Risk and Security LLC

Risk Assessments, Training and More

This content shows Simple View

Risk Assumptions

17-year old imposter does CPR on patient in Kissimee, FL

Posted on March 5, 2012 7:28 pm by Caroline Ramsey-Hamilton Comment

Security measures in place are being questioned in Kissimmee, Florida at Osceola Regional Medical Center after clerk passes as a physicians assistant!

Hospital security procedures, including staff screening practices at Osceola Regional Medical Center, are getting a second look after a 17-year-old passed himself off as a physician’s assistant and took part in several exams and procedures, including doing CPR on a patient. The Orlando Sentinel reported that hospital management is reviewing its practices to ensure a similar incident doesn’t occur. The youth was able to secure a hospital ID badge from the human resources department by claiming to need a new one because the surgical practice at which he worked had changed names. In fact, the youth was employed part time as a billing clerk at a doctor’s office. When confronted by staff, the youth said he was working undercover for the sheriff’s department, so they would be unable to check his employment records



Man Makes Meth in his Car in Hospital Parking Lot

Posted on March 5, 2012 7:18 pm by Caroline Ramsey-Hamilton Comment

Hospital security cameras showed that a
33-year-old man was making meth in his car in the facility’s
parking lot before the vehicle became engulfed in flames.
The man was burned over 80 percent of his body and
later died of his injuries. The car, which was in the Horizon
Medical Center lot, was captured on security video that
showed the man mixing ingredients just before there was
fireball inside the car. A sheriff’s office detective working
security at Horizon requested assistance to put out the fire.
In examining the site, he noticed canisters and other possible
drug-related items in the car and called the drug task force,
according to news accounts



Threat Modeling is the Exciting, Sexy Part of Risk Assessment

Posted on January 26, 2012 6:09 pm by Caroline Ramsey-Hamilton Comment

As a risk assessment professional, when I get into a risk discussion, most security people want to talk about THREAT!  Threat is the most sexy and exciting part of doing a risk assessment.

Threats are exciting all by themselves.  Think about all the threats you can name:

All the natural disasters like Earthquakes, Tornadoes, Storms, Hurricanes, Tsunamis, Lightning, Floods

Crimes like Homicide, Assault, Rape, Burglary, Theft, Kidnapping, Blackmail, Extortion

Terrorism like Sabotage, Explosions, Mail Bombs, Suicide Bombs

All the IT Threats like Malicous Code, Disclosure, Data Breaches, Theft of Data

And about 50 more including Chem/Bio incidents, Magnetic waves, High Energy Bursts, Microbursts, Contamination and Reputation Damage.

Each of these threats could theoretically occur at any time, but we try to establish a pattern of how often they have occurred in the past, in this location, in this county, in this country, in the company, etc.   So NASA, for example, gets thousands of hacker attacks, but another company, like the local Salvation Army, gets 1 every 10 years.

Same model for natural disasters, although you might have to factor in climate change, it’s easy to get the threat incidents for hurricanes in Florida, snow storms in Cleveland, earthquakes in northern California, etc.

We also like to examine industry specific data to see if some threats are higher in a certain industry, like the high incidence of workplace violence incidents in hospitals and high risk retail establishments (like Wawa or 7-11).

Another factor we use in calculating threat likelihood is how the threat could actually affect different types of assets…. for example, would an earthquake damage a car?  Probably not. Would it cause damage to an old historical building – probably (unless it had been retrofitted).  Could it cause loss of life, or injuries (think Haiti).

So I use a multidimensional model that takes the threats list (I have a standard list of 75 threats that I use), and map it to each potential loss, based on the ‘asset’ that might be affected.

The more data you get, the better your model will be, and the more value it will have as a decision support tool!

 



No Way to Win an Election – A Risk Assessment

Posted on January 2, 2012 3:57 pm by Caroline Ramsey-Hamilton Comment

Watching the pandemonium that is the build up to the Iowa Caucus, you can follow the thread that pandering and trying to appeal to the lowest common denominator brings to the Iowa Caucus candidates.

They have taken what could have been an asset, and transformed it into the threat that each of the candidates seems to be fixated on –  that they will not be considered ‘enough of a social conservative’ and so will not win the caucus. 

So, by having a field of five (Paul, Newt, Santorum, Perry and Bachman) competing to be the most dogmatic, the most restrictive, the most anti-abortion, the most anti-immigrant, the most family-oriented, etc., they have actually pared down their own chances of winning.

