SECURITY PROFESSIONALS’ ETHICAL AND BEHAVIOURAL STANDARDS

SECURITY PROFESSIONALS’ ETHICAL AND BEHAVIOURAL STANDARDS

All security professionals and organisations must operate to the highest ethical values to engender trust in all those they encounter in a professional capacity.  

Given the security industry’s high profile, A Code of Ethical Conduct sets a standard that security professionals shall adhere to in their working habits and professional relationships.

The values on which it is based apply to all situations in which Security Professionals participate and exercise their judgement. 

Security Professionals Code of Conduct

A Code of Ethical Conduct requires out that a security professional must operate to the highest ethical standards with all those they encounter in a professional capacity and shall:

a.      Act in the interests of the security of society and their client.

A security professional shall:

i.    act honourably, responsibly, diligently, lawfully and uphold the reputation, standing and dignity of the Security Profession within society.

ii.      not act recklessly, maliciously or in a manner that will negatively impact on the reputation of other individuals or organisations

iii.    act in the interests of the security of society and their client.

iv.   act honourably, responsibly, diligently, lawfully and uphold the reputation, standing and dignity of the company, employer or client to which the security professional has a professional or legal association.

b.      Perform their duties in accordance with the law at all times.

A security profession shall:

i.    act in accordance with the laws of the jurisdiction(s) in which they are performing professional services.

ii.      hold paramount the health, safety and security of others.

c.      Act and behave at all times with integrity.

 

A security professional shall:

i.      not abuse a professional position for personal gain and reject improper inducement.

ii.     avoid conflicts of interest.

iii.  avoid deceptive acts by actively taking steps to prevent corrupt practices or professional misconduct.

d.      Be diligent and competent in discharging their professional responsibilities.

A security professional shall:

i.       act for their employer or client in a reliable and trustworthy manner.

ii.      never knowingly mislead or allow others to be misled.

iii.  maintain currency in their security competencies through continued education and private research.

e.      Protect confidential information gained in the course of their professional activities and not disclose it to any unauthorised party nor use it for personal gain.

A security professional shall:

i.     protect client information in accordance with client information security policy.

ii.     apply effective physical, procedural and IT controls to protect client or employer information in their care from unauthorised release.

iv.   implement and follow processes for the clearance of partners, employees, contractors and other stakeholders in accordance with the classification of client or employer information accessed 

v.     apply the need-to-know principle.

f.       Not maliciously damage the professional reputation or practice of colleagues, clients or employers.

A security professional shall:

i.  refrain from unfounded criticism of work carried out by Security Professionals.

ii.      refrain from action deliberately designed to damage a colleague, client or employer.

g.      Not knowingly undertake any action that brings the profession into disrepute.

A Security Professional shall:

 i.   be objective and truthful in any statement made in their professional capacity.

ii.   act honourably, responsibly, diligently, lawfully and uphold the reputation, standing and dignity of the profession.

iii.      not engage in acts of collusion, corruption or breaches of the Law.

iv.       be a positive role model for others in the profession.

Crime Prevention in Cyberspace

In the early years of most nations, criminals have robbed individuals, stage coaches, trains and banks. Why? Because that’s where the money is. In the 20th and 21st century, with the coming of the internet age, criminal conduct has expanded dramatically to include new types of crime such as fraud, theft, identity theft, blackmail and espionage conducted through cyberspace.  We term this as cybercrime. Cyberterrorism can arise from the same groups, but we will only look at cybercrime at this time.

Cybercrime can be far reaching with long-term effects; from the impact on organisations resulting from the theft of intellectual property or business secrets to the consequences that identity theft can have on an individual, including credit standing and loss of personal resources or loss of personal identity.
 

Responding to cybercrime is even more challenging because the economics favour the criminals. With just a laptop, a single individual anywhere in the world can wreak havoc on individuals and organisations with minimal cost and little risk of being caught. As more advanced technologies and protective measures are developed it may eventually level what has become an unbalanced playing field but in the meantime, it is imperative that all digital users practice basic cybersecurity practices to increase their own protection and improve cybersecurity overall.  

