Last week I attended the Family Office Exchange’s Fall Forum in Chicago for a chance to spend time with high net worth families and their advisors, a number of whom attended my special session on family security. FOX is a leading group in the HNW space, and it’s always valuable to hear input and feedback from their members.

This year, the top concern I heard from a number of participants, particularly families in metropolitan areas, is the lack of confidence in plans to prepare for emergencies and disasters. Despite government efforts over the past 8 years, families are still unsure of how best to prepare for or how to respond to a wide range of crucial scenarios, spanning weather emergencies to a potential terrorist attack.

The second issue on the minds of families and advisors is a concern over the role of staff when responding to emergencies. Household staff are eager to help and protect their employers and their children in adverse circumstances, but their good intensions may be misplaced or go awry. For example, staff may engage an unfamiliar trespasser directly without any protocol for making sure this person is not a threat or a plan for how to respond by securing the family and getting help if it turns out they are. Training staff is a key area when it comes to keeping families safe, and I’m glad family members and advisors are recognizing the issue and looking for solutions.

I discussed many more meaningful security issues and challenges with the FOX members and attendees. This year’s forum was engaging and educational, as always, and I’m looking forward to implementing some of what I learned.

Countering Threats: Insite Security shields its clients against kidnappers and other criminals who prey on the wealthy.

BUSINESS MANAGEMENT – PRACTICE DEVELOPMENT

SEPTEMBER / OCTOBER 2009

By CAREN CHESLER

It remains one of the most horrific kidnappings in history. In April 1992, Exxon executive Sidney Reso was kidnapped in his own driveway in wealthy Morris Township, N.J. Bound and gagged, he was put in a six-by-three-and-a-half foot wooden box, which was left in a metal storage room without ventilation or electricity. The 57-year-old father of five was left there for four days, lying in his own waste and given little more than water and vitamins. On the fifth day, his kidnappers returned to find him dead. Yet they continued to demand $18.5 million in ransom for eight weeks before finally being apprehended.

Reso wasn’t the first wealthy executive to be abducted and he certainly won’t be the last, which is why some of the country’s wealthiest families have hired New York City-based Insite Security Inc.

The firm’s CEO, Chris Falkenberg, a former Secret Service agent and litigator, counts celebrities, such as Martha Stewart and Ralph Lauren, as well as movie stars and hedge fund managers among his clients. The firm has so many clients in hedge-fund heavy Connecticut, it opened a four-person office in Greenwich. Falkenberg founded the firm in 2002.

“I think the most important thing we do is prevent kidnappings and respond to them,” Falkenberg says. “It is the number one threat because it is exactly the type of crime focused against our client base. Our clients have an enormous amount of money and, therefore, they are attractive to kidnappers.”

His firm, which employs law enforcement veterans who formerly worked for the Secret Service, the Federal Bureau of Investigation and the U.S. Marshals Service, as well as several police departments, has about a dozen clients for which it provides security services on a retainer basis.Monthly fees range from $8,000 to $12,000. The firm also performs discreet services, such as installing home security systems, which could cost $40,000 to $60,000.

The range of services Insite provides varies, depending on the client’s level of risk. An executive with a company that does animal testing or sells fur, for instance, faces a higher risk, as do executives who have received a lot of publicity because of their wealth or been involved in a high-profile termination of an employee, according to Falkenberg.

Kidnapping, however, is a threat to anyone with a lot of wealth. Kidnappings are on the rise internationally, experts say, partly due to organized crime activity in countries such as Brazil and Russia, and the drug trade run out of countries such as Mexico, where kidnapping has become a lucrative criminal activity. That’s made border states like Arizona, Texas and California greater security risks, says Falkenberg.

Apparently, Connecticut has its risks as well. In 2003, billionaire hedge fund manager Eddie Lampert was kidnapped at gunpoint while leaving work. Several ex-convicts found Lampert, who at the time owned the $9 billion private investment fund ESL Investments Inc., by going into the prison law library in jail and typing in “richest guy in Connecticut,” Falkenberg says. They nabbed him at work after seeing that he went in every Saturday and parked in the same spot that had his name on it. He was held for ransom for two days before talking his way out of it.