Romney is running in the slightly more moderate vertical, which no one wants to compete in because it’s not such a knee-jerk distinction, which is why I left him out of this analysis.

In risk assessment terns, this means they have focused on addressing the wrong potential threat (not being conversative enough), and failed to address the real threat (losing the election or coming in dead last).

For the field of five, it turns out that by directly competing against each other, they energize their narrow social conservative vertical and that keeps all five of them alive, and the eventual  outcome is the splintering of that narrow field, which effectively prevents any one of them from anything close to a clear win.

It may be a great way to promote yourself for a later VP slot, or, who knows, maybe a future ambassadorship, but it’s NO WAY TO WIN AN ELECTION!

 



What’s the Risk of Backing Newt Gingrich?

Posted on December 15, 2011 3:31 pm by Caroline Ramsey-Hamilton Comment

Hundreds of the shakers and movers in the Republican party AND the Democratic party are doing their risk assessments this week on who to openly support, and doing the risk calculation on whether it is better to wait and see what emerges, or make their comments/endorsements now and worry about the fall out later!

Here is the kind of risk model for politics that people use, often unconsciously- to make those decisions. Political risk is especially tricky because there are 2 stakeholders to consider:

1. what’s good for ME personally
2. what’s good for THE PARTY, DISTRICT, or COUNTRY.

Here’s a list of threats that politicians worry about in a situation like this:

1. Lose my current position
2. Lose my Power in the Party/Coalition/Media
3. Lose campaign contributions
4. Lose voters
5. Lose tea party support
6. Lose respect from peers
7. Lose future election
8. Lose income
9. Look wrong in the media
10. Create bad sound byte
11. Face Reprisals Later from Establishment
12. Lose Media Support (however it exists).

More tomorrow on how to value the assets of an ongoing campaign.



Crime and Punishment II – Sentencing of Rod Blagojevich

Posted on December 7, 2011 6:01 pm by Caroline Ramsey-Hamilton Comment

Today marks a historic day in the State of Illinois.  While the previous governor is still in prison on corruption charges, out-going, loud-mouth Rod Blagojevich is in court to receive his sentence on federal corruption charges.

This is a great moment for the judge and the judicial system to hand out a sentance that will help PERMANENTLY end the endemic corruption in the Illinois executive branch.

Americans always point out corruption issues in other countries — but this is the MidWest — the Heartland of America.  In fact, I know people who ONLY hire people from the midwest because they think they are more honest and more hardworking.

So I hope that this verdict will uphold justice because I firmly believe that a country is only as good as it’s justice system.  It defines everything else that happens (read my previous post on the SEC failures to enforce).

Every judicial decision, even a non-decision, sends out a strong message to the next potential corrupt politican that the State of Illinois, and the US as a whole, cannot allow corruption in our elected officials!

 



HAS 60 MINUTES EXPOSED THE SEC SECRET – No Penalties for Big Banks?

Posted on December 5, 2011 5:06 pm by Caroline Ramsey-Hamilton Comment

On Sunday evening, December 5th,  60 MINUTES aired what I think is a ground-breaking bit of investigative reporting on how the SEC allowed big banks and mortgage companies to violate Sarbanes Oxley (SOX) requirements with total impunity.

Since the American public is still suffering from the mortgage meltdown – they are looking for answers and looking for punishment.  Crime and punishment usually go together in the Justice Department and law enforcement communities.

“You do the Crime – You do the Time”.

So one person is arrested for a victimless crime, like shoplifting a candy bar, but a big company, like Countrywide, or Bank of America, can crash a worldwide economy, lie on federal forms, commit perjury and saw intense financial destruction to millions of people, and they are allowed to keep the fortunes they made through this risky behavior, and, even better, there’s no jail time, no fines commensurate with crime, and no penalty for openly flaunting federal laws!!

WOW – what kind of message does this send?

For me, concerned day after day with helping organizations comply with federal mandates and laws, like SOX, and HIPAA, and OSHA, this makes a parody of compliance enforcement.

Companies spend millions of dollars to comply with these regulations, which are passed to protect the American public from exactly what just happened.  To find that the regulators are the ones who ignored the falsified attestations, forgave the lack of compliance and let these 21st century robber barons keep their ill-gotten gains makes me, and about 200 million other people, sick!

