Happy vacation! Security at tourist spots.

Security isn't what travelers want to think about before heading to a vacation, but top tourist sites are working hard to keep visitors both secure and happy.

By Joan Goodchild, Senior Editor

July 14, 2010 — CSO —
While many people are getting ready for their summer vacations, security professionals at tourist attractions around the country are preparing to ramp up their efforts. A recent Harris May Poll finds 66 percent of Americans will take a summer vacation this year—good news for the country's $704 billion tourism industry, which relies heavily on summer travel each year.
The last thing travelers have on their mind during vacation is security, and the top tourist sites around the U.S. want it to stay that way. But that doesn't come without an intense amount of preparation and work by officials in charge of security at tourist sites, according to Bill Farrar, senior vice president, operations & business development with security firm Andrews International. From museums and monuments, to theme parks and movie studios, there are different and unique challenges to securing each type of site.
"There is a different culture in each place, and that also depends on the state and part of the country it's in, too," said Farrar. "Security needs to be geared for the needs of that site."
Farrar, who during his career has overseen executive protection and investigations, including stalking problems, to ensure the welfare of numerous entertainment and executive clients of Andrews International, gives us a rundown of the security needs at some of the popular destinations sites for summer vacation.
Movie studio (Examples: Universal Studio, Warner Brothers Studio, Paramount Studio)
The biggest security concern in a movie studio where the public is allowed to come on site for tours is keeping those people that are working there feeling comfortable, said Farrar.
"They need to feel that they are able to do their jobs without being bothered or threatened by the general population," he said. "Everyone thinks of terrorism when it comes to security, but it's as much as the obsessed fan or stalker that can be anywhere from a pest to being deadly. You are dealing with all levels of it."
The challenge is to keep security tight while also allowing for employees to work without feeling too hindered. That means access control that is both appropriate and secure.
"We try and make the person who is there working every day feel comfortable going to work and that they are not going to be bothered and are free to do what they need to do."
Landmark site or museum (Examples: Washington monument, Statue of Liberty, Smithsonian Museums)
Depending on the nature of the site, they can truly be a target for security incidents, said Farrar. Many landmarks and museums have now implemented magnetometers for visitors to pass through before entering the building. This can cause a mixed reaction among tourists.

"Some people are fine, ready to go through it. Other people don't want to be bothered and will walk through and try and create a confrontation so you will confront them; they're hoping for some kind of legal dispute. Some people figure if they walk on through and act like they belong they'll just be allowed to go through."
Farrar said it is important for security personnel at these types of places to be changed out to varying roles frequently so they can stay sharp in the face of some of these challenges.
"Someone who is standing at the door for eight or nine hours without relief is going to get lax and not do their job."
Farrar said the other important role security folks must play at landmarks and museums is customer service representative.
"You want things to be secure, but also to appear as friendly and unthreatening as possible. So, it's going up to visitors and saying 'Hi, how are you? Can I help you find something?' At the same time you want a bad guy when he walks up to it know you mean business here. Greeting them lets them know that they are being watched."
Public spaces (Examples: Time Square, the Las Vegas Strip)
Because areas that are public spaces are not officially controlled by any one person or organization, security in these areas requires a combined effort between citizens and police.
"When you have venues like Times Square, or other locations where people will go to and it would make an impression if something happens, the community must be educated and authorities need to be approachable," said Farrar. If police don t have a relationship with the community, the community won't know what to look for, and may also be afraid to talk to the police."
Farrar says many successful awareness campaigns around the country that encourage citizens to pay attention, notice strange things, and report them, have resulted in stopping a catastrophe. The recent Times Square bombing attempt is one example.
"The Time Square attempt was all citizens being aware of what was going on and they may not have known what to look for if they hadn t been educated about what to look for," he said. "You can't do a policeman's job or a security function without the cooperation of the citizens."
Theme parks (Examples: Disney World, Six Flags, Cedar Point)
Tourists may sometimes get a little nervous before stepping onto a roller coaster at a theme park, but concern over a security incident is usually not on their minds. But security is just as important at a theme park as at any popular tourist spot, because if anything happens, it can ruin business, said Farrar.
"Everybody is going to go for the soft target," he said. "You don't want to make it easier."
The challenge is, of course, making things fun and secure.
"You have to be able to actually ward off threats, but create an atmosphere where everyone is comfortable."
Farrar said in his experience, an effective technique is fastidious upkeep of the grounds that work in tandem with a tight security plan. Appearance is everything, he said. And well-kept areas tend to attract less crime.
"The nicer it looks, the better it looks, the better people act," he said.
Public/Private venue (Examples: Navy Pier in Chicago, Faneuil Hall in Boston)
Venues that are open to the public for shopping, dining and entertainment pose a unique security challenge in that they are also sometimes used for high profile events. In these instances, security crews have to balance the need for higher security during events, but also make the venue as open as possible for others so businesses in the facility will not be impacted. Farrar has worked on security for a number of events involving the entertainment industry.
"We can do an event venue where you have a street shut down and have a red carpet, but I still have the rest of the facility open for business."
Security for these types of events usually means extra police and security around the entire facility, not just the event. And security also needs to be on hand for arrivals in order to ensure secure access control.