Protection of business information systems

In business, your system protection will start with well-defined policies on the use of internet connected devices in the workplace or when working out of the office. Education and awareness across your staff will go a long way to protect yourself against many types of cybercrime.

Do all your employees understand the most common hacking tactics, such as phishing, social engineering, or packet sniffing.

Do they understand your company policies around protection of information and information systems?  Do they understand and comply with the company social media policy?

Is your information system well configured and your network secure, ensuring the confidentiality, integrity and availability of your data? Is all software housed within your network continually up to date? Exploits in software are very common ways hackers gain access to systems and sensitive data. Updating software on network-connected machines should always be a top priority.

Do you have business-class antivirus software installed (and up to date) on all office workstations and servers? Leading antivirus software can detect, remove, and protect your machines and network from malware. Do you scan your website or web applications for malware? 

Do you have reliable IT support who maintain ongoing awareness of evolving threats and the latest mitigation treatments for cybercrime?

Do you have reliable backups of all of your critical data? Recovering from many types of common cybercrimes often involves restoring your data from a point prior to the event in question. Not having reliable and securely stored backups of your data is a significant liability.

Businesses that have contracts with government agencies are seen by hostile cyber aggressors as soft targets, allow them the potential to gain information that would otherwise be difficult to get from protected government information systems. All information shared by government agencies must be protected from compromise either from data leakage or deliberate or accidental human compromise. Companies should work closely with government agency security advisers to ensure that data is protected to a standard required by the information owner or government agency.

Home computer users

For home users, many of the same rules apply.  One of the best ways to keep attackers away from your computer is to apply patches and other software fixes when they become available. By regularly updating your computer, you block attackers from being able to take advantage of software flaws (vulnerabilities) that they could otherwise use to break into your system. 

While keeping your computer up-to-date will not protect you from all attacks, when used with difficult passwords it makes it much more difficult for hackers to gain access to your system, blocks many basic and automated attacks completely, and might be enough to discourage a less-determined attacker to look for a more vulnerable computer elsewhere.

Operating systems, Web browsers and Email

More recent versions of popular operating systems can be configured to download and apply updates automatically so that you do not have to remember to check for the latest software. Taking advantage of "auto-update" features in your software is a great start toward keeping yourself safe online.

Keep in mind that a newly purchased computer may not have the right level of security for you. When you are installing your computer at home, pay attention not just to making your new system function, but also focus on making it work securely. 

Configuring popular Internet applications such as your Web browser and email software is one of the most important areas to focus on. For example, settings in your Web browser will determine what happens when you visit Web sites on the Internet. The strongest security settings will give you the most control over what happens online but may also frustrate some people with a large number of questions ("This may not be safe, are you sure you want do this?") or the inability to do what they want to do. 

Choosing the right level of security and privacy depends on the individual using the computer. Oftentimes security and privacy settings can be properly configured without any sort of special expertise by simply using the "Help" feature of your software or reading the vendor's Web site. If you are uncomfortable configuring it yourself consult someone you know and trust for assistance or contact the vendor directly.

Passwords

Passwords are a fact of life on the Internet today—we use them for everything from ordering flowers and online banking to logging into our favourite airline Web site to see how many miles we have accumulated. 

Selecting a password that cannot be easily guessed is the first step toward keeping passwords secure and away from the wrong hands. Strong passwords have eight characters or more and use a combination of letters, numbers and symbols (e.g., # $ % ! ?). Avoid using any of the following as your password: your login name, anything based on your personal information such as your last name, and words that can be found in the dictionary. Try to select especially strong, unique passwords for protecting activities like online banking.

Keep your passwords in a safe place and try not to use the same password for every service you use online.

Change passwords on a regular basis, at least every 90 days. This can limit the damage caused by someone who has already gained access to your account. If you notice something suspicious with one of your online accounts, one of the first steps you can take is to change your password.

