Crime Prevention in Cyberspace

In the early years of most nations, criminals have robbed individuals, stage coaches, trains and banks. Why? Because that’s where the money is. In the 20th and 21st century, with the coming of the internet age, criminal conduct has expanded dramatically to include new types of crime such as fraud, theft, identity theft, blackmail and espionage conducted through cyberspace.  We term this as cybercrime. Cyberterrorism can arise from the same groups, but we will only look at cybercrime at this time.

Cybercrime can be far reaching with long-term effects; from the impact on organisations resulting from the theft of intellectual property or business secrets to the consequences that identity theft can have on an individual, including credit standing and loss of personal resources or loss of personal identity.
 

Responding to cybercrime is even more challenging because the economics favour the criminals. With just a laptop, a single individual anywhere in the world can wreak havoc on individuals and organisations with minimal cost and little risk of being caught. As more advanced technologies and protective measures are developed it may eventually level what has become an unbalanced playing field but in the meantime, it is imperative that all digital users practice basic cybersecurity practices to increase their own protection and improve cybersecurity overall.  

Protection of business information systems

In business, your system protection will start with well-defined policies on the use of internet connected devices in the workplace or when working out of the office. Education and awareness across your staff will go a long way to protect yourself against many types of cybercrime.

Do all your employees understand the most common hacking tactics, such as phishing, social engineering, or packet sniffing.

Do they understand your company policies around protection of information and information systems?  Do they understand and comply with the company social media policy?

Is your information system well configured and your network secure, ensuring the confidentiality, integrity and availability of your data? Is all software housed within your network continually up to date? Exploits in software are very common ways hackers gain access to systems and sensitive data. Updating software on network-connected machines should always be a top priority.

Do you have business-class antivirus software installed (and up to date) on all office workstations and servers? Leading antivirus software can detect, remove, and protect your machines and network from malware. Do you scan your website or web applications for malware? 

Do you have reliable IT support who maintain ongoing awareness of evolving threats and the latest mitigation treatments for cybercrime?

Do you have reliable backups of all of your critical data? Recovering from many types of common cybercrimes often involves restoring your data from a point prior to the event in question. Not having reliable and securely stored backups of your data is a significant liability.

Businesses that have contracts with government agencies are seen by hostile cyber aggressors as soft targets, allow them the potential to gain information that would otherwise be difficult to get from protected government information systems. All information shared by government agencies must be protected from compromise either from data leakage or deliberate or accidental human compromise. Companies should work closely with government agency security advisers to ensure that data is protected to a standard required by the information owner or government agency.

Home computer users

For home users, many of the same rules apply.  One of the best ways to keep attackers away from your computer is to apply patches and other software fixes when they become available. By regularly updating your computer, you block attackers from being able to take advantage of software flaws (vulnerabilities) that they could otherwise use to break into your system. 

While keeping your computer up-to-date will not protect you from all attacks, when used with difficult passwords it makes it much more difficult for hackers to gain access to your system, blocks many basic and automated attacks completely, and might be enough to discourage a less-determined attacker to look for a more vulnerable computer elsewhere.

Operating systems, Web browsers and Email

More recent versions of popular operating systems can be configured to download and apply updates automatically so that you do not have to remember to check for the latest software. Taking advantage of "auto-update" features in your software is a great start toward keeping yourself safe online.

Keep in mind that a newly purchased computer may not have the right level of security for you. When you are installing your computer at home, pay attention not just to making your new system function, but also focus on making it work securely. 

Configuring popular Internet applications such as your Web browser and email software is one of the most important areas to focus on. For example, settings in your Web browser will determine what happens when you visit Web sites on the Internet. The strongest security settings will give you the most control over what happens online but may also frustrate some people with a large number of questions ("This may not be safe, are you sure you want do this?") or the inability to do what they want to do. 

Choosing the right level of security and privacy depends on the individual using the computer. Oftentimes security and privacy settings can be properly configured without any sort of special expertise by simply using the "Help" feature of your software or reading the vendor's Web site. If you are uncomfortable configuring it yourself consult someone you know and trust for assistance or contact the vendor directly.

Passwords

Passwords are a fact of life on the Internet today—we use them for everything from ordering flowers and online banking to logging into our favourite airline Web site to see how many miles we have accumulated. 

Selecting a password that cannot be easily guessed is the first step toward keeping passwords secure and away from the wrong hands. Strong passwords have eight characters or more and use a combination of letters, numbers and symbols (e.g., # $ % ! ?). Avoid using any of the following as your password: your login name, anything based on your personal information such as your last name, and words that can be found in the dictionary. Try to select especially strong, unique passwords for protecting activities like online banking.

Keep your passwords in a safe place and try not to use the same password for every service you use online.

Change passwords on a regular basis, at least every 90 days. This can limit the damage caused by someone who has already gained access to your account. If you notice something suspicious with one of your online accounts, one of the first steps you can take is to change your password.

It is recommended that users monitor improvements in biometrics and physical tokens to use with passwords to provide two factor (dual factor) authentications. A fingerprint reader or other technology, combined with password, will provide a higher level of security for your computer or system.

