Food Facility Security Penetration & Intelligence Testing

How secure is your facility from acts of terrorism, workplace violence, or any act committed by a person with ill intent? What kinds of security countermeasures do you have in place to reduce or mitigate the possibility of product tampering, asset theft, or damage, or to protect your employees and visitors from the harm committed by outsiders? Have you ever asked yourself if your security is even effective?

One way to determine the answers is by having a real-world Security Penetration & Intelligence (SPI) test conducted at your food facility to test and evaluate your security measures and help you determine whether they are effective.

Recently, a food plant manager who had security concerns at his facility asked AIB to visit his plant during second shift on a Sunday evening and attempt to breach established security measures and gain entry to the facility by acting as a delivery person. I arrived at the plant around 8:00 p.m., dressed in the uniform of a major pizza delivery service that I had purchased from eBay and carrying two large pizza boxes. I went to the rear door of the processing area of the plant and knocked on the door. There was no glass in the door or surveillance camera outside the door that would have allowed the employee to see who was knocking.

An employee opened the door. I informed him that I was there to set up for a surprise pizza party for a member of the staff arranged by the plant manager. Because it was supposed to be a surprise, I asked the employee not to tell anyone about what I was there to do. The very friendly employee invited me into the plant and gave me directions as to how to get through the processing areas and find the employee break room where I was to set up.

Once inside the plant, I was able to roam the entire processing area unaccompanied and access the boiler rooms, the fire alarm shut-off valves, the employee locker areas, the main office areas, including Human Resources, and other critical areas of the plant. The whole time, I had my cell phone with me, which is equipped with a camera.

It is important to note that the plant in which this examination was conducted has established security measures and procedures in place. The security concerns identified by the SPI proved that the protocols were either not being followed, unknown to all plant personnel, or simply disregarded and not adhered to by plant personnel.

Security Penetration and Intelligence Testing is a simulated attack or attempt to violate a facility’s established security protocols and procedures and evaluate the attentiveness of security guards and employees and how well they follow established procedures. SPI challenges the technical, procedural, and physical weaknesses within an organization’s security plans in order to identify ways that a perpetrator could compromise security and gain access to sensitive areas and information. SPI assesses a food facility’s ability to discover and respond to security events and evaluates the safeguards currently in place to counteract them.

Most often, AIB SPI tests are coupled with a Vulnerability Assessment, which identifies and reports noted areas in the facility’s security procedures, programs, and physical security measures that remain vulnerable, even with certain security measures in place. The SPI is different in that it attempts to exploit such vulnerabilities to determine whether malicious activity is possible. It is an attempt to emulate a “real world” attack scenario or security breach of established security procedures. At the conclusion of the activities, a detailed report and one-on-one debriefing is held with plant management and recommendations on correcting the security deficiencies are provided.

The AIB SPI can be customized to meet the specific objectives of plant management and to provide information that can be beneficial in further development of the overall security program. The following areas are typically evaluated during an AIB SPI:

1. Outside perimeter evaluation of the food plant, including an observation of surrounding businesses and residential areas, and the potential impact they may have on the facility in the event of an emergency.
2. Observation of the employee and visitor parking areas with an emphasis on places in which someone with ill intent could hide, especially under the cover of darkness.
3. A soft attempt to surreptitiously enter the plant grounds, testing established barriers, fencing, camera systems, etc., to determine whether the security breach has been identified.
4. A soft attempt to enter the facility by providing false identity information, such as a pizza delivery person, pest control operator, etc. This is done with prior management approval.
5. A discussion with an employee or security personnel about security at the facility without providing true identification. The goal is to see how much information about the plant and plant activities the employee or security guard will share with a total stranger when questioned.
6. Observation of exterior perimeter doors to see if any are propped open and/or improperly used for plant entrance or egress.
7. Evaluation and observation of any suspicious or possible illegal activity, such as drug use or exchange, theft, etc., taking place on plant grounds or in the immediate area of the plant.

SPI testing should have predefined goals and objectives set by the company. At the conclusion of the exam, the following information is shared with plant management:

• Summary of any successful penetration scenarios.
• List of all information gathered during penetration testing.
• Detailed descriptions of all vulnerabilities found, including photos taken.
• Suggestions and techniques to resolve identified vulnerabilities.
• Corrective measures to consider to reduce the risks found during the SPI and accompanying vulnerability assessment.

Although a Security Penetration & Intelligence test may identify several weaknesses in an established security program, a person with ill intent only needs to find one to make an impact. The ability to successfully compromise just one security measure could quite possibly be one too many.

The author is Homeland Security & Facility Protection Specialist for AIB International.