Basic Commercial Premises Security

If we work on the basis that most burglaries are opportunist, in other words they didn't plan to break-in until they saw an opportunity; then you are more likely to lose items that are easy to remove and that can be sold on quickly.

PC's, laptops, PDA's, mobile phones and similar other items are obvious candidates for theft. It isn't just physical computers that have value, but the integral components and information stored within that thieves will focus upon. The loss of a computer or related equipment might not represent the biggest loss; it could be the costs of business interruption and important or sensitive data loss that may do most harm.
Much can be said about technical security systems but at this point let's look at very basic solutions to prevent thieves from gaining access.

This could be a good time to call in your local CPO (Crime Prevention Officer).

Let's take a look at the physical security of the building.

No matter how good the locks are on Entry/Exit Doors, if the door and frame cannot withstand a violent attack, your premises are vulnerable. Wooden doors should be at least 44mm thick. It is equally important to make sure they are locked at all times.

Often Health & Safety and security don't mix, for example; Regulations state that when the building is occupied, fire exit doors must be able to be opened quickly in the direction of escape without the use of keys. A perfect escape route for thieves too! Think alarm and CCTV point here.

If you occupy offices of multiple tenancies then the landlord and appropriate tenants should address the security of communal doors. No one benefits if this area is deemed the responsibility of the other. Responsibility needs to be agreed and accepted to ensure common areas have suitable security.

Look out of windows and check either side for potential access points, look for flat roofs and nearby fire escape stairs. Internal grilles should be considered for all accessible windows, don't overlook skylights.

If there is no reason for goods lifts to be used after working hours they should be disabled at the end of the day. Perhaps taking them to the top and switching them off. Old type lifts with lattice doors are easier to disable in the sense that if the doors are left open, they cannot operate.

Talk to your Crime Prevention Officer about installing an intruder alarm system linked to a central monitoring station. This should be fitted in accordance with Association of Chief Police Officers (ACPO) policy and Association of British Insurers (ABI) guidelines.

Be mindful that nominated key holders must be able to get to the building within 20 minutes of being notified of alarm activation. This allows police to check the premises if a forced entry is not apparent. Consider using a reputable key-holding company if you cannot meet this requirement.

Keep the number of people able to arm and disarm the alarm system to an absolute minimum and make sure that they are issued with individual 'pin' numbers that each can be monitored and their activity is logged. This will facilitate better management of the system and minimise in-house mischief or activity from disgruntled ex-employees. Don't transfer old PIN's to new people.

If employees work during periods of reduced occupation, for example, lone workers overnight or weekends then personal attack buttons may need to be incorporated into the alarm system. In these circumstances cannot be accommodated, perhaps staff should not work alone because if there is more than one person on the premises, someone can raise an alarm. Having said all that, planned raids are very rare and if the building looks occupied, the chances of an opportunist intruder are fairly low. Keep lights in and look occupied.
Never leave computer related boxes and packaging in public view. Empty or otherwise, these cartons inform all passers-by that you have new IT equipment on the premises.

Thieves rarely rely on guesswork when selecting a commercial building to break into. This isn't about 'walk-in' crime. Companies have had new computers stolen the very same day as they have been delivered, it not pure coincidence or extreme bad luck! It is obvious that intelligence is gained before the event, inside information or poor security measures. It cannot be over-stressed how important it is to control access during office hours as well as when closed.

If possible, restrict access to the building to one entrance/exit, with all other access points being controlled.
Is your front of house staff, whether they are security or receptionist, fully aware of staff that have left - voluntary or otherwise? If an employee has left your employment and returns to visit - would they be free to enter the premises because nobody knows they no longer work for you?.

All personnel should be identifiable. This begins at the reception point where a visitor should be registered and supervised by an authorised member of staff. It extends to the active vigilance of employees - fully aware of the defined procedure for challenging strangers. If employees see a stranger wandering around, would they be reported or challenged?

If visitors sign in or are issued with security tags, does anyone check to see that they actually leave the premises? Is anyone tasked with an end of the day procedure for checking the building to ensure that no one is hiding in it?

Site your IT equipment carefully, away from the perimeter and behind obstacles that slow and frustrate the intruder, in locked rooms for example.

Mark property with your full postcode in a permanent and prominent way. Heat branding or chemical etching can do this.

Anchor equipment to solid furniture and building fixtures with an enclosure unit designed to resist dismantling. Choose a product that has been certified to Loss Prevention Standard 1214.

If an enclosure unit is not in use, special security screws are available that replace the standard back cover screws and help to some extent to prevent quick entry to the computer's interior.
Safes and security cabinets can be obtained which allow the computers to be used during the day and locked away at night.

Smoke generating devices, activated by the intruder alarm system, work to create conditions where intruder activity is severely hampered.

Computer alarms that detect tampering can be fitted to units. These are suitable for buildings either during office hours or when an on-site response can be generated at night.

Lap-top computers need to be locked away when they are not being used. Security instructions should be issued to personnel for care of equipment when used away from the office.

Key security - keys to security devices should be kept in the custody of authorised personnel only and either removed from the premises when they are left unattended or put in a locked safe.

Asset control - make sure that an up-to-date inventory is in existence so that full details of any equipment that is stolen can be given to the police and insurance companies.

Commercial premises that maintain large numbers of computers clearly face a disproportionate risk from crime. If IT equipment is spread out or scattered throughout the premises, it is more difficult to establish a secure perimeter, than if the 'IT' area was concentrated in secure pockets.