Where Does Access Control Fit in the K-12 Security Mix?

• By Dian Schaffhauser
• 10/14/08

As a part of overall security initiatives in schools, electronic access control is little used, according to a recent survey of school resource officers (SROs) and administrators in K-12. Sponsored by Wren Solutions, a developer of IP-based surveillance solutions, and distributed in August to members of the National Association of School Resource Officers and the National Association for School Safety and Law Enforcement Officers, the survey revealed that only 28 percent of responding schools felt "extremely confident" in their ability to ensure perimeter doors would securely lock in case of an emergency lockdown; yet 91 percent of respondents said it was critical to be able to lock down the school in the event of an emergency.

The survey also uncovered the key obstacle schools face in implementing additional security technologies: funding. THEJournal.com recently interviewed two security experts from Wren to uncover the role of access control in the K-12 environment. Jeff Floreno is director of security operations and strategy; Bret Rachlin is the director of marketing for the company and also a blogger focusing on school security.

Dian Schaffhauser: What's involved in access control? It's not just cameras, is it?

Jeff Floreno: When you look at access control, you're really generically looking at how to control the flow of traffic in and out of points of entries and egress. There is a bunch of different ways to perform access control. You can use people, maybe a receptionist, maybe a school resource officer.... Video systems can enhance the operations of an electronic access control system, but typically video doesn't stand alone.

Schaffhauser: What are the biggest mistakes school administrators make regarding access control these days?

Floreno: When schools rush into buying any type of device--whether it's access control, video--when they rush into it and don't stop and say, 'What are my problems? Where's my risk?' I would suggest that what schools really need to do is take the time to conduct a security assessment to find out where they really need to deploy technology to get the best bang for the buck. The places where you think you have vulnerabilities, you might find, by changing policies or procedures, changing your traffic flows, changing the way you use a room, asset or resource, those things would probably do a fine job of mitigating the problem.

Schaffhauser: So how does a school go about doing that evaluation? Should it be done by somebody who won't be selling them the equipment?

Floreno: You can find a security person that doesn't sell any equipment at all, who will come in and do an assessment for you. You can use the security person who is also part of the company that sells equipment. In those cases you need to make sure that the person doing the assessment is not wearing a salesperson's hat. Their job is to tell you what your vulnerabilities and risks are. They need to do a comprehensive look at the school. They really need to identify where your problems are. If they're not coming up with a lot of procedural fixes for things, they're probably not looking hard enough.

Schaffhauser: Can you give an example of a procedural fix?

Bret Rachlin: One procedural fix is around visitor management.... In the past, [a school] might have had a couple of different doors where visitors could enter. Visitors may still have had to come through a receptionist or office manager or school secretary, and either check in and sign their name, maybe it's looked at, maybe not. Maybe they don't have to check out.

Now it's one door. They may have to leave their identification, check in, check out, put a badge on. Some schools are doing background checks of their visitors and making sure they're not on any [known sexual predator] database. That's very progressive. Very few schools are doing that. But certainly, the procedural change--from being very casual with visitors to the point of making sure they check in and check out and trying to track them while they're on a campus--is something we're seeing a lot more of.

Floreno: Hand in hand with visitor polices and procedures, [another example is] looking at how you handle perimeter doors. If you have a school purchasing an access control device and putting it on the front door, but then propping side doors open or letting traffic freeflow through the back door of the school, that really defeats the purpose of having the device on the front door.

Schaffhauser: Any sense of how much a school could expect to pay for the equipment it needs to put together a solid access control system?

Floreno: When schools invest in access control today, they really need to invest in IP access control. Right off, they'll save significant money in the installation of the system. Schools typically have a great IT infrastructure in them. What this means is that there's new technology on the market where you can have devices that will allow doors to lock and unlock and get their power right over the Ethernet. The installation price is just pretty low. So I would say, maybe thumbnail, $3,000 to $5,000 a door....

Something I find surprising in the survey is the number of schools that don't protect critical assets with access control. Only 13 percent are protecting server rooms with access control devices. To me, if you wanted to cause some vandalism and put the school out of business for a day or two, the server room is the place to go.

Schaffhauser: But the survey focused on electronic access control. You could have a lock on the server room, which would protect it from casual access.

Rachlin: One of the challenges is that schools and any business have a problem of losing keys--and it's a lot easier for keys to be misplaced and for someone to gain access to that door than when you have electronic access. If I lost that card, I would be able to tell somebody, and that card could be deactivated. Whereas if I lost that key, the door would have to be rekeyed or the locks would have to be changed to prevent somebody from using that key.

Floreno: If I were going into a school and doing a security assessment, one of the places I'd look is how secure is your server room? If it does have a key lock on it, we really don't have too many investigative tools to help us find out who caused the problem and how to resolve the problem with missing data. If we had video in the hallway where that door was, certainly we'd have some information from the video camera. If we had a card reader--an access control device at the door--we'd know whose card was used to unlock the door.

