The Janitors' Closet

Smart homes - and offices?

Our office neighborhood lost power for about an hour this morning; when it came back on, and we'd restored internet connections and so on, about the first thing that came up was an article on enhancing one's security on one's various interconnected electronic devices around the home.  Good advice on avoiding WY-fi, updating devices often, generating one's own passwords, and so on.

I've not seen much evidence of such interconnectivity in the sort of client we serve - smaller commercial janitorial jobs in the metro Phoenix area.  But, reading the trade press, I'm sure it's coming.

Going back to our short power outage: Whenever this happens, I'm reminded anew of how much I depend on the electronic gizmo at which I currently sit.  There's very little I can accomplish around the office without it, except perhaps re-painting.  The over-riding problem with interconnectivity, as I see it, is that when one aspect malfunctions - through a glitch, a hacker (North Korea or the kid next door), or an electrical issue - everything is likely to go down.  In an office building, if you tie together door access, alarm system, security cameras, the web and so on, you add convenience and ability to your system, but also complexity. 

Folks who study disasters and accidents distinguish between complicated systems (those that have a lot of moving parts) and complex systems (those that have moving parts that interconnect in ways the results of which are often difficult to predict). For a complicated system, think pre-flighting an airliner. You have a whole long check list, but should you miss something - say setting the brakes - you know pretty precisely what will happen.  Should you miss several things, again, you know what will happen.  The couple of nuclear power plant disasters over the years illustrate the issue with a complex system: A couple or three small things change or go wrong, and you've no idea what might happen.  Kind of like the weather (the butterfly flapping it's wings...).

One might go a step further.  My (currently) favorite archaeologist argues that building a society is simply a matter of adding complexity (Tainter - "The Collapse of Complex Societies").  You have an issue - say a famine in a Roman province - you add infrastructure (physical or bureaucratic) to fix it - say a system to ship food into the province.  He argues that complexity adds overhead, so the society grows less and less productive, thus saves less resources ongoing, and eventually has no resilience to the next outrage, whether it's a plague or a crop failure or the barbarians at the gates.  Thus in Tainter's magisterial survey, societies fail for a variety of proximate causes, but most always for underlying economic weakness.  I'd add to the economic analysis the complexity caused unpredictably of outcomes.  And, we're certainly creating an ever more complex society.

In other words, "Keep it Simple, Stupid".

So give everybody the same alarm code, but change it weekly...

The alarm system in the new client's suite seemed a bit strange.  The doctor in charge is big on security, so he's asked his office manager change the alarm code weekly.  She (the office manager) doesn't have the time, so she changes it "when she thinks of it".  And then tells everybody.  They all have the same code, because changing all those codes would be even more time consuming.

I can envision the over-worked office manager changing the code, and then getting pulled onto another task, and forgetting to tell someone of the new code - probably us.  I really hate those 3:00 in the morning calls from a frustrated janitor.  And the client doubtless hates the false alarm charge from the city, due to the police dispatch.

What we do, and recommend to our janitorial clients, is issue each of our folks authorized to disarm the office alarm an individual code.  We emphasize to each that he is to NEVER let his code out; he is responsible for anything bad happening in the office while his code has the alarm disarmed.  When a person leaves our employ,  we delete his code, immediately.  We do not have to wait for the alarm company to act; we do it in-house.  And the alarm company need not know anyone's code; all they show on their records, and on the security print-out, is the user code (so anyone reviewing the security record knows who disarmed the alarm, and who armed it, but not his code.  Most all alarm companies are set up similarly, as is the alarm company of the client mentioned above.

In passing, it's probably not a good idea to use the building's street address, or the current year, as an alarm code.  Burglars might be mean and anti-social, but they're not necessarily stupid.

I hardly claim to be qualified as a security consultant (I have a consultant for that), but I can handle simple common sense.

Better personnel screening

We participate in Homeland Security's IMAGE program; we commit to confirming identity on applicants before sending names and SSNs to E-Verify; they assist us in training our folks to do so.  As one might expect, we also get regular updates on E-Verify, the IMAGE program, training and seminars on each, and so on.  And, it gives me the occasional topic for an article.