Dual factor authentication 

Two-factor authentication (2FA), sometimes referred to as two-step verification or dual factor authentication, is a security process in which the user provides two different authentication factors to verify themselves to better protect both the user's credentials and the resources the user can access. Two-factor authentication provides a higher level of assurance than authentication methods that depend on single-factor authentication (SFA), in which the user provides only one factor -- typically a password or passcode. Two-factor authentication methods rely on users providing a password as well as a second factor, usually either a security token or a biometric factor like a fingerprint or facial scan.

Two-factor authentication adds an additional layer of security to the authentication process by making it harder for attackers to gain access to a person's devices or online accounts, because knowing the victim's password alone is not enough to pass the authentication check. Two-factor authentication has long been used to control access to sensitive systems and data, and online service providers are increasingly using 2FA to protect their users' credentials from being used by hackers who have stolen a password database or used phishing campaigns to obtain user passwords.

The technology involve in dual factor authentication is improving all the time and it is important that those looking at implementing such security protection measures seek expert insight into the latest and most secure measures on the market.

Security software

Several types of security software are necessary for basic online security. Security software essentials include firewall and antivirus programs. A firewall is usually your computer's first line of defence as it controls who and what can communicate with your computer online. You could think of a firewall as a sort of "policeman" that watches all the data attempting to flow in and out of your computer on the Internet, allowing communications that it knows are safe and blocking "bad" traffic such as attacks from ever reaching your computer. 

The next line of defence is your antivirus software, which monitors all online activities such as email messages and Web browsing and protects an individual from viruses, worms, Trojan horse and other types malicious programs. More recent versions of antivirus programs also protect from spyware and potentially unwanted programs such as adware.

Having security software that gives you control over software you may not want and protects you from online threats is essential to staying safe on the Internet. Your antivirus and antispyware software should be configured to update itself, and it should do so every time you connect to the Internet.

Integrated security suites combine firewall, antivirus, antispyware with other features such as antispam and parental controls have become popular as they offer all the security software needed for online protection in a single package. Many people find using a security suite an attractive alternative to installing and configuring several different types of security software as well as keeping them all up-to-date.

 

Protecting personal information

Exercise caution when sharing personal information such as your name, home address, phone number, and email address online. To take advantage of many online services, you will inevitably have to provide personal information in order to handle billing and shipping of purchased goods. Since not divulging any personal information is rarely possible you should, where possible, only deal with reputable e-commerce sites and monitor any unusual activity that may indicate that security of your information has been compromised.

Keep an eye out for phony email messages. Things that indicate a message may be fraudulent are misspellings, poor grammar, odd phrasings, web site addresses with strange extensions, web site addresses that are entirely numbers where there are normally words, and anything else out of the ordinary. Additionally, phishing messages will often tell you that you have to act quickly to keep your account open, update your security, or urge you to provide information immediately or else something bad will happen. Don't take the bait.

Don't respond to email messages that ask for personal information. Legitimate companies will not use email messages to ask for your personal information. When in doubt, contact the company by phone or by typing in the company web address into your web browser.

Don't click on the links in these messages as they may take you to a fraudulent, malicious web sites.

Steer clear of fraudulent Web sites used to steal personal information. When visiting a Web site, type the address (URL) directly into the Web browser rather than following a link within an email or instant message. Fraudsters often forge these links to make them look convincing.

A shopping, banking or any other Web site where sensitive information should have an "S" after the letters "http" (i.e. https://www.yourbank.com.au not http://www.yourbank.com)/. The "s" stands for secure and should appear when you are in an area requesting you to login or provide other sensitive data.

Another sign that you have a secure connection is the small lock icon in your web browser bar similar to below.

Pay attention to privacy policies on Web sites and in software. It is important to understand how an organisation might collect and use your personal information before you share it with them.

Guard your email address. Spammers and phishers sometimes send millions of messages to email addresses that may or may not exist in hopes of finding a potential victim. Responding to these messages or even downloading images ensures you will be added to their lists for more of the same messages in the future.

Online offers that look too good to be true usually are. The old saying "there's no such thing as a free lunch" still rings true today. There are many enticing hooks (scams) used by companies to grab your attention that can lead to your computer being compromised or your bank account being raided. Be aware and very careful when online.

Social media safety

You need to think carefully about how much information you share on social media sites, and who is able to see it. While most people who use social networking sites are well intentioned, there are others out there who may copy, forward or save your information to embarrass you, damage your reputation, or steal your identity. Once something goes online, you have very little chance of deleting it.

Keep in mind that the information that you provide on social; media can be harvested by criminals to create false identities, thus stealing your identity. Use of Pseudonyms and false dates of birth can reduce the risk, however, without making a concentrated effort to limit personal information across web sites, it is still possible to accidentally place yourself at risk.  Practice good personal security and you can protect yourself and your family.

The Australian Cybercrime Online Reporting Network (ACORN) recommends the following practical tips for staying safe while using social media.