Falkenberg feels one of the benefits his firm brings to clients is the ability to respond to such situations on a moment’s notice. Law enforcement agencies, in contrast, may not act with urgency until they’ve established whether a kidnapping has occurred, he says.

To help prepare for kidnapping situations, Falkenberg recently hired the FBI’s former lead hostage negotiator, Christopher Voss. Experts say the first 24 hours of a kidnapping are considered the most crucial, in terms of keeping the victim alive, Falkenberg notes. The presence of Voss will assist the firm when it needs to act quickly, he adds.

“Given that so many of our clients are U.S.-based, and so many [domestic] kidnappings result in homicides, we just can’t not have that capability in house,” Falkenberg says.

Voss says kidnappings are like Russian roulette. Most of the time, victims are unharmed. But when something does go wrong, the results can be disastrous. In the U.S., he feels victims face heightened risk because kidnappers are more concerned about covering up their tracks.

“In the U.S., we have an extremely robust law enforcement community, and kidnappers are afraid they’re going to get caught. And they’re not only going to get caught they’re going to do an extremely long time in jail,” Voss says. “Outside the U.S., they’re pretty sure they won’t get caught.”

The firm hasn’t yet had to deal with a kidnapping, but Falkenberg believes it may have prevented one. He had a client in New York whose child may have been a potential target. According to school officials, a man was asking questions about the client’s child. But once Falkenberg’s firm put the man under surveillance, he disappeared.

“There can always be an innocuous excuse for behavior, but we didn’t think that was the case here. So we increased security, and the surveillance ended,” Falkenberg says. “One of the frustrating things about selling these services is that, unlike an investment advisor, we can’t prove a negative.”

Aside from kidnapping, the biggest issues clients face are home invasions and confidence games perpetrated by the people around them, Falkenberg says. For example, the firm had two ultra-wealthy clients whose college-aged sons were preyed upon by women who wanted their money. The parents had grown suspicious of the women, but their sons, who were so flattered by the women’s interest, refused to end the relationships.

Falkenberg’s firm discovered that both women had created a web of lies, about their identities, their college majors, and various other basic facts. The men ultimately terminated the relationships.

The women likely found the men in one of the college yearbooks created for entering freshmen, Falkenberg says. In general, he says, the less information that’s available about his clients, the safer they are.

“These days, there’s so much information out there about people, specifically the wealthy, that it creates security issues for them,” Falkenberg says. “Even if they make huge efforts not to draw attention to themselves, like those who vociferously guard their privacy and don’t talk to the media or take credit for their charitable foundations, they still end up in media reports on the very, very wealthy, like the Forbes list.” Some of the biggest breaches in security occur when people voluntarily give up information, he notes.

Falkenberg, who served on the security detail for the first President George Bush and then for President Bill Clinton during his 1992 presidential campaign, recommends that the wealthy keep public information about themselves vague, business-oriented and impersonal. The wealthy should be guarded about where they live, whom they know and what they do for hobbies, he says. The firm also does thorough background checks on anyone working for his clients, from nannies to landscapers.

Many of his clients, particularly hedge fund managers who have acquired enormous amounts of wealth early in life, find they and their children are living in a bubble. One of the firm’s challenges is allowing clients to live somewhat normal lives while looking out for their security.

“They’ll have a security infrastructure, but they don’t want to see or have to worry about it,” Falkenberg says. “It’s not so easy to do that.”

What makes it even harder is when clients are resistant to his security efforts. He once had an interior designer balk at the prospect of putting smoke detectors on the ceilings of each room, suggesting instead that they be put in closets. The wife of one of his clients asked that the unsightly surveillance cameras in the backyard be tucked away so far into the bushes that it rendered them useless.

The most resistant family members, he says, are children, who are warned not to put intimate details on social networks such as Facebook and MySpace. Many simply refuse to comply.

Risks don’t just occur at home, he notes. The ultra-wealthy have to be careful, perhaps even more careful, when they travel.

“When you show up and get off a Global Explorer – a $15 million private jet – people look at you differently,” he says. What predators see, he says, is opportunity.

Falkenberg had a client whose five-member family was traveling through one of the former Soviet republics 18 months ago and was detained at an airport by border officials who were apparently looking for a payoff. After six hours of detention, Falkenberg says the family was freed after his firm “negotiated” with the officials.