It is recommended that users monitor improvements in biometrics and physical tokens to use with passwords to provide two factor (dual factor) authentications. A fingerprint reader or other technology, combined with password, will provide a higher level of security for your computer or system.

Dual factor authentication 

Two-factor authentication (2FA), sometimes referred to as two-step verification or dual factor authentication, is a security process in which the user provides two different authentication factors to verify themselves to better protect both the user's credentials and the resources the user can access. Two-factor authentication provides a higher level of assurance than authentication methods that depend on single-factor authentication (SFA), in which the user provides only one factor -- typically a password or passcode. Two-factor authentication methods rely on users providing a password as well as a second factor, usually either a security token or a biometric factor like a fingerprint or facial scan.

Two-factor authentication adds an additional layer of security to the authentication process by making it harder for attackers to gain access to a person's devices or online accounts, because knowing the victim's password alone is not enough to pass the authentication check. Two-factor authentication has long been used to control access to sensitive systems and data, and online service providers are increasingly using 2FA to protect their users' credentials from being used by hackers who have stolen a password database or used phishing campaigns to obtain user passwords.

The technology involve in dual factor authentication is improving all the time and it is important that those looking at implementing such security protection measures seek expert insight into the latest and most secure measures on the market.

Security software

Several types of security software are necessary for basic online security. Security software essentials include firewall and antivirus programs. A firewall is usually your computer's first line of defence as it controls who and what can communicate with your computer online. You could think of a firewall as a sort of "policeman" that watches all the data attempting to flow in and out of your computer on the Internet, allowing communications that it knows are safe and blocking "bad" traffic such as attacks from ever reaching your computer. 

The next line of defence is your antivirus software, which monitors all online activities such as email messages and Web browsing and protects an individual from viruses, worms, Trojan horse and other types malicious programs. More recent versions of antivirus programs also protect from spyware and potentially unwanted programs such as adware.

Having security software that gives you control over software you may not want and protects you from online threats is essential to staying safe on the Internet. Your antivirus and antispyware software should be configured to update itself, and it should do so every time you connect to the Internet.

Integrated security suites combine firewall, antivirus, antispyware with other features such as antispam and parental controls have become popular as they offer all the security software needed for online protection in a single package. Many people find using a security suite an attractive alternative to installing and configuring several different types of security software as well as keeping them all up-to-date.

 

Protecting personal information

Exercise caution when sharing personal information such as your name, home address, phone number, and email address online. To take advantage of many online services, you will inevitably have to provide personal information in order to handle billing and shipping of purchased goods. Since not divulging any personal information is rarely possible you should, where possible, only deal with reputable e-commerce sites and monitor any unusual activity that may indicate that security of your information has been compromised.

Keep an eye out for phony email messages. Things that indicate a message may be fraudulent are misspellings, poor grammar, odd phrasings, web site addresses with strange extensions, web site addresses that are entirely numbers where there are normally words, and anything else out of the ordinary. Additionally, phishing messages will often tell you that you have to act quickly to keep your account open, update your security, or urge you to provide information immediately or else something bad will happen. Don't take the bait.

Don't respond to email messages that ask for personal information. Legitimate companies will not use email messages to ask for your personal information. When in doubt, contact the company by phone or by typing in the company web address into your web browser.

Don't click on the links in these messages as they may take you to a fraudulent, malicious web sites.

Steer clear of fraudulent Web sites used to steal personal information. When visiting a Web site, type the address (URL) directly into the Web browser rather than following a link within an email or instant message. Fraudsters often forge these links to make them look convincing.

A shopping, banking or any other Web site where sensitive information should have an "S" after the letters "http" (i.e. https://www.yourbank.com.au not http://www.yourbank.com)/. The "s" stands for secure and should appear when you are in an area requesting you to login or provide other sensitive data.

Another sign that you have a secure connection is the small lock icon in your web browser bar similar to below.