•                 always type your social media website address into your browser,

•                 never use the same password that you use for your bank or email accounts,

•                 have a different password for each social media site,

•                 only accept friend requests from people you know,

•                 avoid clicking on links in ‘friend request’ emails,

•                 be careful about how much information you share online and with whom, and

•                think before you post – how could your post affect you and others, now and into the future.

Use of Virtual Private Networks

A virtual private network (VPN) extends a private network across a public network and after recent information breaches that have been reported in the media, is becoming popular across the world enabling users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. VPNs, alone, cannot make online connections completely anonymous, but they can usually increase privacy and security.  Not all VPN’s are the same so careful selection is necessary if businesses or individuals wish to use the technology. Where necessary, use of end-to-end encryption that many VPN’s now provide, can be used to enhance the protection of data being transmitted, which will provide an additional layer of protection.

Businesses, especially that operate internationally, should be aware that as VPN’s are becoming more popular, some nations are blocking them to allow government agencies to monitor data traffic, that may lead to compromise of protected data. It is important to maintain awareness of any changes in government attitudes that may potentially, result in a weakening of your information systems security.

Your part in cybercrime prevention

As technology increases our links to the world and enters our homes and personal lives more and more, with smart home automation, network connected medical devices and intelligent software in the modern vehicle; the risk of cybercrime increases. We must all gain an understanding of the risks and how we can protect ourselves from them.

Firewalls and virus protection along with encryption that will protect the operating system and network provides a layer of security that must be supported by the human element. The insider threat or human individual remains the single primary threat to our connected world. Be it the programmer that makes a mistake in their coding that allows an attacker to gain access to systems or users who disregard basic security rules such as strong passwords, that allow systems to be compromised.  All can undo any security system designed to prevent cybercrime.

By understanding how cybercrime can occur and by ensuring that our business systems or home computers are as secure as we can make them and practicing sound personal security when online (including social media sites) we can all assist in mitigating the risk.

Australian Cybercrime Online Reporting Network (ACORN) and other nations Cyber agencies.

Advice on protecting businesses and individuals from cybercrime or how to report cybercrime can be obtained from ACORN
 (https://www.acorn.gov.au/), a national policing initiative of the Australian Commonwealth, State and Territory governments.

For US residents, the National Cyber Awareness System at https://www.us-cert.gov/ncas provides similar services.

The European Union Agency for Network and Information Security (ENISA) is a centre of expertise for cyber security in Europe. The Agency is located in Greece with its seat in Heraklion Crete and an operational office in Athens. Information is available from https://www.enisa.europa.eu/. 

Interpol have a cybersecurity centre that provides advice to most countries including the Asia Pacific region and can be found at https://www.interpol.int/Crime-areas/Cybercrime/Online-safety.

A quick search of your nations websites will allow you to locate information relevant to you.

Cybercrime prevention provides a sound return on investment for a nation’s economy and gives individuals confidence in having a safe and secure connection to the world.

Some thoughts on the creation of a Darwin City Council Crime Prevention Working Group/Crime Prevention Fusion Centre

Unlike many other Australian Councils, Darwin City Council does not have a dedicated crime prevention group embedded within their committees and working groups in Council.

Current alliances are maintained through having a representative on the Neighbourhood Watch NT Board and other government and NFP crime prevention groups, relying on external agencies to take the weight of crime prevention within Council electorates.  

When one considers that crime affects us all and it is the responsibility of all levels of government, and the community, to play their part in reducing crime, having a crime prevention fusion centre/crime prevention working group established within Council can provide an enabling effect for many of these groups and reduce the silo effect that such disparate bodies are vulnerable to.  

Having a Council embedded crime prevention working group/fusion centre allows for a progressive group, working closely with local police, the liquor board and NFP crime prevention organisations along with businesses, local education providers and community groups, to look at initiatives that can tackle crime within our community and identify strategies that may assist reducing the root cause of much of the crime.

The popular Crime Prevention Through Environmental Design (CPTED) is just one tool that can be applied to environments that allow crime to prosper however, it is not a stand-alone tool and total reliance on this model can be counter-productive. 

Some CPTED tools used by CPTED auditors can allow a tick and flick mentality to become prevalent in auditors that can leave gaps in what is understood about vulnerabilities in the target area. There have also been overseas studies that have revealed that criminals have adapted CPTED to assist them in committing crimes through using the very principles that are designed to protect people to that of a tool to target people, who believe that they are safe.

It is essential then that public agencies not get blinded by CPTED as the optional solution. They must expand their options to get better value for the effort put in to reducing crime. CPTED is a great initiative but is only one of many initiatives that will reduce crime, taking into consideration that criminals only require a desire, ability and opportunity to commit any crime, there is scope to develop many different strategies to change the status quo.

All government and non-government bodies must understand that strategies that reduce crime can include a wide range of initiatives, not just policing.  We must involve multi elements within our Darwin community including business, education, Larrakia Nation and community groups, supported by Territory and local government to get valid input into workable initiatives.