Just received this:

"Arizona, Maryland and Wyoming became the latest states to join the Records and Information from DMVs for E-Verify (RIDE) program beginning July 31, 2017.

"RIDE  is an ongoing E-Verify initiative that links E-Verify with participating employers and state departments of motor vehicles (DMVs). It allows E-Verify to validate the authenticity of driver’s licenses and state identification cards issued by participating state DMVs that employees present as Form I-9 identity documents if the employer uses E-Verify. This helps to reduce document and employment eligibility verification fraud in E-Verify. These states join Wisconsin, North Dakota, Mississippi, Florida, Idaho, Iowa and Nebraska in this initiative.

"Learn more about Drivers License Verification and see the RIDE fact sheets. Send us feedback about your E-Verify experience at E-Verify Listens."

We've found IMAGE quite useful in our personnel screening; after all, it makes little sense to do a records check on a fellow without knowing who the fellow is.  Most of our procedure was in place before we partnered with IMAGE, but it helped us tighten it up a bit.

The program is free, and useful.  You'd think a lot of firms, particularly in what ought be a security conscious field like commercial janitorial service, would take advantage of the program.  So far, we're one of exactly two janitorial firms in the country.

A Faraday cage (or a couple)

I sent my 7/24 post out as an email newsletter, to quite positive response.  From one client, I received:

"Oh no, better safe than sorry. Loved the Faraday cage idea! Going to talk to my IT guy now.  Take care!"

I sent her back the following, mostly to note how easy and inexpensive the hardware and data protection is:

"Fancy name for a simple procedure. Just a metal box (metal mesh will do) to conduct a charge around the item. Isolate the item from the metal. For our back-up drive, we use a small metal file box, with a cardboard box inside, and the drive inside the cardboard. For the spare computer, a metal trash can with a cardboard box inside. Lids closed on both. Make sure the item does not touch any of the metal."

I used to be just a janitorial guy.  Now I am a security and cyber security consultant.....

How safe is the internet of things?

I see a lot in the commercial cleaning industry trade publications about the advantages of interconnecting various electronic devices, from inspection reports and door locks on the job to the alarm systems and the coffee makers at home and at the office.  While I'm generally excited about new technology available to the janitorial industry, and to make my life easier at home, it strikes me that this is of a different character than the microfiber and accelerated hydrogen peroxide technology that makes my crew more effective keeping client facilities healthy for their occupants.

Best current information is that the same group of hackers who hit the DNC a bit ago were also behind the cyber attacks of energy companies in the US a couple years back.  Imagine a hacker accessing the electronically controlled doors in your building, to lock them either open or closed, or maybe to change at random.  Or hacking your self driving car.  Even a competitor fooling with my database of inspection reports and client data would be a bother, at best.

We stress, in our janitorial service operation, tight security: personnel identity confirmation, screening and back-grounding; client key and alarm code security; computer file security at the office; and so on.  It wouldn't do to allow a hacker to access client alarm codes, for instance.

I know: one can do firewalls, but any firewall can be breached, either by a targeted hacker or by general malware.  Also, a virus corrupting our office files is a concern, so in addition to firewalls, and off-site database backup, I like an on-site backup in a Faraday cage ( keep a spare computer in one too).  And I like stuff not connected to anything.  And I'll forgo my home coffee maker being able to control my washing machine.

It occurred to us a good many years ago that, in vetting our staff, a thorough back-grounding (criminal and civil, national in scope, plus driving record and so on) made little sense without a formal program for confirming the identity of the applicant.  And back-grounding of entire staff is crucial - we have key access, after office hours, to a great many client facilities, many with sensitive documents on site, as well as the obvious pilferage targets.

We require and verify a current Arizona drivers license (hard to fake, and easy to teach my screening folks to spot a fake); run an address search based on Social Security number (to confirm that number fitting the applicant, and to see if he's the primary user of that number); check year and state in which the number was issued against what the applicant can tell us; check for aliases;  and so on.  Simply relying on E-Verify doesn't answer - as long as the applicant has acquired an name and number that match, the Feds are happy with it.