GAO Issues Report on Sexual Abuse of Kids in K-12 Schools

By Teresa Anderson

12/23/2010 - Schools across the country have hired people who have sexually exploited or targeted children in the past, according to a Government Accountability Office report.

The GAO compared school employment databases from 19 states and Washington, D.C, in between 2007 and 2009 to the National Sex Offender Registry to find cases of sexual abuse that resulted in a criminal conviction.
In investigating known cases of sexual abuse by school employees, the GAO found that people with histories of sexual misconduct were hired or retained as teachers, support staff, volunteers, or contractors. In 11 of the 15 cases the GAO reviewed, the offenders previously targeted children. In six cases, the offenders used their positions in the schools to abuse more children, according to the report (.pdf).

READ MORE

Attorney General Eric Holder: Threat of Homegrown Terrorism "Keeps Me Up At Night".

In an interview with ABC's "Good Morning America," U.S. Attorney General Eric Holder spoke of the ongoing fight to protect American national security and expressed his growing concern with the threat of homegrown terror - a danger which he said  "keeps me up at night."
"What I am trying to do in this interview is to make people aware of the fact that the threat is real, the threat is different, the threat is constant," Holder told ABC's Pierre Thomas, in an interview that aired Tuesday morning.
"The threat has changed from simply worrying about foreigners coming here, to worrying about people in the United States, American citizens -- raised here, born here, and who for whatever reason, have decided that they are going to become radicalized and take up arms against the nation in which they were born," Holder added.
The attorney general said that of 126 people who have been charged with allegations related to terrorism in the past 24 months, 50 had been American citizens.

Read More

Stay Safe

Oram Security

Millions still crossing Americas Borders without documents.

Millions of people are still crossing into America from land ports of entry without the necessary documentation. "The inspector general for the Department of Homeland Security estimated this week that about 3.6 million people a year were still passing through customs without the required documents, and that about half of those were coming through the border crossings in Texas," reports The New York Times. "The audit noted that overall compliance with the law was relatively high; about 96 percent of travelers entering the country’s 39 land ports of entry along the Mexican and Canadian borders now follow the new rules, presenting, for instance, a passport, a border-crossing card or a birth certificate."

Google Searches Warn Against Hacked Web Sites

This looks like a great idea, I just hope people pay attention to it. 

Stay Safe

Oram Security

By Matthew Harwood

12/21/2010 - In an effort to help its customers avoid compromised Web sites, Google has added a new  tool to its search engine that notifies users when it has detected suspicious activity on a Web site, the company revealed last Friday.

When Web surfers use Google to search for something, a "This site may be compromised” warning will appear underneath the search result if Google detects anything suspicious. If users click on the "This site may be compromised" link, they will be transported to Google's Help Center and receive this explanation.

If a site has been hacked, it typically means that a third party has taken control of the site without the owner’s permission. Hackers may change the content of a page, add new links on a page, or add new pages to the site. The intent can include phishing (tricking users into sharing personal and credit card information) or spamming (violating search engine quality guidelines to rank pages more highly than they should rank).

Search-engine users, however, will still have the ability to ignore the warning, click on the search result, and get transported to the Web site.
But with every security measure, there are people who could be adversely affected. In this case, they are Web masters whose sites have been compromised by a hacker.
"Rest assured, once the problem has been fixed, the warning label will be automatically removed from our search results, usually in a matter of days," explains Gideon Wald, an associate product manager at Google. "You can also request a review of your site to accelerate removal of the notice."
Google's new warning is one more additional security layer for its customers. The company already warns its search-engine users that "This site may harm your computer" when it detects a Web site hosting malware.
According to Google's Help Center, "In both cases, our detection might not be perfect -- we continually work on improving our system -- but it would be wise to proceed with caution."

Mexican Drone Crashes in El Paso, Texas, Backyard Near the Border

This is something that I believe needs to be explained.  If the roles were reversed, you would have activist groups within the United States as well as the Mexican Federal Government clamoring for an explanation as to why we crossed international boarders of a sovereign nation.

Stay Safe,

Oram Security 

By Matthew Harwood

12/17/2010 - The residents of Craddock Avenue in El Paso, Texas, got a surprise early Tuesday evening when a Mexican drone crashed into the backyard of one of their neighbors near the border with Mexico.
The El Paso Times tries to make sense of the wreckage:

[National Transportation Safety Board Spokesman] Keith Holloway said the aircraft that crossed into U.S. airspace is a mini orbiter unmanned aerial vehicle developed by the Aeronautics Defense System.

According to the developer's website, the aircraft is designed for use in military and Homeland Security missions. It can be used for reconnaissance missions, low-intensity conflicts and urban warfare.

Officials at the Mexican consul's office in El Paso did not call back to provide details about what kind of operation the drone was a part of, how long drones have been in use or which government agency controlled it.