Elected officials and Council officers seconded to local and government organised crime prevention groups must have a sound knowledge of crime prevention in order to provide valued insight and input into group deliberations.  This will require training and education being offered to those seconded.

Council must also ensure that Regulations and By-Laws are either in place or enacted to support crime reduction strategies and the work of the group, with funding from other levels of government to support the work.

Council media must also promote the work of the group in an open and transparent manner that ensures the public knows what actions and initiatives are being developed to reduce crime and thus support the reduction of crime in the Darwin region. Failure to promote the work of the group would be counter-productive and lead to concerns about hidden agendas, secrecy etc from the public and business.

Darwin City Council can either:

a.    take the lead in developing a coordinated effort to reduce crime in the Darwin region, or

b.    can sit back and let others tackle the problem in isolation, providing token interest, through observers and Council representatives that provide the perception of a dedicated interest in the deliberations and initiatives proposed by the disparate groups. 

It’s now the time for Darwin City Council to create a unified, inclusive crime prevention working group/fusion centre within Council and be the progressive and pro-active body that the community expects.

CRIME & SECURITY AWARENESS some thoughts by Raymond V. Andersson from back in 2003

Recent media reports have highlighted the threat of criminal activities to individuals, properties and businesses in Darwin, Palmerston, Alice Springs and other areas within the NT.   We live in a society where many criminals operate within their own system of ethical and moral standards, having no respect for the law, age, disabilities or common standards that conform to the general population’s our own standards of citizenship.

The ethical standards and moral positions that we may treasure as being the cornerstone of our communities are regarded as a weakness to be exploited.    This is often supported by arguments regarding the rights of the individual overriding the rights of the many, thus exploiting our own belief system to the criminal’s advantage.   After all, we as a community also believe in the rights of the individual, however we temper this right with our citizenship responsibilities as members of a community.

Much of this crime is blamed on our youth however it must be realised that for every juvenile delinquent there are always one or more adult delinquents – people of mature years who either do not know their duty to their community and nation, or who knowing it, fail.   It is a fundamental fact of life that children emulate adults and adopt the adults’ ethical and moral beliefs in most instances.

What then can the average person do to minimise the threat of crime?

First of all you have to ACCEPT THAT THE THREAT EXISTS. Human nature is a funny thing. We don't like living with threats.  Crime is a subject of conversation nearly every day, or night in homes, bars and workplaces.  You read about it in the papers every day, and the TV and radio tell you about it constantly.  But as soon as we've finished lamenting the problem, we stick it in the recesses of memory; we forget about it.

 You cannot allow yourself to forget that the criminal is out there. They steal for a living.  They assault so they can steal.  They will attack to create an environment of fear and intimidation, so they simply aren't going to forget about you.

Next you have to consciously accept that YOU ARE A POTENTIAL TARGET. Now this is quite difficult for the average person, because the average person is a nice person and it doesn't figure that someone you've never seen before in your life wants to harm you. The bottom line is simply that you have something he or she wants. This goes for every crook or assailant on earth. The criminal assault may be purely an act of theft, or low-level terrorism conducted to gain personal satisfaction in the fear or pain created or just for the individual or groups self gratification in stamping their control over ‘their turf’.  You have to accept that they do not see the world the way that you do. To them you are simply an anonymous target; a bit like those legs dangling in the ocean in front of a shark.

The main problem is that very strong human belief that 'it will never happen to me'.  Every single crime victim is a 'Me'.

 A news item from Sydney in January 2003 reported on a thief stealing from a vehicle stopped at the red lights.   It would have been somewhat of a surprise when he checked his booty, as the driver was a registered snake catcher and was returning from a job with a red-bellied black snake in the bag that was taken.   In this case the victim of theft probably never considered that anyone would attempt to steal from his vehicle whilst he was in it and the thief, of course, would never have considered that his booty resulting from a crime could attack him.

To reduce this type of risk and other crime threats there are a few easy steps that anyone can adopt that can reduce or remove the risk.

a. ENVIRONMENTAL CONTROL: Control your environment by being aware of your immediate and proximate surroundings and being able to react to any apparent potential threat. If the criminal wants to mug you, steal from you, pick your pocket, sell your kids some drugs, they must take control of the environment in which they are to operate. They might do this by stealth or by force.   By controlling your environment, you take the initiative away from them.

b. ENVIRONMENTAL AWARENESS: Think about it like this, if I am aware of my environment I will be able to react to anomalies.  Get to know what is happening around you.  Be aware of the normal pattern of life in your neighborhood so that unusual patterns or people will stand out.  Harden the security on your home or business then look outside of this perimeter at the environment that you live and work in.

c. CONSCIOUS SELF-INTERROGATION: This is self-explanatory. As you drive your car or walk, along the street where you live, on your route to work, wherever; ask yourself, consciously what is going on around you, who else is also driving or walking within your local environment? Are those persons standing on the corner legitimate pedestrians, or watching the behaviour of residents or businesses?  Police patrols and professional Security Officers always carry out self-interrogation  whilst working as a matter of street survival.  

