This past Wednesday a KVLY reporter went into three area elementary schools and walked around with a hidden camera. The reporter, Mellaney Moore, was not stopped by any school personnel. KVLY aired the hidden camera footage taken within the schools on Wednesday’s news broadcast. The elementary schools that were breached are in the Moorhead, West Fargo, and Fargo school districts.
Now parents and others want to know why she was able to enter three different schools in three different districts without being stopped by school personnel; the reporter may face criminal charges; and area superintendents are forced to examine what they might do differently to keep someone who may have ill intent from pulling off a similar perpetration of school premises.
There are opinions on both sides of this discussion and there are many questions. I will not enter the discussion fray, but I will offer a commentary on the value of testing an organization’s security protocols and procedures. Red teams have long been used to test organizations’ security. Red teams do such things as trying to gain access to secure information systems or penetrate security barriers. The military and other government agencies have long used such teams. Increasingly, red team assessments are being utilized by corporations, financial institutions, schools, hospitals, etc. to help identify areas where security can be improved. Red teams use open source data and surveillance to help them understand how to best infiltrate the target.
I teach my students how to do red team assessments as it enhances their ability to uncover and mitigate security gaps. When one focuses on how to find their way around or through security their lens changes. Regular folks don’t spend their days thinking like evil-doers and often miss key vulnerabilities.
I was not at all surprised at the reporter’s ability to walk around the schools. Such vulnerabilities exist in many places that you might assume are secure. Walking around with authority as if one belongs there can immediately reduce the potential of being stopped within a facility. In addition, employees who see strangers that they do not think belong will too often say nothing. They assume someone else will say something or convince themselves that they are overreacting.
Schools can benefit from red team assessments. Perhaps the takeaway from the reporter’s ability to access the three schools should be that there are some gaps in security that could do with strengthening. A sign that says check-in at the office will be ignored by someone seeking to infiltrate the facility. In the end this should be a lesson to us all – regardless of where we work – security requires constant attention.
Day one thousand two hundred and fifty-nine of the new forty – obla di obla da