“We used contacts we developed in advance of the trip,” Falkenberg says, adding, “And maybe there was some payment of compensation to someone. And maybe not.”

Falkenberg says he’s seen an increase in requests for security services related to overseas tourism and business travel. It’s not surprising. Security experts say Americans traveling internationally face increased risks today to not just their safety but also their health. For that reason, Falkenberg’s firm recently partnered with a company called WorldClinic to provide emergency medical care to its clients. With a network of 4,000 doctors outside the U.S., WorldClinic provides around-the-clock medical care to clients who suffer serious illness or injury while traveling abroad.

Falkenberg believes people should hope for the best and prepare for the worst. Anne G. Donohoe, who works for Falkenberg’s public relations firm, KCSA Strategic Communications, can vouch for that. She was recently preparing for a trip to the Tuscany region of Italy when she received a call from Falkenberg, who told her to become acquainted with the plane’s exit routes and to wear sneakers on the flight, in case she has to run. He told her not to take the sneakers off until the plane is at cruising altitude, and because she was staying in a 200-year-old villa, he warned her to locate all of the exits in the building in case there was a fire.

“I told him, ‘You’re scaring me.’ And he said, ‘Great. Have a nice trip,’” Donohoe says. “Now when I travel, I keep a flashlight on me, in case there’s a power outage.”

Supply Chain Security Threats: 5 Game-Changing Forces

CSO

December 16, 2009

By LAUREN GIBBONS PAUL

As any CSO knows, it’s not enough to mind your own business. You have to look after your business partners as well, across all links that connect to your supply chain—whether that chain is physical or virtual. And that goes double in times of rapid change and high stress.

“The threat environment is constantly changing,” says Ryan Brewer, CISO for the Centers for Medicare and Medicaid Services. “Sometimes it’s hard to put your finger on what’s most important.”

Who would have thought three years ago that piracy on the supply chain would be such a big concern? Sometimes the big worry is terrorism, sometimes it’s natural disasters, lately it’s malware. Here are the top five developments CSOs say have the biggest potential to wreak havoc on their supply chains.

No. 1 Game-Changing Force: ‘Black Swan’ Events

As Nassim Nicholas Taleb explained in his 2007 book of the same name, the term “black swan” refers to an event that is high-impact, hard to predict and rare. Black swans need not be negative (as in the case of 9/11) and can present times of great opportunity, but CSOs rightfully spend their time worrying about the former scenario.

When it comes to the supply chain, black swan events can include everything from disastrous weather to global pandemicto terrorist attacks. The problem is, if you prepare for the worry du jour, you may leave yourself exposed on other fronts. Case in point: avian flu. Warned that a large-scale outbreak of Asian bird flu would put supply chains at risk, global businesses braced for the worst. Executives discussed how the supply chain might be affected if the flu broke out in China. Their plans rested on transporting and storing materials in other places around the world.

Then, early this year, H1N1 flu broke out in Mexico and spread quickly to unexpected regions like Australia. “Companies had to immediately reassess their plans because they were based on specific scenarios,” says Adam Sager, senior manager of business continuity consulting at Control Risks, a security consulting firm in Washington. This was a major wake-up call. “Companies realized they needed to better prepare for unexpected events and increase their knowledge of how their organizations could be impacted. If something is emerging on a global basis, they need to act before it affects their supply chain,” says Sager.

When a crisis hits—no matter where on the globe—you need to be able to understand and assess the situation using firsthand country- and location-specific information, says Sager. And you need bi­directional communication between crisis managers and the locale where the event is occurring. Sager notes that companies are discovering gaps between their crisis plans and their operations.

“They had security management and crisis management plans in place, but the missing link was integrating them with the business so people around the world could understand management’s position regarding critical things such as uptime, issue resolution and who’s responsible,” he says. This type of information is often not conveyed to the field in advance, a crucial error. Management needs to empower local decision-makers in advance to take action quickly to mitigate damage if certain conditions are met.

The plans have to address not just key supply chain nodes and specific scenarios that could occur, but also emerging security vulnerabilities. “That is a different mind-set and way of planning,” Sager says. “The security department has to come together with the operational/financial side of the business,” looking at all aspects of the supply chain, including where the different components are located and alternative sourcing arrangements. Sager puts his clients through tabletop testing, in which executives sit in a conference room and go through a scenario point by point with the key decision-makers, reviewing how they would respond.

