After yet more school shootings began making the news, the Diocese of Springfield in Illinois decided to completely overhaul its virtually nonexistent lobby security a year and a half ago. “(The shootings) made us realize we needed to put something in place to secure us a little bit more. We may be looked at as a target because we are in an old high school building, and our property is combined with the (new) high school next door to us,” says Patrick Ketchum, Director of the Office for Insurance and Benefits at the Diocese of Springfield in Illinois.
Because the door is the first part of a building that the public can enter, it’s important for businesses to maintain good lobby security. “If you’re talking about just a building, the lobby is the first area you’re trying to protect,” says Tim Sutton, Security Consultant at Sorenson, Wilder & Associates. “A lobby is a buffer, a receiving area for people between the public side of the building and the private side.” If at all possible, it’s best to have employees come in a separate door from the lobby.
Assessments
The first step to an effective lobby security program is to have a security vulnerability assessment (SVA) done, according to Sutton.
“The SVA will identify all assets and will attempt to identify all of the vulnerabilities that a threat could exploit to gain unauthorized access to the assets,” he says. “A good SVA will also utilize historical data and industry best practices, guidelines and standards.” SVAs should be done regularly, not just once, because circumstances and technology change.
A risk assessment, assessing the potential for loss, is another valuable tool for lobby security, says Sutton. “A risk assessment builds upon the SVA and assigns a probability to the likelihood of a threat occurrence,” he adds. “It helps to determine what level of security will be employed in the protection of assets at the particular site. The risk is calculated by determining the possibility, probability and likelihood that someone would actually attempt unauthorized entry.” The lobby can then be designed or set up in the most effective manner for that particular business.
Purpose
Understanding the purpose of your lobby will also help you choose the best type of security. Is yours a company that has clients coming in and out all day? A business that mostly deals with employees and rarely has outsiders in the building? In the case of the Diocese of Springfield in Illinois, both employees and visitors are common entities in the building, which is why they have set up a two-door system at the front. Employees have access cards to get through the double doors, but visitors can only get through the first door before they must be buzzed in by the receptionist.
Design
The proper design of a lobby is more important than people realize, Sutton says. Where the security or reception desk is placed makes a huge difference in how easily people are able to get into the building. “Design the lobby so that people have to go through your security measures,” says Sutton. “If you’re trying to control a lobby, it should be a closed environment.”
Even rearranging a desk can change the environment drastically. Both Sutton and the U.S. General Services Administration recommend looking into Crime Prevention through Environmental Design (CPTED) techniques to help set up or design a lobby in the most beneficial way possible. For more information on CPTED, visit www.cptedsecurity.com.
Ideally, there should be two doors with the receptionist or security officer placed in between them so that he or she can closely monitor who is going in and out, says Sutton. The lobby is set up similarly at the Diocese of Springfield. Beyond the fact that any visitors have to be let in the second door by the receptionist, they can’t go anywhere in the building past the lobby without either a key or an access card, Ketchum says. In order to boost security even further, the employees have been instructed to walk down and retrieve their visitors from the lobby, as well as walk them back to the lobby when it’s time for them to leave the building.