Pay attention to privacy policies on Web sites and in software. It is important to understand how an organisation might collect and use your personal information before you share it with them.

Guard your email address. Spammers and phishers sometimes send millions of messages to email addresses that may or may not exist in hopes of finding a potential victim. Responding to these messages or even downloading images ensures you will be added to their lists for more of the same messages in the future.

Online offers that look too good to be true usually are. The old saying "there's no such thing as a free lunch" still rings true today. There are many enticing hooks (scams) used by companies to grab your attention that can lead to your computer being compromised or your bank account being raided. Be aware and very careful when online.

Social media safety

You need to think carefully about how much information you share on social media sites, and who is able to see it. While most people who use social networking sites are well intentioned, there are others out there who may copy, forward or save your information to embarrass you, damage your reputation, or steal your identity. Once something goes online, you have very little chance of deleting it.

Keep in mind that the information that you provide on social; media can be harvested by criminals to create false identities, thus stealing your identity. Use of Pseudonyms and false dates of birth can reduce the risk, however, without making a concentrated effort to limit personal information across web sites, it is still possible to accidentally place yourself at risk.  Practice good personal security and you can protect yourself and your family.

The Australian Cybercrime Online Reporting Network (ACORN) recommends the following practical tips for staying safe while using social media.

•                 always type your social media website address into your browser,

•                 never use the same password that you use for your bank or email accounts,

•                 have a different password for each social media site,

•                 only accept friend requests from people you know,

•                 avoid clicking on links in ‘friend request’ emails,

•                 be careful about how much information you share online and with whom, and

•                think before you post – how could your post affect you and others, now and into the future.

Use of Virtual Private Networks

A virtual private network (VPN) extends a private network across a public network and after recent information breaches that have been reported in the media, is becoming popular across the world enabling users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. VPNs, alone, cannot make online connections completely anonymous, but they can usually increase privacy and security.  Not all VPN’s are the same so careful selection is necessary if businesses or individuals wish to use the technology. Where necessary, use of end-to-end encryption that many VPN’s now provide, can be used to enhance the protection of data being transmitted, which will provide an additional layer of protection.

Businesses, especially that operate internationally, should be aware that as VPN’s are becoming more popular, some nations are blocking them to allow government agencies to monitor data traffic, that may lead to compromise of protected data. It is important to maintain awareness of any changes in government attitudes that may potentially, result in a weakening of your information systems security.

Your part in cybercrime prevention

As technology increases our links to the world and enters our homes and personal lives more and more, with smart home automation, network connected medical devices and intelligent software in the modern vehicle; the risk of cybercrime increases. We must all gain an understanding of the risks and how we can protect ourselves from them.

Firewalls and virus protection along with encryption that will protect the operating system and network provides a layer of security that must be supported by the human element. The insider threat or human individual remains the single primary threat to our connected world. Be it the programmer that makes a mistake in their coding that allows an attacker to gain access to systems or users who disregard basic security rules such as strong passwords, that allow systems to be compromised.  All can undo any security system designed to prevent cybercrime.

By understanding how cybercrime can occur and by ensuring that our business systems or home computers are as secure as we can make them and practicing sound personal security when online (including social media sites) we can all assist in mitigating the risk.

Australian Cybercrime Online Reporting Network (ACORN) and other nations Cyber agencies.

Advice on protecting businesses and individuals from cybercrime or how to report cybercrime can be obtained from ACORN
 (https://www.acorn.gov.au/), a national policing initiative of the Australian Commonwealth, State and Territory governments.

For US residents, the National Cyber Awareness System at https://www.us-cert.gov/ncas provides similar services.

The European Union Agency for Network and Information Security (ENISA) is a centre of expertise for cyber security in Europe. The Agency is located in Greece with its seat in Heraklion Crete and an operational office in Athens. Information is available from https://www.enisa.europa.eu/. 