Marc Siegel, commissioner for the ASIS International Global Standards Initiative, is leading the charge to develop an ISO standard for supply chain resilience. ASIS has already published SPC.1, its first organizational resilience standard, which it expects will be ready by the end of the year. “We think standards are the answer for dealing with [black swans],” Siegel says. “Companies have to develop a comprehensive [supply chain resilience] strategy because their resources are limited. This allows you to look at the full picture, rather than just separate out the different things.” For example, a strategy to prevent terrorism might work against piracy or help during an earthquake as well.

Organizations need to approach risk from a holistic standpoint, Siegel adds. “The problem with the risk du jour is that the likelihood of it happening varies so greatly between organizations that it can divert your attention away from doing a comprehensive risk assessment.” In short, it can make you take your eye off the ball.

No. 2 Game-Changing Force: The Rise of Malware

Information security matters also weigh on CSOs’ minds, though they are not as visibly related to the supply chain as physical security is. An organization (and therefore its supply chain) can be brought low by an attack on its information network as surely as it can be hurt by an attack on its cargo. Many CSOs say they are worried about botnets; two of the most pressing threats related to botnets are spam/phishing attacks on employees and the possibility of a resurgence in the denial-of-service (DoS) attacks that first appeared 10 or more years ago.

Ed Amoroso, CISO of AT&T, blames rampant technological complexity for the rise in malware. “The primary root cause for almost everything we deal with—commercial customers and everything—is complexity. The computers and networks that people set up and use have become way too complicated,” says Amoroso. Since no one knows exactly where all the connection points between systems lie, it is easy for wrongdoers to exploit them. “I’ve read that 95 percent of the spam that is floating around is botnet-originated,” he adds. “It’s all about complexity—people not knowing how to stop it on an individual, corporate and information security level.”

Like Amoroso, Joonho Lee worries a lot about the advent of integrated DoS attacks. “DoS used to be about large-volume traffic hitting your network,” says Lee, an officer for the National Incident Response Team and assistant vice president at the Federal Reserve Bank of New York. “Now, there are so many different types of attacks. It’s not just flooding you with traffic anymore. It’s flooding you with traffic that you can’t block.

“We have all the DoS protections, but I’m very skeptical about them always working. If you get hit by a 40-gig-per-second pipe, it’s going to knock you out, either your network or your provider,” says Lee. “The hackers are leveraging hundreds of thousands of machines. DoS is definitely back on the horizon.”

Rena Mears, a partner in security and privacy services for Deloitte & Touche, believes the malware supply chain is itself approaching maturity. “You go back a decade, and it was a few people doing mental gymnastics. Then we moved to an era where it was monetized [via phishing and spam]. The next step was the massive quick hit—equivalent to a bank robbery. Now we are seeing something much more insidious,” says Mears. Malware and its perpetrators are growing increasingly sophisticated.

Rather than carrying out the massive hit-and-run DoS attacks of the past, today’s malware seeks to sustain itself at a relatively low level, similar to the way a parasite survives in nature. “This is more of a constant-stream-of-revenue strategy. The malware agent can live below the organization’s pain threshold, but it siphons off information to compromise intellectual property or scoop up credit card information,” Mears says.

Lee, for one, does not believe that network service providers can adequately protect against the threats posed by new-breed malware. Amoroso of AT&T acknowledges that the situation is difficult, saying only that, like other providers, AT&T has developed multiple strategies for handling new-breed DoS attacks. He believes that the increasing popularity of thin clients will help thwart these attacks because they are simpler, with fewer moving parts to attack.

No. 3 Game-Changing Force: Economic Downturn

It is axiomatic that crime increases as the economy deteriorates. A number of threats—to physical security as well as information security—have become more pressing in the past year or so. Many CSOs expect the associated threat pool to continue to widen. Although the economy is forecast to improve slowly in the coming year or two, many experts expect the reshaped landscape will not necessarily signal a return to prosperity for all, or even most, of society. Some people will be desperate and therefore prone to desperate actions.