Make sure you do it consciously, just to make sure that you are keeping up the habit and after a while, your subconscious will take over.   Healthy suspicion may avoid placing yourself in a position of risk.

d. CORRIDORS AND PATTERNS: Ever heard the saying that 'we're slaves to habit'? It's true. We oscillate between known points; home, work, the bank, schools and we go to them at given times and along favourite routes. This plays into the hands of criminals.  Vary your routine.  Watch for corridors that afford the criminal any advantage.  This includes intersection stop signs, traffic control lights etc.  They all afford criminals and terrorists the advantage of time whilst the target has their attention elsewhere.   Many thefts, car-jacking and assassinations have occurred at intersections and traffic lights’.   Be aware of your environment and what is occurring around you.

e. LEAVING AND APPROACHING YOUR CAR: This is particularly important in parking lots. Imagine you are at a shopping centre and you are driving into the parking area.    This is an area where many people develop patterns or create corridors of opportunity for criminals.

Get into your well-lit parking place as quickly as possible and then get out of your car and stand up as quickly as possible, gaining control your environment once more. Remember that if you are bending down peering at the lock you are surrendering environmental control. After locking up, walk briskly away from your car, observing who is watching you. You don't have rear view mirrors, so consciously turn around and look at your sides and behind you. An observer with ill intent will note that you are alert and, in most cases, will look for an easier target, but don't let this make you 'cocky' they will still have a go if they don't find easier pickings.

Inevitably your going to come back to your car, so as you walk out of the supermarket, the hairdresser, restaurant, you must once more interrogate the area around your car. Do not walk directly to your car, go away from it, at an angle so that you can keep it visual and watch for any reactions in the people around. Once you are happy that the area is clear, walk back to your car from a different direction.

Walk to your car as quickly as possible, unlock it while standing upright, get in the car, lock it and get out of there. If you are carrying goods, stay upright as much as possible and put things in the car from a standing position. Do not lean into the car and thus make yourself vulnerable. .  Having two people can assist here as one can always remain alert whilst the other packs the car.  If you have a remote electronic central locking system, make sure that locking and unlocking is accompanied by a minimum of flashing lights and certainly make sure that your car does not make any bleeping sounds. That will alert anyone in the parking lot that someone with the means to open the car and drive it away is approaching a specific vehicle and that makes you vulnerable to the opportunist

f. ON FOOT: We previously looked at controlling your environment when out of your car.  Using this principle should also enable you to identify areas you should stay out of; alleys, bushy areas, unlit areas, shanty areas where environmental clutter makes it hard to control the environment. You just don't go there without adequate protection.  Ask any expert self defence exponent, what they would do if four men attacked him or her whilst alone in a dark alley. Their response would most likely be that they wouldn't be alone in a dark alley. That's the best possible rule of thumb; if you can't control it, don't go there.  

Studies and practical implementation overseas has revealed that street and other overhead lighting has dramatically reduced the level of crime in those areas that have adopted this strategy.   It also dramatically reduced the fear factor of people going out at night in those same areas.   Lighting is a primary tool in Crime Prevention Through Environment Design and should be considered as a matter of priority by Councils responsible for areas of high crime risk.   Lighting assists in bringing control of the night away from criminals and back to the community and as ratepayers you have a right to live in a safe environment.

When crossing the street in a built-up part of town in a reasonably developed part of the world, you can use shop windows as mirrors if the lighting is right, but it still pays to have the odd look behind you, just so they know you are alert.

Maintaining control of your environment is particularly important at ATMs, which are constantly observed by opportunist thieves. Don't fixate on the screen, examine the screen before you start work, look for any tampering with the machine, but at all times, look around you every couple of seconds. In this instance, as in all other situations, you must have your escape route planned.  If you don’t feel safe, simply walk away.  Trust your intuition when you feel you may be in danger.  Intuition or gut feelings can be more often right than they are wrong.

When using mobile (cellular) phones, it's best to stand with your back to a flat high wall. A shop window is good. Now you only have to sweep through 180 degrees. But remember when you walk off, your environment is 360 degrees again, because some interested party has just seen you use that phone…

Crime will not go away.  We must therefore attempt to control it by reducing the opportunity, increasing the risk of detection and capture. Making the criminal act less desirable to all bar the most desperate offenders.   This can be achieved by being crime & security aware and taking control of your environment.

Crime Prevention for Senior Citizens

It is clear that criminals see senior citizens as soft targets. However, just because senior citizens are vulnerable does not mean they have to be completely helpless.  

Here are some crime prevention tips for our elderly. 

Personal safety at home:

1. Never open your door automatically. Install and use a peephole or use a CCTV system to see who’s there if you have a solid door. Alternatively, install a chain lock that allows you to see who is at the door without it being opened all the way and preventing forced entry.

2. Lock your doors and windows. (Many burglaries involving older persons, similar to all other age groups, involved unlocked doors and windows).  If you have a security door; keep it locked even whilst conversing with strangers. Keep your garage doors locked also.