Interpol have a cybersecurity centre that provides advice to most countries including the Asia Pacific region and can be found at https://www.interpol.int/Crime-areas/Cybercrime/Online-safety.

A quick search of your nations websites will allow you to locate information relevant to you.

Cybercrime prevention provides a sound return on investment for a nation’s economy and gives individuals confidence in having a safe and secure connection to the world.

Some thoughts on the creation of a Darwin City Council Crime Prevention Working Group/Crime Prevention Fusion Centre

Unlike many other Australian Councils, Darwin City Council does not have a dedicated crime prevention group embedded within their committees and working groups in Council.

Current alliances are maintained through having a representative on the Neighbourhood Watch NT Board and other government and NFP crime prevention groups, relying on external agencies to take the weight of crime prevention within Council electorates.  

When one considers that crime affects us all and it is the responsibility of all levels of government, and the community, to play their part in reducing crime, having a crime prevention fusion centre/crime prevention working group established within Council can provide an enabling effect for many of these groups and reduce the silo effect that such disparate bodies are vulnerable to.  

Having a Council embedded crime prevention working group/fusion centre allows for a progressive group, working closely with local police, the liquor board and NFP crime prevention organisations along with businesses, local education providers and community groups, to look at initiatives that can tackle crime within our community and identify strategies that may assist reducing the root cause of much of the crime.

The popular Crime Prevention Through Environmental Design (CPTED) is just one tool that can be applied to environments that allow crime to prosper however, it is not a stand-alone tool and total reliance on this model can be counter-productive. 

Some CPTED tools used by CPTED auditors can allow a tick and flick mentality to become prevalent in auditors that can leave gaps in what is understood about vulnerabilities in the target area. There have also been overseas studies that have revealed that criminals have adapted CPTED to assist them in committing crimes through using the very principles that are designed to protect people to that of a tool to target people, who believe that they are safe.

It is essential then that public agencies not get blinded by CPTED as the optional solution. They must expand their options to get better value for the effort put in to reducing crime. CPTED is a great initiative but is only one of many initiatives that will reduce crime, taking into consideration that criminals only require a desire, ability and opportunity to commit any crime, there is scope to develop many different strategies to change the status quo.

All government and non-government bodies must understand that strategies that reduce crime can include a wide range of initiatives, not just policing.  We must involve multi elements within our Darwin community including business, education, Larrakia Nation and community groups, supported by Territory and local government to get valid input into workable initiatives.

Elected officials and Council officers seconded to local and government organised crime prevention groups must have a sound knowledge of crime prevention in order to provide valued insight and input into group deliberations.  This will require training and education being offered to those seconded.

Council must also ensure that Regulations and By-Laws are either in place or enacted to support crime reduction strategies and the work of the group, with funding from other levels of government to support the work.

Council media must also promote the work of the group in an open and transparent manner that ensures the public knows what actions and initiatives are being developed to reduce crime and thus support the reduction of crime in the Darwin region. Failure to promote the work of the group would be counter-productive and lead to concerns about hidden agendas, secrecy etc from the public and business.

Darwin City Council can either:

a.    take the lead in developing a coordinated effort to reduce crime in the Darwin region, or

b.    can sit back and let others tackle the problem in isolation, providing token interest, through observers and Council representatives that provide the perception of a dedicated interest in the deliberations and initiatives proposed by the disparate groups. 

It’s now the time for Darwin City Council to create a unified, inclusive crime prevention working group/fusion centre within Council and be the progressive and pro-active body that the community expects.

CRIME & SECURITY AWARENESS some thoughts by Raymond V. Andersson from back in 2003

Recent media reports have highlighted the threat of criminal activities to individuals, properties and businesses in Darwin, Palmerston, Alice Springs and other areas within the NT.   We live in a society where many criminals operate within their own system of ethical and moral standards, having no respect for the law, age, disabilities or common standards that conform to the general population’s our own standards of citizenship.