Optimizing SMB Lobby Security with Integrated Visitor Management SystemsLobby security has become increasingly important for small- to medium-sized businesses, where high-profile incidents have proven that organizations simply can’t ensure safety and security using paper logs. The latest visitor management systems solve these problems, and have become affordable and are very easy to install. They can be implemented on a PC at the lobby reception desk or another entry point, and are also easy to use, with training requiring no more than an hour. Today’s systems automate the entire visitor registration process, including gathering information from the visitor by simply electronically scanning a driver’s license or other ID, screening the visitor against any internal and/or external watch lists, and creating a high-quality badge for the visitor to wear while in the facility. They enable businesses to identify who is in their facilities at any given time, and why, and to keep out unwanted visitors. They also capture detailed, highly accurate visitor information, and provide reporting and analysis capabilities for one location or many facilities operated by the organization. Today’s solutions also simplify visitor management by enabling administrators to create and manage badge templates by category. Administrators can create and manage all of the user accounts for employees who will be operating the badging software in each building, and can set up and manage an automated, scheduled employee import process. This ensures that the visitor list is always updated. Finally, today’s visitor management software also manages all setting and options on each badging station from the central administrator console, further simplifying the process. In many environments, the primary focus for visitors is safety. For instance, in the event of a fire or other emergency, visitor management systems can be used to very quickly assess who remains in the building so they can be found and evacuated. Organizations should enforce procedures including requiring all visitors to wear a badge issued to them when they check in. Hand-written systems don’t offer adequate security for this requirement, and aren’t scalable enough to support business expansion. In other cases, businesses face additional security challenges related to crime or regulatory mandates, which can be difficult to meet against the backdrop of economic pressures. In this environment, paper-based systems are quickly being replaced by registration solutions that are capable of screening, badging and tracking all visitors or, at a minimum, only those visiting certain critical areas or time periods, such as after hours when staff is reduced. The visitor management system can flag any individuals or organizations that the organization has pre-determined should not enter the building. The results of this screening process can be displayed in just two seconds if there is a match. The combination of database screening and other flagging mechanisms makes it easier for businesses to ensure that proper controls are in place to monitor all visitors and protect those who are on the premises. In addition to screening each visitor against databases and other watch lists and then flagging those who are not authorized to enter, some businesses use their visitor management systems to issue a warning alert to the lobby attendant. Within seconds, the attendant will know whether a visitor who is checking in is listed on a watch list, and an automatic e-mail alert can also optionally be sent to other facility administrators and/or security personnel. Organizations should consider visitor management solutions that integrate directly with their access control system. When visitor management is integrated with an organization’s access control system, all information entered into the visitor management system during check-in is seamlessly passed to the access control system. A proximity card for the visitor is activated in the access system using the information entered into the visitor software. Then, when the visitor leaves the facility, they are checked out by the visitor lobby system, and that card is automatically deactivated. If visitors inadvertently leave with their cards, the facility is still secure, because the visitor software passes the expiration date and time to the access system. The access card will no longer be valid after the specified date and time. If the card was stolen, it could not open anything. Those that always escort visitors through their facilities do not necessarily need to integrate their visitor management system with their access control environment. However, when it is desirable and appropriate for guests to have free access to the facility, integration can be extremely valuable, eliminating the need to interface with the access control system; instead, lobby attendants can issue guest badges directly through the visitor management system, which also provides the ability to track and badge both employees and visitors throughout the facility. Both systems work together to grant entry to authorized outside personnel, and the lobby attendant doesn’t have to be familiar with the access system in order to provide temporary card privileges to visitors. Integrating visitor management with access control also eliminates the problems of having a supply of live cards at the reception desk for those who have forgotten their ID badges. The visitor system also has a record of all visitors who have been provided an access card, so there is a complete audit trail, including information about the dates and times when cards were active. In summary, the key benefits of integration include: • Optionally allow free facility access to certain authorized visitors or contractors, when appropriate. • Limit unauthorized personnel from entering restricted areas. • Track the activity of everyone – including visitors – who have entered and left the facility. • Enable lobby attendants to check in and issue badges to visitors directly through the visitor management system. Another important consideration is whether the visitor management system supports web-based visitor pre-authorization so that a company’s employees can alert lobby security officers when they are expecting guests to visit. After the visitor’s identify and credentials are verified, they are then again verified against the Pre-Registered list. At this point, the system can announce the visitor’s arrival to the employee using either e-mail or SMS. Organizations today face many security challenges at their facilities, and managing access by visitors and other authorized personnel is a major concern. Complicating the issue is that vendors, partners, contractors and other guests who visit frequently require and expect certain levels of access to the facility and people within the organization. A key ingredient for ensuring effective facility security is to replace paper logs and manual processes with a visitor management system that is easy to use and, ideally, is integrated directly with an organization’s access control system. The result is enhanced security and convenience, and the confidence that all guests are authorized to be in the facility and officially checked in. With the latest visitor management software, businesses also have access to a variety of valuable analysis, reporting, flagging and alerting capabilities, as well.