3. Vary your daily routine.

4. Use “Neighbourhood Watch” to keep an eye on your neighbourhood. A concerned neighbour is often the best protection against crime, because suspicious persons and activities are noticed and reported to police promptly.

5. Don’t leave notes on the door when going out.

6. Leave lights on when going out at night. When you are gone for more than a day, make sure your home looks and sounds occupied; use a timer to turn lights on and off when you are away for an extended period.

7. Notify neighbours and the police when going away on a trip. Cancel deliveries such as newspapers and arrange for someone – a neighbour’s child, perhaps – to mow the lawn if need be. Arrange for your mail to be held by the Post Office or ask a neighbour to collect it for you.

8. Be wary of unsolicited offers to make repairs to your home. Deal only with reputable businesses. Look them up on the Internet, talk to other clients or give the company a call to establish their bona fides.

9. Keep an inventory with serial numbers and photographs of re-saleable appliances, antiques and furniture. Leave copies in a safe place.

10. Don’t hesitate to report crimes or suspicious activities.

11. Install deadbolt locks on all your doors and install window locks, where possible.

12. Keep your home well-lit at night, inside and out; keep curtains closed. Use of motion activated lighting is always useful in deterring 'would be' thieves. These can be used both inside your house or apartment as well as outside. They can provide both safety inside the residence as well as crime detection.

13. Ask for proper identification from strangers who arrive asking for donations or offering work to be done. Don’t be afraid of asking … if they are legitimate, they won’t mind.

14. If a stranger asks to use your telephone, offer to place the call for him or her yourself. Do not let them inside the house.

15. Never let a stranger into your home,

16. Do not hide your keys under the mat or in other conspicuous places. Thieves know them all.

17. Never give out information over the phone indicating you are alone or that you won’t be home at a certain time.

18. If you arrive at home and suspect a stranger may be inside, do not go in. Leave quietly and call 000 to report the crime.

Personal safety when out walking:

19. Walk purposefully and maintain situational awareness of the area and those also in the area.

20. If you are attacked on the street, make as much noise as possible by calling for help or blowing a whistle. Do not pursue your attacker. Call 000 and report the crime as soon as possible.

21. Avoid walking alone at night. Try to have a friend accompany you in high risk areas … even during the daytime.

22. Avoid carrying weapons. They may be used against you.

23. Always plan your route and stay alert to your surroundings. Walk confidently.

24. Stay away from buildings and doorways; walk in well-lit areas.

25. Have your key ready when approaching your front door.

26. Don’t dangle your purse away from your body. (Many crimes against the elderly are handbag/ wallet snatchings and street robberies.)

27. Don’t carry large, bulky shoulder bags; carry only what you need. Better yet, sew a small pocket inside your jacket or coat. If you don’t have a handbag, no one will try to snatch it.

Personal safety while shopping: 

28. Carry your handbag very close to you … don’t dangle it from your arm. Never leave it in a shopping cart. Never leave your handbag unattended.

29. Don’t carry any more cash than is necessary. Most stores accept debit or credit cards instead of cash.

30. Don’t display large sums of cash.

31. Watch out for thieves who may attempt to steal your shopping.

32. Be aware of your surroundings and those who are in your vicinity. Thieves do not like being eye-balled, as it can aid in their identification.

Protect your finances: 

33. Be aware of who is close to you when using ATM’s. Keep your PIN and amount being collected private. Have a friend with you, if possible.

34. Be wary of con artists and get-rich schemes that probably are too good to be true.

35. Store valuables in a Safety Deposit Box (if available).

36. Never give your money to someone who calls on you, identifying himself as a bank official. A bank will never ask you to remove your money.

37. Banks don’t want one of their customers to invite crime by having large amounts of cash around the house. Get it into a bank account.

38. Never fall for the trick of paying fines to Police by going to the bank with them to withdraw money for the fine.

39. When someone approaches you with a get-rich-quick-scheme involving some or all of YOUR savings, it is THEIR get-rich-quick-scheme. If it is a legitimate investment, the opportunity to contribute your funds will still be there tomorrow – after you have had time to consider it.

40. If you have been swindled or conned, report the crime to your local police as soon as possible. Con artists count on their victim’s reluctance to admit they’ve been duped, but if you delay you help them get away. Remember, if you never report the crime, they are free to cheat others again and again and you have no chance of ever getting your money back.

41. When in doubt…..Protect your finances and ‘don’t commit yourself’ to anything.

Personal safety whilst in your vehicle: 

42. Always keep your car doors locked, whether you are in or out of your car. Keep the fuel tank full and your engine properly maintained to avoid breakdowns.

43. If your car breaks down, pull over to the left as far as possible, raise the bonnet, return to the vehicle cabin, lock it and call for help. Wait INSIDE the car for help. Avoid getting out of the car and making yourself a target before help arrives.

44. At stop signs and traffic lights, keep the car in gear.

45. Travel well-lit and busy streets. Plan your route.

46. Don’t leave your handbag/ wallet on the seat beside you; put it on the floor, where it is more difficult for someone to grab it.

47. Lock bundles or bags in the boot. If interesting packages are out of sight, a thief will be less tempted to break in to steal them.