Schaffhauser: Let's talk about video cameras. IP vs. analog--what's the trend there?

Rachlin: We're seeing more schools going with IP over analog. Most schools have a network infrastructure in place where it's fairly easy to add network cameras. I think smaller type businesses might tend to go with an analog system. With a small number of cameras, it's still less expensive. But the number of cameras required to make the cost justification for IP, that number continues to come down. Most schools are fitting into that model where they're going to have enough cameras where it will make sense to have IP anyway, whether they have existing [category 5] cable or not. With networks, it's easier to fit IP cameras on their system.

Second, IP cameras are better for schools than analog, because it allows more people across the school as well as local law enforcement to access that video more easily than with analog. We've gone into schools where they've replaced analog with IP. The DVR or VCR was in there but essentially was never looked at, except when there was an incident. Now they can use that video much faster and help with incidents. Any type of school fight, you'd be able to bring up the video--[to show] a parent, 'Here's why we're suspending that student.' Their child started that fight. In the past, they didn't have backup or couldn't access that video quickly or easily to really make that case.

Schaffhauser: How do you advise schools to handle the monitoring of the cameras?

Rachlin: Most schools are starting from a reactive standpoint. The initial focus is to have video in place for a couple of reasons: so they can deal with issues and incidents and determine what happened, and because they can deter students.... Forward-thinking schools are starting to use video--and IP video is almost required for this--using event- or motion-based recording. If you're doing a training exercise where there's a fire drill or other emergency planning drill, you may be able to pull up video to monitor how staff and students departed the school to go to the rally point. Did they do that correctly and in a reasonable amount of time? Video can help from a training perspective. It'll certainly help first responders at an event to be able to pull up video.

Schaffhauser: What's important on the management side of video?

Rachlin: First, being able to record based on motion or events. If there's motion in certain areas, you can record video based on that event and then review it in next day or next hour to determine what happened.... The second thing is being able to have remote access to video to supply to first responders, for them to be able to pull up video over the Internet and determine what's going on at that moment from camera to camera to camera. Third, as part of our software, we have a feature called the Watchdog feature, which detects when a camera is not working properly and notifies administrator of the software that there's a problem--the camera wasn't working properly or the system wasn't recording properly.

Schaffhauser: Once an incident occurs at a school, what kind of process should be followed?

Floreno: What kind of incident?

Schaffhauser: Say there's a fight in the hallway. After you've stopped the fight, then what happens?

Floreno: The one thing I would ask right off the bat is, what's the policy for handling those fights? Do they have a zero tolerance policy? Does their policy say how they're going to manage and investigate [an incident]?... If we have a fight, we should have a policy that says, 'Here's what the school intends to do, that the school is going to collect information, that the school will visit with the parents, and the school will ensure that they will always adhere to the same set of guidelines whether it's Jeff starting a fight or Brett starting a fight. The same guidelines have to apply equally to everybody.

Schaffhauser: The survey respondents said the most important investment to make is in the SRO. It was primarily SROs answering the survey, so there's self interest there, but do they play that vital of a role in schools?

Floreno: As I'm working with SROs, they bring an awful lot of value to the schools. They perform a function where they're providing security. It's typically some reactive security. They're learning about how to do the proactive things. A good example would be, if I went to a school and consulted with school on security plan, I'd be taking the SRO around with me as I did it so they could provide that service going forward.

SROs also do a lot of mentoring with the kids.... The SROs do a real fine job of getting that good positive face to law enforcement. They typically have a wonderful relationship with kids in schools. It's not one that's combative or animosity. The kids all seem to enjoy and like them.

Schaffhauser: Do they have a security background?

Floreno: Anyone in school called a RSO is an active law enforcement officer. They're going to be a police officer associated with a police department or sheriff's office. Larger independent school districts might have their own law enforcement department.

Schaffhauser: Any advice about how to get budget proactively? How do you persuade the school board that you need the money to do some of this stuff?

Rachlin: There was just a school shooting in Knoxville in August. Right after that the school board approved a $200,000 in funding to increase school security.... Other schools need to look at Knoxville and say, 'This happened at their school, and they're putting in enhanced security after the fact. What can we do prior to any of these incidents up front?' It takes a sea change from the school board all the way through administrators, teachers, parents, and even students to come together and acknowledge that change has to happen and we're going to find a way to raise money to fund these projects. Money can be raised through grants, budgets, and community-based fundraising as well. The bond issue is another area where they can raise money as well....

Sometimes teachers don't want to get involved in security issues. They want to focus on teaching. From our perspective, that's not realistic anymore. Teachers are going to have to be involved with school security. They are often the first line of defense for someone being bullied--and for anybody who's coming into the school who's going to perpetrate a crime. That's part of their work responsibility, that's part of their job. Having a safe environment is critical to having a positive learning environment.