By John Fenske, Vice President of Product Marketing for Identity and Access Management, HID Global |
The design and setup at the Diocese is still evolving. “We’re going to move the offices that are down in the lobby area into the main section of our building, so that the conference rooms will be by the lobby, and visitors will not have to be buzzed into the main section of the building,” says Ketchum. The front desk will also eventually be behind glass so visitors can just come in and walk up to the desk to announce themselves.
Visitor Management Systems
A visitor management system (VMS) is another component, though Sutton cautions that it isn’t necessarily lobby security. “People can still get in, and they are still going to go wherever they want unless you control where they are going,” he says. A VMS can be a self-serve kiosk, or it can be managed by a person. It scans the visitor’s driver’s license, registers that he or she is there, and can then create a badge to be worn. “A VMS works well for emergency management purposes as well because you know who is in your building and how many,” says Sutton.
Ketchum says that at the Diocese each visitor receives an ID badge with a number on it, which is written down in a log. “If there’s an emergency, the person at the front desk grabs the log book so we know who all is in the building,” he says. Before they employed this lobby security system, visitors could walk around the building completely on their own.
A VMS, whether assisted or self-serve, needs to have policies and procedures behind it that make people use it, says Brian Allen, Director of Sales at LobbyGuard Solutions. The VMS doesn’t replace people, but it can enhance their jobs, he says. Many schools are now employing a VMS that also does a background check when visitors scan their IDs, alerting school officials to sex offenders and the like, says Sutton.
Video
A useful tool in the lobby security arena is a video intercom system. “You never want to buzz anyone in until you know who you’re buzzing in,” says Sutton. If you can’t see the person for yourself, a video camera is absolutely necessary.
Video surveillance analytics are also particularly helpful in some areas, such as being able to tell how many people have come in and when, as well as motion sensing and programming the camera to set off an alarm under certain conditions. “I think you can accomplish a lot through video, but only if you understand it and use it proactively. Otherwise it’s not going to help if you’re not actively using it to help your security,” Sutton says.
Policies and Procedures
“Technology is only as useful as the policies and procedures that are written and observed by those people executing it,” says Sutton. For instance, he once saw a hospital where the emergency exit doors did not have any alarms or commands put on them, so no one knew when they’d been opened. Worse, the doors could have been propped open, and no one would have been notified. “You can have a top-notch security system, yet if you don‘t have policies and procedures that employees can follow, or if it’s not installed properly, you don’t know if the door has opened,” Sutton says.
Updating and revisiting policies and procedures regularly is part of a good overall security plan as well. “We have a small committee of people here, and we meet on a regular basis to discuss safety and security for the buildings, whether it’s fire or tornadoes, or anything,” Ketchum says.
Train Employees Well
“You’re only as strong as your weakest link at the front desk. You want that to be a very strong-minded person who understands security with regard to people coming in the front door.
They should be able to diffuse a situation, or see suspicious activity,” Ketchum says. “The strongest element of lobby security is a security officer,” says Sutton. “The juxtaposition is that the weakest element is also a security officer. The human element is the weakness.” Training helps strengthen this weakness.
In Ketchum’s case, all of the 60 or so employees at his office need to be well-trained in order to effectively carry out their organization’s policy of meeting visitors in the lobby and escorting them to other areas, as well as bringing them back to the lobby when they leave. The receptionist especially needs to be well-trained so she doesn’t buzz someone in a door she’s not supposed to, or if there’s a meeting and the lobby gets busy, she knows who to call to come and help her so no one slips by and creates a security breach.
Securing the lobby takes time and money, but as it is likely the first place a malicious person will enter the premises, lobby security is imperative for the protection of the whole building and its occupants. As Ketchum puts it, “We want to be an example for other schools to look at security more closely. You want to be ahead of these things, not wondering what to do after it happens.”
Want to Learn More?
Check out the lobby security providers included in this article:
