can shut off heated and cooled air can be installed so that your particular space can be isolated from therest of the building air. But unless your space is sealed, this may be of only limited value. In addition,

when employees eventually evacuate, they will have to pass through common areas which are neither

sealed nor isolated.

Somebody Up There Wants You Or Somebody Down There Wants You

Building roofs make excellent hideouts and access points. Disguised as repairmen, the roof is generally

12


16/18


17/18

Keeping Your Landlord Accountable

Having protection written into your lease provides you with the most effective security possible.

Written policies can include a myriad of activities and events that can keep your landlord sensitized to

your security needs. As a minimum, you should stipulate that:

The landlord or building management should accompany all service personnel who enter orhave access to your space.

The landlord must confer with you regarding new tenants. It may be difficult to get the landlordto agree to this, but if you are a big enough tenant, or are willing to pay a premium for space, it

puts you in better control of your security measures.

The landlord must be accountable for all service work that is done. That includes screening ofall service personnel as well as holding the landlord personally accountable for any damage or

theft that occurs when they are working in the facility.

You should also insist that all vacant units are inspected regularly for signs of forced entry or signs ofsuspicious activity. If there are indications of activity in vacant units, it is reasonable to assume that

something illegal is going on. If nothing else, someone is trespassing.

You should also insist that all common areas are inspected regularly. Housekeeping is important here.

Filled trash containers or unattended packages have no place. Messy common areas are a good

breeding ground for illegal activities or hiding things that should not be present. You should alsoinquire about non-tenants using facilities such as cafeterias or restrooms. In spite of the fact that a

building may be open to the public, it is not necessary to invite disaster by making the building a haven

for suspicious people. There should be a policy that excludes entrance to anyone who does not havebusiness in the building and the policy should be enforced.

Property-wide tours, both inside and outside, should be conducted regularly by the landlord or building

management. Besides obvious problems that occur as a result of aging, inspections should focus on

signs of forced entry, unusual damage, the presence of suspicious packages or people and other forms

of evidence that are not quite right. Obviously repairs should be made immediately. But moreimportant, management should decide whether or not proactive actions are necessary. If people are

intent on breaking in, a simple repair will not stop them. It may be necessary to add a guard or other

form of surveillance equipment. And, as pointed out previously, tenants need be notified and asked tobe on guard for suspicious behaviors.

Words to the Wise: The Rules Have Changed

Today, aesthetics, size and convenience of location are three main considerations relative and exclusive

to the security of a facility.

Aesthetics of a shared facility are mutually exclusive to security. How a building looks should always

be evaluated by the vulnerabilities created by appearance. Fountains, glass, gardens, sculptures,

14


18/18

vulnerabilities; the harsh realities of a leased facility

Documents