Visible Security: Making Security Obvious

Imagine walking down a street and seeing two buildings.

The first has:

  • High fences
  • Security cameras
  • Security guards
  • Warning signs
  • Strong doors
  • Bollards protecting the entrance

The second has none of these.

Which building looks like the easier target?

Most people – and most opportunistic criminals – would probably choose the second one.

This is the basic idea behind visible security.

Visible security uses obvious physical and visual security measures to discourage attackers, make protected areas look difficult to target, and demonstrate that security controls are in place.

Visible security doesn’t necessarily stop every attacker. Its primary purpose is often to make an organisation appear to be a harder and riskier target.

What Is Visible Security?

Visible security is the deliberate use of security measures that can be seen by employees, visitors and potential attackers.

Examples include:

  • CCTV cameras
  • Warning signs
  • Security guards
  • Fences
  • Walls
  • Gates
  • Barbed wire
  • Security lighting
  • Window bars
  • Security doors
  • Bollards

The principle is simple – if an attacker can see that security measures exist before attempting an attack, they may be deterred from attacking in the first place.

Why Does Visible Security Matter?

Security controls don’t always need to be secret. Sometimes it is useful for an attacker to know that security is present.

This is an example of deterrence.

Visible Security as a Deterrent

A deterrent control attempts to discourage someone from carrying out an attack.

Visible security is particularly useful for this.

For example, a sign which states “CCTV in operation.” doesn’t physically stop somebody entering. Instead, it communicates “You may be observed.”

This may be enough to dissuade someone from doing something they shouldn’t be doing

Deterrence Doesn’t Mean Prevention

This distinction is important.

  • A deterrent attempts to convince someone not to attack.
  • A preventative control attempts to stop the attack from happening.

Of course, the same control can sometimes contribute to both.

A security guard, for example, may deter an attacker simply by being visible, while also physically preventing unauthorised access.

CCTV

Closed-Circuit Television (CCTV) is one of the most recognisable forms of visible security.

Cameras can be positioned around:

  • Building entrances
  • Car parks
  • Perimeters
  • Corridors
  • Server rooms
  • Loading areas
  • Reception areas
  • Cash handling areas

A visible camera communicates:

“Your activity may be monitored and recorded.”

CCTV isn’t purely a deterrent though – It is also a detective control.

Reviewing CCTV footage after an incident has occurred may help identify the what, how, who, and why of the incident

This is why CCTV fits into more than one category of security control.

It can:

  • Deter
  • Detect
  • Provide evidence
  • Support investigations

Warning posters are another simple form of visible security.

Examples include:

  • CCTV IN OPERATION
  • AUTHORISED PERSONNEL ONLY
  • SECURITY PATROLS IN OPERATION
  • NO UNAUTHORISED ACCESS
  • ALARM SYSTEM ACTIVE
  • SECURITY INCIDENTS MUST BE REPORTED

All communicate expectations and potential consequences.

Physical security controls create actual barriers between attackers and the assets they want to reach.

These might include:

  • Walls
  • Fences
  • Gates
  • Doors
  • Locks
  • Security shutters
  • Window bars
  • Barbed wire
  • Security cages

The attacker now has multiple physical barriers to overcome – Another example of Defence in Depth

Security guards are one of the most visible security controls.

A guard can:

  • Monitor entrances
  • Check identification
  • Challenge suspicious behaviour
  • Escort visitors
  • Patrol buildings
  • Respond to alarms
  • Contact emergency services
  • Physically intervene where appropriate

Bollards

Bollards are short, strong posts designed to prevent or restrict vehicles from entering a protected area.

They are often used around:

  • Building entrances
  • Pedestrian areas
  • Data centres
  • Government buildings
  • Airports
  • Retail premises

A vehicle can be used as a weapon or to gain unauthorised access.

Bollards create a physical barrier.

Visible Security Creates Uncertainty

A useful benefit of visible security is that attackers don’t necessarily know what is happening behind the controls.

This uncertainty can make an attack less attractive.

Visible Security Can Protect People as Well as Technology

Physical security isn’t only about protecting computers.

It can protect:

  • Employees
  • Customers
  • Visitors
  • Equipment
  • Buildings
  • Vehicles
  • Critical infrastructure

For example, bollards can protect pedestrians from vehicles, while security guards can protect people as well as buildings.

Visible Security and Privacy

There is an important balance to consider with some visible security controls.

For example, CCTV can improve security but may also involve collecting personal information.

Organisations should consider:

  • Why cameras are being used
  • Where they are positioned
  • What they record
  • How long recordings are retained
  • Who can access them
  • Appropriate signage
  • Data protection requirements

Security controls should themselves be implemented responsibly.

Visible Security Can Be Unwelcoming

There is also a potential problem with making security information too visible.

It can make a place unwelcoming for authorised people.

Crime Prevention Through Environmental Design (CPTED) is a strategy that uses building layouts, landscaping, and urban planning to reduce crime and increase safety.

Take the image below – both show buildings that are protected via visible security. They both have security personnel, they both have CCTV, they both have physical security.

The one on the left however looks quite an unfriendly place, whilst the one on the right looks much more welcoming.

Rather than having metal bollards, concrete planters with trees and shrubs can be used, a winding driveway slows traffic down to prevent high speed impacts. Security wearing all black looks menacing, but security in high-vis clothing does the same job, but looks more approachable. Strong safety glass provides just as much protection against threats gaining access as high fencing & barbed wire does.

Visible Security Isn’t a Complete Defence

An important lesson is to not confuse looking secure with being secure.

A building could have:

  • Ten CCTV cameras
  • Three security guards
  • Huge warning signs
  • A high fence

but still have:

  • An unlocked server-room door
  • Poor access controls
  • No alarm
  • Vulnerable windows

Visible security should therefore support genuine security controls.

A determined attacker may simply ignore visible security, so visible controls should be combined with less obvious controls.

The Importance of Lighting

Security lighting is another useful form of visible security.

Good lighting can:

  • Remove hiding places
  • Improve CCTV images
  • Help security guards
  • Make suspicious activity more obvious
  • Increase perceived risk for attackers

In Summary

Visible security is the deliberate use of obvious physical and visual security measures to deter attackers, communicate security requirements and provide protection.

Examples include:

  • CCTV – Makes surveillance visible, deters some attackers, detects activity and can provide evidence.
  • Warning Posters – Communicate rules, restrictions and potential consequences.
  • Walls and Fences – Define physical boundaries and make unauthorised access more difficult.
  • Barbed Wire – Adds an obvious physical barrier to fences and walls.
  • Window Bars – Protect vulnerable openings from unauthorised entry.
  • Security Guards – Provide a highly visible deterrent while also being able to detect and prevent incidents.
  • Bollards – Protect buildings and people from unauthorised vehicle access or vehicle-based attacks.

These controls can perform different functions, but the important thing is not to treat any individual control as a complete solution.

  • A fence can be climbed.
  • A camera can be avoided.
  • A warning sign can be ignored.
  • A guard can be distracted.
  • A door can be forced.

Instead, combine them with other forms of security

This is Defence in Depth applied to the physical world.

And perhaps the most important lesson is:

Good security doesn’t just stop attackers. Sometimes it convinces them to choose somewhere else.