Protecting Your Business: Fixed Ops Security, It’s Not Just For James Bond

Imagine the embarrassment and the bad ‘press’ your business could experience if you lose a client’s vehicle. What could you say? “I’m sorry Mr Green, I know you dropped the keys through the (glass) front door, but the wily criminal cracked our advanced security measures using a bent coat hanger and a gob of used chewing gum!” Definitely not a fun conversation. Perhaps you should have implemented stricter OPSEC protocols?

What is OPSEC?

OPSEC is nothing new; it is applied in competitive or adversarial environments. For instance, if you have ever thrown a surprise party or tried to make your home look lived in while you were on vacation, by having a friend drop by to pick up your newspapers, or perhaps you installed a light timer, then you have practiced OPSEC.

OPSEC is the shorthand term for operations security. OPSEC is a process for identifying, controlling, and protecting various forms of assets: from informational to tangible like cars, keys, inventory and so forth.

OPSEC allows you to identify and protect assets that might give an adversary (thief, competitor or disgruntled employee) clues to your plans and capabilities thereby enabling them to interfere, or maybe even stop, a planned operation or activity.

OPSEC helps you identify the indicators that are giving away information about your business, activities, and operations. What do people observe about your schedule? What do you do when you open for business each day? What are you revealing by your predictable routines and the way you operate your business - these are indicators.

Common Indicators That Betray You

Operational security is not just for James Bond, government agencies, or military strategists. On the contrary, everyday business owners need to be aware of the indicators that an adversary can use against them: for instance, your opening and closing times, the routines you have for inventory or vehicle delivery, how your customers drop off their vehicles after hours and so on.

These indicators are publicly available pieces of strategic and tactical information that can allow an adversary to develop measures to thwart you and your business.

So if OPSEC is not just for James Bond, how do you implement an efficient OPSEC risk management process in your business?

The 5 Phases of OPSEC

Phase 1 - The first identifies critical information. What are we trying to protect? Is it information relating to the arrival of the next batch of premium cars? Is it the access code to the key locker in the service office? Is it the customer records within the database?

Phase 2 - Once you know what you are trying to protect, you can then begin to analyse the threat. Who needs access to those keys? Who is our adversary? Put yourself in the other guy’s shoes for an alternate viewpoint.

Phase 3 – The third phase looks to vulnerabilities. Look at how the activity really works rather than how people think it works. For instance, you may have a procedure that clearly states how a client is supposed to drop off their car after hours, but look at the reality of how that happens.

Phase 4 – This stage is where you crunch the numbers. Sure, you may have found your business has more holes than a Swiss cheese, however if the cost of plugging those holes is more than the actually losses you face… well, you do the math.

Phase 5 – And finally, (assuming it makes dollars and sense) you implement countermeasures. Countermeasures reduce the risks to an acceptable level, either by removing the indicators that betrayed you, or by disrupting the flow of information, or by preventing an adversary from accurately interpreting the data.

Two Simple & Effective Countermeasures For a Modern Car Dealership

Countermeasures are dictated by cost, timing, feasibility, and the imagination of the personnel involved. The most effective tend to be simple, straightforward, and inexpensive procedural adjustments that fit the solution to the need.

Countermeasure Scenario #1 – Customer Vehicle Drop Off

I started this article with a slightly tongue-in-cheek crack at the practise of dropping keys through the front door. Today many dealerships have extensive glass frontages – including the main door. And even if the drop key slot is in the service access door, the point about a ham-fisted criminal taking the keys with a bent piece of wire and some gum is all too true.

And don’t kid yourself that criminals don’t know that clients drop keys through the slot. I’m betting you have a sign somewhere that indicates this very fact!  So what is the appropriate countermeasure? For starters, stop using the door. There are many special purpose gated drop box or key vaults on the market. Two types that we have found particularly effective are the wall mounted and the freestanding sentry.

Both drop box key vaults feature quarter inch plated steel construction with a gating flap that shuts (to avoid access to the inside) when the flap is opened for key drop off. The wall mount unit is installed through a solid brick or stone wall. Customers drop their keys through the front slot and staff access the keys from the secured panel inside the building.

The freestanding sentry type is constructed using the same technology and offers a similar gating and anti-tamper mechanism. The bolts securing this unit to floor are specially designed for this purpose and even the locking device on the staff access panel is an advanced padlock with no cutting points.

A customer’s car easily costs tens of thousands of dollars – and both these security countermeasures allow you to safeguard your client’s vehicles for under $1,000 apiece.

Countermeasure Scenario #2 – Vehicle Key Control

So the keys were dropped off overnight and now you have them in you care – now what? How do you protect them while they are in your offices? Far too many dealerships have simple key boards – hooks, labels and wide-open access. Simply reach over, unhook the key (which likely has a label identifying the car) and you’re done. Not very safe is it?

How about a heavy gauge lockable steel cabinet bolted to a solid interior office wall. Unlocking it requires entry of a 5 key push-button combination. This system requires no key to access it, no power to operate it, gives you 2,200 changeable combinations, and a small unit protects about 50 keys and retails for under $300.

And if you really want to beef up security, you can install a special key management system inside the cabinet – double the protection. The key management systems utilizes numbered and colored access keys identifying the users. These access keys lock in the board when vehicle keys are removed thus ensuring accountability.

Then there’s special anti-smash-n-grab laminates for windows, advanced inventory tracking using tiny RFID technology and the list goes on…

Conclusions

Protecting your business, your assets and your customers is a constant evolution. Adversaries develop new ways to compromise your security each day, and OPSEC procedures reduce your risk allowing you to avoid the “Mr Green…we seem to have misplaced your vehicle!” phone call…

Garth MacMillan is Director of Sales & Marketing with MacMillans, a supplier of dealership supplies and security products.   Garth can be reached at This e-mail address is being protected from spambots. You need JavaScript enabled to view it or at 1-800-263-7283.