As the economy continues to falter, more and more people are losing their jobs, which often means losing their health insurance as well. Ray Biondo, CISO at Health Care Services (which runs four Blue Cross Blue Shield plans in Illinois), fears ongoing economic problems will cause wide-scale employee layoffs, which the company has so far managed to avoid. He fears the coming of a national healthcare plan could have the same effect. Biondo finds himself worrying more about insider threats to information and physical safety than he did a few years ago.

“I worry about internal physical threats and threats to our data. People become very anxious, and data leakage becomes an issue,” says Biondo. He believes he has taken all available measures to protect information and physical security, but he remains uneasy. Chris Falkenberg foresees increased threats to personal security, including the kidnapping of business executives abroad and attacks on high-net-worth individuals. “CSOs will have to deal with these things because they have to protect their executives,” says Falkenberg, president of security services firm Insite Security. He also worries that personal kidnapping could become a problem in the United States, though the country does not have the widespread governmental corruption that typically allows such activities to take root. He believes most CSOs do not have the internal expertise to handle this type of threat.

Lee, of the Federal Reserve Bank, believes emerging threats such as malware and attacks by insiders require stronger communication between the information security and physical security groups, as well as any other departments that get involved when there is a problem, such as legal. “There needs to be better teamwork. It’s not just training,” he says. “Even if these groups do speak to each other, they usually would just offload the case onto the other side. Everyone involved needs to know the logical next steps. There needs to be recognition of joint ownership of the problem.”

No. 4 Game-Changing Force: Data Explosion

Data is now so ubiquitous and so pervasive that people lose sight of it. Even many manufacturers today are so massively involved in data, they never think of themselves as anything other than purveyors and users of information. The level of integration companies have with their processes and business partners is something they could not have contemplated just five years ago, says Mears. The explosion in both data itself and the practice of sharing data outside organizational boundaries presents a number of different kinds of risk.

Companies of all types and sizes share infinite amounts of information with business partners. This data is constantly updated and flows back and forth. “This is a two-way chain,” says Mears. “That means you are replicating data. We used to say ‘defend the perimeter.’ Many companies don’t even have a perimeter anymore.”

Data and information are assets, but executives don’t know what they have, where it all is and who is (and isn’t) protecting it. “It is very difficult to secure data when you don’t know exactly what it is and who you’re sharing it with and no one is on the hook for those decisions,” says Mears. This reality necessitates a risk-based approach to data protection. “You cannot protect all data anymore. Not all data assets are worth the same amount. You have to be sure there is a return on that data asset, just as you would with any other asset. You should provide security commensurate with the value of the information asset,” she says.

Deloitte is advising its clients to develop a more focused response to information security. In a highly integrated global environment, companies understand that their core intellectual property is at risk, but they cannot afford to protect the daily flotsam that is part of business as usual. “Data protection is now a C-suite and a board-level issue. Executives are beginning to think about how to maximize the return on their data assets,” says Mears.

No. 5 Game-Changing Force: Regulatory Burdens

Since Sept. 11, 2001, and the passage of the Sarbanes-Oxley Act in 2002, regulatory activity has been high in virtually every industry. This is certainly true in the food/beverage/agribusiness industry, due to the obvious importance of maintaining a food supply that’s safe from contamination, whether malicious or innocent. H.R. 2749, the Food Safety Enhancement Act of 2009, just passed. And Walmart made news in 2008 when it required all of its food suppliers to comply with the stringent GFSI (Global Food Safety Initiative) standard. According to Rick Shanks, this standard above all mandates traceability within the food supply chain.

“Many food processors are not prepared to deal with the level of traceability required by the regulation,” says Shanks, national managing director of Aon Risk Services, the risk advisory division of Aon Corp. Traceability requires a high level of supply chain visibility, which has not always been available. That makes it more difficult to mitigate a food contamination incident such as salmonella in peanut butter or listeria on deli slicers. “When you have a food event, you have to be able to trace it back to its source,” says Shanks. Aon recently announced a service offering that helps food processors and producers achieve the necessary visibility.

A related force reshaping supply chains in the food and beverage industry is consumers’ increasing demand for visibility into the provenance of their food. Produce and seafood have been labeled to indicate origin for a few years now. The current “locavore” trend—which emphasizes eating locally grown food—stems in part from consumers’ beliefs that food grown and consumed nearby is less likely to become contaminated. Here, supply chains are shedding links to help allay consumer fears.