The ethical standards and moral positions that we may treasure as being the cornerstone of our communities are regarded as a weakness to be exploited.    This is often supported by arguments regarding the rights of the individual overriding the rights of the many, thus exploiting our own belief system to the criminal’s advantage.   After all, we as a community also believe in the rights of the individual, however we temper this right with our citizenship responsibilities as members of a community.

Much of this crime is blamed on our youth however it must be realised that for every juvenile delinquent there are always one or more adult delinquents – people of mature years who either do not know their duty to their community and nation, or who knowing it, fail.   It is a fundamental fact of life that children emulate adults and adopt the adults’ ethical and moral beliefs in most instances.

What then can the average person do to minimise the threat of crime?

First of all you have to ACCEPT THAT THE THREAT EXISTS. Human nature is a funny thing. We don't like living with threats.  Crime is a subject of conversation nearly every day, or night in homes, bars and workplaces.  You read about it in the papers every day, and the TV and radio tell you about it constantly.  But as soon as we've finished lamenting the problem, we stick it in the recesses of memory; we forget about it.

 You cannot allow yourself to forget that the criminal is out there. They steal for a living.  They assault so they can steal.  They will attack to create an environment of fear and intimidation, so they simply aren't going to forget about you.

Next you have to consciously accept that YOU ARE A POTENTIAL TARGET. Now this is quite difficult for the average person, because the average person is a nice person and it doesn't figure that someone you've never seen before in your life wants to harm you. The bottom line is simply that you have something he or she wants. This goes for every crook or assailant on earth. The criminal assault may be purely an act of theft, or low-level terrorism conducted to gain personal satisfaction in the fear or pain created or just for the individual or groups self gratification in stamping their control over ‘their turf’.  You have to accept that they do not see the world the way that you do. To them you are simply an anonymous target; a bit like those legs dangling in the ocean in front of a shark.

The main problem is that very strong human belief that 'it will never happen to me'.  Every single crime victim is a 'Me'.

 A news item from Sydney in January 2003 reported on a thief stealing from a vehicle stopped at the red lights.   It would have been somewhat of a surprise when he checked his booty, as the driver was a registered snake catcher and was returning from a job with a red-bellied black snake in the bag that was taken.   In this case the victim of theft probably never considered that anyone would attempt to steal from his vehicle whilst he was in it and the thief, of course, would never have considered that his booty resulting from a crime could attack him.

To reduce this type of risk and other crime threats there are a few easy steps that anyone can adopt that can reduce or remove the risk.

a. ENVIRONMENTAL CONTROL: Control your environment by being aware of your immediate and proximate surroundings and being able to react to any apparent potential threat. If the criminal wants to mug you, steal from you, pick your pocket, sell your kids some drugs, they must take control of the environment in which they are to operate. They might do this by stealth or by force.   By controlling your environment, you take the initiative away from them.

b. ENVIRONMENTAL AWARENESS: Think about it like this, if I am aware of my environment I will be able to react to anomalies.  Get to know what is happening around you.  Be aware of the normal pattern of life in your neighborhood so that unusual patterns or people will stand out.  Harden the security on your home or business then look outside of this perimeter at the environment that you live and work in.

c. CONSCIOUS SELF-INTERROGATION: This is self-explanatory. As you drive your car or walk, along the street where you live, on your route to work, wherever; ask yourself, consciously what is going on around you, who else is also driving or walking within your local environment? Are those persons standing on the corner legitimate pedestrians, or watching the behaviour of residents or businesses?  Police patrols and professional Security Officers always carry out self-interrogation  whilst working as a matter of street survival.  