 



Starting a Hospital Security Risk Assessment

Posted on September 28, 2011 7:26 pm by Caroline Ramsey-Hamilton Comment

How to make sure your Security Department is Working for the Hospital.

Security Risk Assessment are not just Required by the Joint Commission – they are required in many states as a preventive measure to help prevent and reduce workplace violence.

The Risk Assessment also helps managers and administrators assess their security program, directly measure it’s effectiveness and helps determine
cost effective methods that can give you a great deal of protection for the lowest possible cost — something we call “bang for the buck”. 

The recent increase in violence comes as a surprise to doctors, nurses, managers and administrators, too.  Violence is not a concept that people usually associate with hospitals.  For years, hospitals have been seen as almost a sanctuary of care for the sick and wounded in our society.   However, the perception of hospitals has been changing over the last fifteen years due to a variety of factors.

 1.  Doctors are no longer thought of as “Gods”.  This means they are
      are more easily blamed when a patient’s condition deteriorates.

 2.  Hospitals are now regarded as businesses.  This perception has been
       been aggravated by television in shows like a recent “60 Minutes”, as well as
       by the effects of the recession on jobs and the loss of health insurance.

3.  Lack of respect and resources (funding) for hospital security departments
   .  Rather than being seen as a crucial protection for the hospital staff and
      patients, many security departments are chronically underfunded and used
      for a variety of non- security functions, such as making bank deposits for
      the hospital gift shop, driving the education van, etc.

The federal government  issued a guidance document for dealing with violence issues in healthcare,  called OSHA 3148.01R, 2004, Guidelines for Preventing Workplace Violence for Health Care & Social Service Workers.  You can download a copy at www.osha.gov/Publications/osha3148.pdf



Playing Footsie with the Haqqani Crime Network

Posted on September 26, 2011 2:40 pm by Caroline Ramsey-Hamilton Comment

I am a risk analyst and risk assessment expert, certainly not a diplomat.  In fact,  my friends might say I am probably really un-diplomatic most of the time.  I like the direct approach.

But watching the U.S. State Department and the Obama administration playing footsie with the Haqqani network in Afghanistan and Pakistan is worse than enduring waterboarding.  What a waste of American dollars — paying off these criminals to finance construction projects that Americans are doing to build up Afghani infrastructure.  

I have watched for years as the U.S. State Department props up brutal dictators, only to see them toppled overnight.  Of course, Mubarak and Quaddfi come to mind right away.

But to try and win a WAR, while paying off criminals and murderers who are launching attacks on our embassy, letting them run our relationship with Pakistan, is just wrong.

What has this got to do with risk assessment?  PLENTY – because the problem here is large amounts of unaccountable cash.  Cash passed out by the State Department, USAID and the intelligence services, theoretically, to ‘grease’ the skids and get something done, but instead, these wholesale PAYOFFS just finance and empower our enemies, while ruining the U.S. reputation and maddening the citizens who provide this money in the first place.

I would vote for anyone who could put REAL ACCOUNTABILITY back into the U.S. spending abroad.  As the Arab spring proved — this kind of diplomacy never works!



How to Correctly Analyze 100-Year Threats for Risk Assessments

Posted on September 25, 2011 2:40 pm by Caroline Ramsey-Hamilton Comment

Starting a risk assessment in northern Virginia and going through the threat list they say, “You can take earthquakes out – we don’t have earthquakes here”!

Hey, Haiti didn’t have earthquakes!

Vermont didn’t have major floods!

Connecticut doesn’t have tornados!

Like Murphy’s Law, as soon as you discount a threat, and think, “it will never happen here”, it happens!   The earthquake in the mid-Atlantic in August was a wake-up call for those who that they would never have earthquake damage.

One of the reasons that security risk assessment is so highly valued as an analytical took, and why it’s required by so many governments is because it DOES take into account the 100-year flood, the 75-year drought, etc.

Natural disasters can be so overwhelming, and catastrophic, that they must be considered in any proper risk assessment.  This is why some areas are not suitable for building housing tracts, because they are in a 100-year flood plan.

Because human memories are short, just because YOU haven’t experience a flood
along a meandering creek, doesn’t mean it will never happen.  

Always check the long-term probabilities when you start a risk assessment and make the numbers work for you!




top