Scenarios or Table-tops…Which one is better?

The halls were filled with the sounds of gunfire and fear. Our team moved forward as fast as we could, passing victims and backpacks pursuing the gunfire. We thought the shooting was in front of us, but the labyrinth of walls made it impossible to know for sure. As we cut around a sharp corner I came face-to-face with a suspect. I fired two quick shots, hitting him in the face and neck. He yelled and recoiled backwards. A deep voice roared to life behind me, “No shooting in the face! Scenario over!” Fast forward 11 years and I was sitting at a standard, round, hotel conference room table with four people I’d never met. The woman at the front of the room just finished describing what amounted to the collapse of social order due to several days without power. Our job was to keep a local hospital running with no fresh water, no sewage service, and little to no police protection.

Believe it or not, I left both training events thinking, “That was the best training I’ve ever had” even though they were light years apart in scope and teaching styles. One was a full scope, active shooter, scenario based training module complete with SIM guns, screaming actors, and vicious assailants. The other was in a comfortable room surrounded by calm voices, candy, and chilled bottles of water. The contrast between the two could not be any clearer. If you were to look at both events from an objective standpoint you might be inclined to think the scenario-based module was superior to the table-top. The truth is one is indeed superior to the other, when done correctly.

“Realistic” scenario-based training modules are extremely popular right now. The thought process is, “we will expose our employees to the realities of the event, thus training them for the real thing.” This is not altogether a flawed line of thinking, but it can, and often does, lead to very expensive training modules that produce very little positive outcomes. The main problem with defaulting to scenario-based training is many people are ill equipped to handle the scenario, which almost always leads to failure. For scenario-based training to be effective, employees must have some foundational training upon which to rely. For example an active shooter training scenario will be successful only after employees have undergone basic crisis training. Employees need to have a plan so that plan can be tested. Conducting table-top exercises with employees lets them see the plan in action. Table-top modules build confidence in response plans and more importantly, build confidence in employee’s ability to react to a crisis. When employees finally undergo the scenario-based module, they will already know how to succeed, which in the end will help them survive the real deal.

Just like reliance on scenario based training will fail, so will a reliance on table-top exercises. For several reasons many entities use three or four of the same scenarios each year to train employees on crisis management. During the exercise the most stressful dilemma is usually trying to end the scenario before lunch. In the worst cases, employees skip the training modules and become victims rather than survivors when the real attack occurs. To avoid the monotony and dismissive attitudes, table-tops need to challenge employees and more importantly they need to build confidence. Interspersing real-life, external stressors like active assailants, will show employees the importance of table-tops. If budgets are too low for full-scale scenario-based modules, try simple things like turning out the lights and making everyone work using whatever light sources they can find. You might be surprised to see what weaknesses in personnel and facilities reveal themselves with just a tiny amount of stress.

To answer the overlying question of which is superior; it depends on the company’s level of readiness. An overreliance on either will not be effective. To ensure success, build a good training foundation and complement that foundation with real-life stressors. Most importantly remember, all crisis training is meant to ensure survival. Pick training modules accordingly.

New Threats Require New Defense Strategies

As we enter a new phase of terrorism old counterterrorism measures need to be reviewed and updated. Since 9/11 the law enforcement community has been building counter terrorism strategies on the theory that each terrorist event requires significant pre-planning and that this pre-planning is done in a manner detectable by the public and law enforcement. Much of the counterterrorism industry is accustomed to the “Eight Signs” or pre-indicators; Surveillance, Information Gathering, Security Testing, Finance, Logisitics, Strange Behavior, Dry Runs, and Deployment. This strategy worked for several years because it was assumed major attacks would require significant time spent performing each pre-indicator. Today many of these pre-indicators have been compressed or eliminated which reduces the possibility of detection. Two types of attacks illustrate this, and the need for updated strategies; active shooters and cyber attacks.

Active shooter cases appear to be on the rise in the United States. In post-attack analysis certain patterns have emerged, but there is a lack of pre-incident “unifying behaviors” explicit enough around which to craft countering strategies. For example, in all active shooter cases the suspect required access to a firearm. Since the purchase of weapons is not prohibited, nor successfully monitored, there is no way to build a countering strategy around acquisition. Surveillance and Dry Runs are still possible gateways of prevention, but rely more on luck than science to be successful. To effectively combat active shooter attacks we need to look at core prevention strategies with an understanding that the risk of an active shooter attack will always be present. This assumption in place, prevention strategies need to focus on reducing the risk posed to potential targets. Re-writing emergency plans, identifying shelter-in-place locations, and proactive security measures are all proven methods for reducing the risk of active shooter attacks. These strategies are most successful when complimented by real-life training scenarios exposing participants to the sights and sounds of the real incident.

The complexities of cyber warfare are vast and numerous, and because the warfare is conducted in “cyber space” traditional pre-indicators are not valid. Whereas state secrets were once the currency of the realm now cyber collectives attack everyone from corporations to police agencies meaning it is virtually impossible to identify which specific data is at risk and which is not. The old adage of the best offense being a robust defense is very prescient in cyber warfare. By examining threats and trends, and being proactive with system security, the risk of a successful cyber attack is significantly mitigated. It is also vital to examine nontraditional security measures in data management and access controls. Finally, the use of preventative intelligence will add the final touch to a robust security posture. Preventative intelligence leveraged against cyber attacks will be addressed in another entry, however it is vital to understand how important it is in defending your networks.

As the world moves from one iteration of terror to another, counterterrorism strategies need to evolve. Counterterrorism strategies built around significant pre-planning operations needs to give way to current methods of protection, detection, and deterrence. While there is always an inherent risk of attacks regardless of time or place, using intelligence and building strong and flexible defense networks will mitigate risk and save lives.