48. If you have an audible central locking system, ask a mechanic to disable the audible alarm part, as it can allow thieves to target you as you approach your vehicle.

49. When returning to your car, check the front and back seat before entering.

50. If possible, never bend over to place items in the vehicle as it leaves you exposed to attack. Have someone with you, if possible, to reduce the risk.

51. Never pick up hitchhikers.

 STAY ALERT AND STAY SAFE

Establishing Business Impact Levels and Risk Tolerance for your business.

Depending on the planning and investment in business plans and risk management, small business can flourish or die if the impact of an event or incident directly impacts on their operations or financial resilience.

Family and micro businesses are especially vulnerable as even a small loss due to repetitive incidents such as burglary, break and enter and shop stealing; or a reduction in family or other employees needed to operate the business due to injury, illness or death, will have a critical impact on cash flow and business operations. A critical impact then can be broken down as any hard dollar or reputational loss that could endanger the survival of the company.

The loss of stock, through fire, can be mitigated through insurance but the loss of customer/client information and listings through commercial espionage or loss of stock and client electronic data through a cyber crime ransomware attack can impact on your businesses reputation and operations.

Operations may also be interrupted by natural events, damage or breakdown of machinery, systems or equipment, power or gas outages, fuel delivery strikes, the failure of a supplier of goods or services or delayed deliveries or absenteeism of essential employees. There are many possible scenarios which should be considered such as:

Some quantifiable impact categories for a small retailer could include:

·         Inability to record sales

·         Inability to accept returns

·         Inability to process debit or credit cards, cheques (checks), gift cards, certificates

·         Inability to replenish merchandise

·         Inability to move merchandise between locations

·         Inability to respond to customer communications

·         Inability to advertise

A manufacturing company may see quantifiable impact categories as including:

·         Inability to order materials

·         Inability to receive materials

·         Inability to assemble materials

·         Inability to advertise products

·         Inability to process orders

·         Inability to ship products

·         Inability to collect payment[1]

 It is incumbent on all business owners to understand their risk tolerance and by identifying and evaluating the impact of disasters on business, owners can establish the basis for investment in recovery strategies as well as investment in prevention and mitigation strategies. To do this you need to have developed a risk management plan.

Once you have developed a risk management plan, you should conduct a business impact analysis to assess the likely impact of these risks on your business operations. This is the preparedness step in the prevention, preparedness, response and recovery (PPRR) model[2] for developing a business continuity plan. A business impact analysis identifies the activities in your business operations that are key to its survival.

Business owners should recognise that a business impact analysis (BIA) is a continuous process that predicts the consequences of disruption of a business function and process and gathers information needed to develop recovery strategies. Potential loss scenarios should be identified during a risk assessment. It is not a one-off process.

We don’t conduct one BIA report then step back from it for a year or so. It needs to be constantly monitored to take into consideration changes in the sales, production or security environment. As crime changes and moves from areas of a city or region, threats levels will change and as many small enterprises have found, a series of break-ins, caused by displaced crime, can change the financial state of a small business in a very short time and threaten its continued viability.

The first step in developing your analysis is to ask yourself some key questions:

·         What are the daily activities conducted in each area of my business?

·         What are the long-term or ongoing activities performed by each area of my business?

·         What are the potential losses if these business activities could not be provided?

·         How long could each business activity be unavailable for (either completely or partially) before my business would suffer?

·         Do these activities depend on any outside services or products?

·         How important are the activities to my business?

As the risks to your business change, so too will their potential impacts. When you update your risk management plan, you will also need to conduct a new business impact analysis.

Seek advice from all levels of your business in order to identify all processes and functions that go into making your business function, then, ask yourself these questions:

·         what could occur if this function of my business was unable to function for any reason?

·         where could critical financial impact occur and what is the potential amount of the impact?

·         where could critical reputational impact occur and what is the potential amount of the impact?

·         under what circumstances could a critical impact occur? and

·         what is the effect of the impact over a lifetime?

 Let’s look at an example of a small business that produces widgets for the mining industry. The widgets are high use and replaced every week to be refurbished by the manufacturer. If we have a crisis and are unable to supply the widgets, mining companies will understand a delay of a few days by adjusting equipment operation to reduce wear on existing widgets, but some may not be able tolerate a delay and may be forced to reduce or cease operations until supply is re-established. The cost to mining companies could be very high but the cost to the small business could be catastrophic if its reputation is damaged by the crisis that results in companies seeking alternate suppliers.

Business continuity and business resilience that arise from BIA reports are critical in ensuring you can weather a crisis and whilst bringing in expert consultants to work with you to develop your report on the results of a BIA is a good practice, you can assist by preparing BIA Worksheets that can greatly assist in bringing critical functions to the fore and allowing you to understand the real impact of events on your business.