"We are collecting data about the crash. We don't have the aircraft because it was returned to its owner," said Keith Holloway, spokesman for the National Transportation Safety Board (NTSB), told the Times. The NTSB investigates aviation crashes inside the United States.
(For more on how El Paso handles its violent neighbor, see December's cover story, "Bordering on Danger," by Associate Editor Matthew Harwood.)
The drone known as the Orbiter Mini UAV System is manufactured by the Israeli company Aeronautics Defense Systems, which also is listed as Aeronautics ltd on its Web site. According to the specs listed on its Web site, the Orbiter can fly as high as 18,000 feet at speeds of 70 knots for three to four hours per flight.
Officials at Mexico's consul office in El Paso did not return calls from the Times seeking comment. Federal officials from the Department of Homeland Security and the office of Rep. Silvestre Reyes (D-TX), El Paso's congressional representative, also disclosed little information of the crash.
Customs and Border Patrol (CBP) Press Officer Roger Maier told TPMMuckraker in an e-mail, "CBP/U.S. Border Patrol responded to a concerned citizen's call and recovered a small Unmanned Aerial Vehicle... which belonged to the Government of Mexico (GOM). We worked collaboratively with the GOM and other U.S. federal agencies to coordinate the return of the UAV to GOM."
The Times also reports that www.defenseindustrydaily.com had earlier reported that Aeronautics Defense Systems in 2009 planned on selling Mexico's federal police $22 million worth of its Skystar 300 surveillance aerostats and small Orbiter UAVs to help the government fight the country's notorious cartels that many analysts consider a narcoinsurgency.

Security breaches at three firms expose vulnerability of customer information

McDonald's, Walgreen and Gawker Media were hit by hackers in recent days. Some experts warn against using 'dumb' passwords.

By Gregory Karp

December 13, 2010

Customer information collected by three companies, including McDonald's Corp. and Walgreen Co., has been compromised in recent days.

The incidents highlight the vulnerability of that information, especially when consumers, overwhelmed with the number of online log-ins they need, use "dumb" passwords for their accounts, experts say.

Recent breaches contained such information as names and e-mail addresses. They did not involve crucial personal information, such as Social Security, bank account and credit card numbers, the companies said. In the Walgreen case, medical prescription information was not stolen, the company said.

McDonald's on Monday notified some customers that information they provided on the fast-food company's website or in promotions "was improperly accessed by an unauthorized third party." Information might have included the customer's name, mobile phone number, postal address and e-mail address. McDonald's said it had hired the marketing services firm Arc Worldwide to coordinate its e-mail promotions. Arc then hired another company to manage the e-mail list. It was that company, which Arc and McDonald's would not name, that suffered the breach.

Gawker Media, operator of numerous websites, said its registered users' user names and passwords were hacked over the weekend. Though passwords were encrypted, they're still vulnerable and should be changed, the company said. The danger comes if people used the same log-ins for a Gawker site as they do for their other accounts, including financial accounts. Gawker operates the websites Gawker, Gizmodo, Jalopnik, Jezebel, Kotaku, Lifehacker, Deadspin, Io9 and Fleshbot. The Gawker breach led to spam postings using some victims' Twitter accounts.

Walgreen on Friday said customers subscribing to the drugstore chain's e-mail distribution list should be on the lookout for spam directing them to another site and then asking for personal data. That was because of an "unauthorized access" to its e-mail list. Only e-mail addresses were compromised — no names, a Walgreen spokesman said Monday, declining to provide further details of the breach.

"The McDonald's, Walgreens, and Gawker incidents should be a wake-up call for everyone," said Rob Fitzgerald, president of Lorenzi Group, a digital forensics company.

Andrew Storms, director of security operations for nCircle, a network security and compliance auditing firm, said data breaches were on the rise. "Unfortunately, consumers don't pay much attention to breach disclosures — even for large brands — because there are so many of them," he said.

In fact, 63% of organizations reported experiencing at least one security incident or breach during the last 12 months, according to the Global Information Security Trends study by the Computing Technology Industry Assn., a nonprofit trade group.

"More troubling is the feeling that the severity level of breaches has increased over the last several years," said Steven Ostrowski, spokesman for the association. "Attacks that in the past may have been done for sport or notoriety are now being done more frequently with criminal intent or financial gain in mind."

For consumers, one danger of stolen names and e-mail addresses is "phishing." Thieves can create and send e-mails that look like they are from legitimate businesses, such as a bank, and contain your name, trying to trick you into divulging more personal information, which can be used for more serious frauds.

Ultimately, the biggest problem is that people are too trusting and offer too much personal information, said Mike Meikle, chief executive of Hawkthorne Group, a security consulting firm. "The weakest link is the person using the device or piece of software," he said. "It's just about having a healthy skepticism. It's kind of a sad situation, but you have to kind of give everyone the eye. It's just the way it is."

And so many people use the same or similar user names and passwords for all their accounts that they're easy to hack, said Graham Cluley, senior technology consultant for information security firm Sophos and operator of the Naked Security blog.

"People choose dumb passwords, like 'password' or 'letmein' or the brand of monitor they're looking at," Cluley said. Instead, they should use a random password for each site, rather than words in the dictionary that are easily hacked. Because it's unwieldy to manage those, consumers should use password storage software. There are many examples, but free programs include LastPass and KeePass, he said.