Make sure you do it consciously, just to make sure that you are keeping up the habit and after a while, your subconscious will take over.   Healthy suspicion may avoid placing yourself in a position of risk.

d. CORRIDORS AND PATTERNS: Ever heard the saying that 'we're slaves to habit'? It's true. We oscillate between known points; home, work, the bank, schools and we go to them at given times and along favourite routes. This plays into the hands of criminals.  Vary your routine.  Watch for corridors that afford the criminal any advantage.  This includes intersection stop signs, traffic control lights etc.  They all afford criminals and terrorists the advantage of time whilst the target has their attention elsewhere.   Many thefts, car-jacking and assassinations have occurred at intersections and traffic lights’.   Be aware of your environment and what is occurring around you.

e. LEAVING AND APPROACHING YOUR CAR: This is particularly important in parking lots. Imagine you are at a shopping centre and you are driving into the parking area.    This is an area where many people develop patterns or create corridors of opportunity for criminals.

Get into your well-lit parking place as quickly as possible and then get out of your car and stand up as quickly as possible, gaining control your environment once more. Remember that if you are bending down peering at the lock you are surrendering environmental control. After locking up, walk briskly away from your car, observing who is watching you. You don't have rear view mirrors, so consciously turn around and look at your sides and behind you. An observer with ill intent will note that you are alert and, in most cases, will look for an easier target, but don't let this make you 'cocky' they will still have a go if they don't find easier pickings.

Inevitably your going to come back to your car, so as you walk out of the supermarket, the hairdresser, restaurant, you must once more interrogate the area around your car. Do not walk directly to your car, go away from it, at an angle so that you can keep it visual and watch for any reactions in the people around. Once you are happy that the area is clear, walk back to your car from a different direction.

Walk to your car as quickly as possible, unlock it while standing upright, get in the car, lock it and get out of there. If you are carrying goods, stay upright as much as possible and put things in the car from a standing position. Do not lean into the car and thus make yourself vulnerable. .  Having two people can assist here as one can always remain alert whilst the other packs the car.  If you have a remote electronic central locking system, make sure that locking and unlocking is accompanied by a minimum of flashing lights and certainly make sure that your car does not make any bleeping sounds. That will alert anyone in the parking lot that someone with the means to open the car and drive it away is approaching a specific vehicle and that makes you vulnerable to the opportunist

f. ON FOOT: We previously looked at controlling your environment when out of your car.  Using this principle should also enable you to identify areas you should stay out of; alleys, bushy areas, unlit areas, shanty areas where environmental clutter makes it hard to control the environment. You just don't go there without adequate protection.  Ask any expert self defence exponent, what they would do if four men attacked him or her whilst alone in a dark alley. Their response would most likely be that they wouldn't be alone in a dark alley. That's the best possible rule of thumb; if you can't control it, don't go there.  

Studies and practical implementation overseas has revealed that street and other overhead lighting has dramatically reduced the level of crime in those areas that have adopted this strategy.   It also dramatically reduced the fear factor of people going out at night in those same areas.   Lighting is a primary tool in Crime Prevention Through Environment Design and should be considered as a matter of priority by Councils responsible for areas of high crime risk.   Lighting assists in bringing control of the night away from criminals and back to the community and as ratepayers you have a right to live in a safe environment.

When crossing the street in a built-up part of town in a reasonably developed part of the world, you can use shop windows as mirrors if the lighting is right, but it still pays to have the odd look behind you, just so they know you are alert.

Maintaining control of your environment is particularly important at ATMs, which are constantly observed by opportunist thieves. Don't fixate on the screen, examine the screen before you start work, look for any tampering with the machine, but at all times, look around you every couple of seconds. In this instance, as in all other situations, you must have your escape route planned.  If you don’t feel safe, simply walk away.  Trust your intuition when you feel you may be in danger.  Intuition or gut feelings can be more often right than they are wrong.

When using mobile (cellular) phones, it's best to stand with your back to a flat high wall. A shop window is good. Now you only have to sweep through 180 degrees. But remember when you walk off, your environment is 360 degrees again, because some interested party has just seen you use that phone…

Crime will not go away.  We must therefore attempt to control it by reducing the opportunity, increasing the risk of detection and capture. Making the criminal act less desirable to all bar the most desperate offenders.   This can be achieved by being crime & security aware and taking control of your environment.