Security gamification: Assume the criminal mind
As every great military commander will tell you, “Know your enemy.” For motor carriers, this means gaining a deeper understanding of anyone who poses a security threat to the operation.
The following tabletop exercise may help you peer into the minds of those who might cause harm (physical or data theft, terrorism, violence, etc.). Seeing your facility from their perspective may be eye-opening and reveal real threats to security at your company.
Assemble the team
The first step is assembling a team of “experts” to look at the vulnerabilities that exist in your organization. This brainstorming team should represent all departments, locations, and shifts.
During this tabletop exercise, participants take on the persona of a security threat and let their imaginations run wild. By putting themselves in the criminal’s shoes, participants look at how someone might gain entry, steal, vandalize, or cause physical harm based on their knowledge of the facility and organization.
Set objectives
A team cannot function properly unless it has specified objectives.
Members of the risk assessment team:
- Need to know what needs to be accomplished, even though creativity is being encouraged; and
- Should remain on task.
The objective of the group is simple: Find real-life vulnerabilities (and roadblocks) when considering fictitious security scenarios. The “enemy” in the scenario has an objective (e.g., stealing load information, workplace violence), and the group needs to think like the perpetrator to figure out how they might accomplish this goal.
Establish team rules
Meetings need a sense of order no matter how much you promote thinking outside the box. You will need to explain the parameters being set.
- Tailor the meeting style to fit your group. Consider the following possibilities:
- Require everyone to present at least one idea.
- Require no minimum contribution (removing pressure).
- Give individuals a specific amount of time to speak with no interruptions.
- Set aside time at the end, after everyone has presented ideas, to offer comments they were thinking as others spoke.
- Offer a casual environment.
Other important rules for the exercise include:
- Respect. No one should be allowed to criticize another person’s ideas, since this may stifle creativity.
- No distractions. Electronic devices (e.g., cell phones, laptops) should be turned off to eliminate distractions. Communication devices interrupt the conversation, break the flow of ideas, and result in lost momentum.
Take notes
Discussion should be timed, and someone should be designated to take notes on the ideas. No idea should be viewed as “crazy.” Sometimes what appears totally absurd has merit and could be a real threat against an individual or the organization.
The notetaker should write all ideas down on a dry erase board or flip chart. Documenting what has been said:
- Shows that all ideas are taken seriously,
- Prevents someone from repeating what has already been said, and
- Provides a visual of the ideas to work from.
Identify viable ideas
By the close of the tabletop exercise, you hopefully have a wide array of ideas to consider. The group should select those vulnerabilities that warrant a more detailed examination.
Consider the following when determining which ideas to pursue:
- How easy is the act to perform (e.g., break in, steal cargo, assault an employee, hack into the system, etc.); and
- The severity of the event (e.g., how much physical harm, financial loss, etc.).
The team’s decision should not be influenced by that of the leader/ facilitator. You do not want to experience groupthink. Whichever ideas receive the most votes should be investigated in greater detail.
Key to remember: A fun and engaging tabletop exercise that puts your staff in the shoes of a criminal might just reveal some overlooked vulnerabilities.
