Establishing a Threat Definition

When considering perimeter security technologies, many components come to mind, such as CCTV, biometrics, lighting and sensors. A product that is appropriate for one site may not be for others. The most reliable solution is to have a combination of complementary technologies, designed to fit the site, that provide a seamless interaction from detection of a threat to alarming upon an intrusion. Ultimately, combined detection technology at the perimeter will provide the most reliable solution with the lowest nuisance alarm rate.

The first step to successfully implementing a perimeter intrusion detection solution is establishing a threat definition. This includes evaluating threat types, intruder skill and level of consequence as they relate to a site. Understanding the threat prepares you to identify the right intrusion detection sensor for your needs.

Determine the intruder profile

Is the intruder a common criminal or terrorist? Evaluate the skill level of that intruder and understand what actions, motivations and physical capabilities they possess. Also consider the level of financial consequence or threat to human life posed by the potential attacker. The answers to these questions will enable the development of a clear threat definition. The following are three examples of varying threat profiles, consequence and threat definitions.

Low threat level

A low-level threat would consist of an unskilled or unassisted intruder breaching the perimeter of a site without taking measures to bypass the security system. The potential consequence is less-serious interruption to normal business operation, with little or no threat to human life. This type of intruder is easily defended against by placing sensors at the perimeter boundary.

This threat profile and the low consequence of this event would dictate the following threat definition: An unassisted intruder with limited knowledge of security systems, a common criminal or trespasser, conducting low value theft or vandalism.

Medium threat level

A mid-level threat would consist of skilled intruders who may be actively working to bypass the security system. The potential consequence is that the event causes interruption to business operation with financial implications, with some threat to human life.

The intruders could have knowledge of the types of sensors in place, the tools necessary to bypass them, and a plan of attack. It’s more difficult to defend against this type of threat because it’s impossible to foresee all of their intentions.

To overcome this threat type, there are measures we can take to increase the probability of detection without raising the potential for nuisance alarms. Instead of increasing sensitivity on the outer perimeter sensors, which would result in a higher nuisance alarm rate, we would instead position those sensors in locations that make it more difficult for an intruder to bypass.

We might consider placing fence detection sensors on both the fabric of the fence and the razor coil outrigger. Or, we might choose to put a volumetric sensor inside the perimeter fence so that the assisted intruder has to deal with layered detection fields rather than a single sensor.

This threat profile and the medium consequence of this event would dictate the following threat definition: Skilled intruders, looking for a specific asset to steal or destroy, which would have a negative effect on business operations, and potential for loss of life.

High threat level

A high-level threat might consist of an attack by a team of intruders that would render the perimeter systems ineffective.  The potential consequence is financial or physical damage to business operation and could cause an organization to cease functioning, and/or serious threat to human life.

This type of intruder will have a clear understanding of the technologies deployed at the perimeter, and the site security protocols. Sensor layout and placement are critical to maximizing probability of detection. 

High-risk sites require multiple perimeter layers, such as dual fences with rows of razor coils to slow an attack, sensors on one or both of those fences to provide early warning and a backup alert, buried covert sensors outside the perimeter fence for early warning upon approach, stacked microwaves to flood the clear space, and in some cases a combination of these technologies.

This threat profile and the high consequence of this event would dictate the following threat definition: aggressive, sophisticated intruder, attacking a critical asset, intending to end business operations, and cause mass casualty.

Understanding the various threat types forms the basis of a perimeter detection system planning process. By clearly identifying the threat definition, followed by site evaluation characteristics, monitoring needs and budget, the increased likelihood of selecting the appropriate mix of sensors and technology applications to secure a perimeter.