A business Impact Analysis Worksheet allows you to look at each function, department or process and identify at which point in time, an interruption would have the greatest impact. Each worksheet should be developed for each department, function or process that you have identified. A simple example is shown below:

Business Impact Analysis Worksheet[3]

Department / Function / Process……………………………………………………………

Operational & Financial Impacts

Timing/Duration	Operation Impact	Financial Impact
Timing: Identify point in time when interruption would have greater impact (e.g., season, end of month/quarter, etc.) Duration: Identify the duration of the interruption or point in time when the operational and or financial impact(s) will occur. •   < 1 hour •   >1 hr. < 8 hours •   > 8 hrs. <24 hours •   > 24 hrs. < 72 hrs. •   > 72 hrs. •   > 1 week •   > 1 month	Considerations (customize for your business) Operational Impacts: •  Lost sales and Income •  Negative cash flow resulting    from delayed sales or income •   Increased expenses (e.g. overtime, outsourcing, expediting costs etc) •   Regulatory fines •  Contractual penalties or loss of contractual bonuses •   Customer dissatisfaction or defection •   Delay executing business plan or strategic initiative	Financial Impact Quantify operational impacts in financial terms.

As part of your business impact analysis, you should assign recovery time objectives to each activity to help determine your basic recovery requirements. The recovery time objective is the time from when an incident happens to the time that the critical business activity must be fully operational in order to avoid damage to your business.

By identifying a time frame necessary to recover and financial amounts to measure your risk appetite where you feel that the business can recover, you can add the information to the table (such as in the above example) to provide better context upon which to base your assessment of priorities for mitigation.

The information resulting from the BIA can be used to bring some local clarity to your consequence rating on your risk management matrix. The table based on ISO31000:2009 below provides a simplified example of how the BIA could be used when applied to business operations, creating your business impact level (BIL).

Minimal BIL-1	Minor BIL-2	Moderate BIL-3	Major BIL-4	Catastrophic BIL-5
Impacts on business operations
Operational capacity
·   Minimal impact on operations. Some reduction on function or process effectiveness but can be dealt with by routine procedures in place.	·   Minor impact on operations. Some reduction on several functions or processes effectiveness but can be dealt with by routine procedures in place.	·  Significant degradation in organisational capability to an extent and duration that, while the business can perform its primary functions, the effectiveness of the functions is noticeably reduced	·  Severe degradation in, or loss of, business capability to an extent and duration that the business cannot perform one or more of its functions for an extended time	·   Severe degradation in, or loss of, business capability to an extent and duration that the business cannot perform any of its functions. ·   Business closure likely.
Business Assets
·   Low or no damage to assets	·   Some damage to assets that will affect functions or processes whilst replacements are obtained. ·   Time frame for replacement >3 months.	· Damage to assets that result in multiple functions or processes that reduces productivity until replacements can be obtained. · Time frame for replacement <3 – 6 months.	·  Damage to assets that results in long term harm to the business. ·  Time frame for replacement <6 months.	·   Damage to assets that are irreplaceable or beyond financial capacity to replace.
Business Finances
·   Low or no financial loss	·   Medium financial loss that does not impact on the ability or capability to meet financial obligations. ·   $100,000 - $500,000	·  Financial losses are covered by insurance and recoverable within a short term but will have a short-term effect on capability. Potential regulatory attention. ·  >$500,000 - $800,000	·  Substantial financial loss leading to key activities being shelved and loss of public/shareholder confidence. Likely regulatory attention. ·  >$800,000	·    Significant financial loss leading to significant damage to the organisations 'brand' and ability to operate. Significant regulatory attention. ·    >1000,000

Note: Estimated financial losses based on micro business model requiring a reliable cash flow.

The information that arises can be used to:

·         evaluate whether the limits of insurance are adequate. Are you underinsured?

·         compile an inventory of properties and assets and determine whether insurable values reflect inflation costs over time, and

·         allow a review of whether property, stock and other insurance policies adequately cover actual cash value or replacement cost.

It can also provide you an overview of just where you need to improve your supply chain to ensure stock, plant or equipment can be replaced within a minimal timeframe to ensure business resilience.

The BIA can assist in allowing you to properly determine just what your risk tolerance level is. A small micro business (such as an on-line business or a restaurant) may have a risk tolerance of BIL2 whilst a medium size business, with a sound client base, good supply chain and regular cash flow may be able to tolerate BIL-3. Each business differs, and each risk tolerance level will differ.

Your mitigation strategies and security investment will, in most cases, align with your level of risk tolerance in which case second guessing would be a dangerous strategy but undertaking a BIA to determine consequences and business impact levels will provide you with quantifiable evidence upon which to make business decisions. Your business impact analysis will also help you develop your recovery plan, which will help you get your business running again if an incident does happen.

Like your Business Plan and Risk Management Plan, your Business Impact Analysis is a tool that can provide you an element of certainty during periods of crisis.  As Benjamin Franklin stated in his Philadelphia address on fire safety, “an ounce of prevention is worth a pound of cure”.

It is as true today as it was in 1736.

---

[1] https://www.ready.gov/business-impact-analysis

[2] https://www.business.qld.gov.au/running-business/protecting-business/risk-management/pprr-model

[3] https://www.ready.gov/business-impact-analysis