All of which we long had in place before being introduced to Homeland Security's IMAGE program.  It's a public/private partnership; we agree to confirm identity on anyone we put on (and ask the same of any subcontractors we use) and open our records to ICE's scrutiny; in return, we received three-plus hours of staff training in spotting fake ID (particularly Social Security cards).  At no cost to us.  And, we got a neat plaque to hang on the wall, and are listed on IMAGE's website.  We're one of the Charter Members.

You'd think, what with client concerns about integrity, background and screening of those folks who will get access to client offices, that more janitorial firms (at least, the ones trying to be legit) would join the program.  But we are still one of only two in the country.

Go figure.

Lost the keys?

Losing a client's keys, in the commercial janitorial service industry, is a nightmare.  Particularly if, like we do at CBN, one stresses tight security in serving clients.

The issue, of course, is the unintended (or sometimes intended) separating the cleaner from the keys.  The clip to your belt may break; or you may put the keys down, say on the front desk, after locking yourself into the building, and forget where you put them; or have them in your hand (you think) as you take out the trash.  Or you carefully set them on the front desk, went out the back door to take out the trash, and the door swung shut and locked behind you (and you likely left your cell phone on the desk with the keys...).

Hate it when that happens.

Imagine how nice it be to have a system where, when you take the keys off the (relatively unbreakable) belt clip, the keys and tje belt clip holler at you, and flash a light, and maybe even vibrate, if they sense more than a few feet of separation, or for a duration of more than a few seconds.

Found one.  It's called a Gravity Key Tether by Tether Technologies.  Try it out.

 

"Not enough..."

Should you suspect theft, or even minor pilferage - food from the fridge or the snack tray, change out of a desk drawer, pens and pencils - the first target of your suspicion tends to be the janitor, whether he's an outside contractor or your own employee.  After all, he generally has nighttime access, with no-one watching over him and, since you do not know him like you know the fellow at the next desk, pointing a finger has fewer repercussions.  So, like all in the commercial janitorial industry, we get our share of questions.

But to minimize the above, we do quite a thorough job screening and back-grounding our people: Insisting on a current Arizona driver license, closely checking the license's micro-printing and hologram, and (if questions arise) comparing the photo on the license to what the state has on file; Social Security Number verification and address history check based on that number; a check of a national database of felons and sex offenders; a statewide check of all court records, down to justice court level; driving record; finally, a personality profile exam, looking at such potential indicators as drug use and basic integrity.  We do start with the same pool of applicants as our competition; we just throw more of them back, and have an exceptionally honest workforce as a result.

But, there is still the occasion for suspicion.

Some time ago, one of my folks noticed a client setting traps for him: small amounts of pocket change, left in obvious but unlikely places.  As it continued, and the amounts grew, my fellow began, more and more, to feel the insult.  Finally, he noticed the most cash ever - near enough for a late night breakfast sandwich - atop a file cabinet.

Slid a note under it reading "Not enough - try again."

The traps stopped.

So what happens when you drop the keys in the Circle K parking lot?

Quoted service for a warehouse operation a few days ago (we provide office cleaning Phoenix).  in running through our key security procedures, I mentioned picking up a string of credit unions from a franchise janitorial provider a bit ago; I had to visit each credit union location in the afternoon to pick up the keys that the ma & pa franchisee had dropped off that morning.

In several of the locations, the keys returned by the franchisee had little sticky tags on the keys - client address on one side, alarm code on the other.  Quite convenient for the janitor, but a bit of a security issue for the client, should the keys ever escape the janitor's grasp.

I talked through, and provided documentation, on our key procedures: no identification, save an internal account number, ever allowed on client keys; keys copied onto neutered bow blanks, to make unauthorized duplication difficult; keys kept separate from client name and address; alarm code printed on a card separate from client name or address; client name and address never along with the janitor, once he had memorized them.  So, when we drop the keys in the Circle K parking lot, we've got a problem, but not as big a problem as we'd have with the client name, or alarm code, attached.

The potential commercial cleaning Phoenix client was amused, and seemed to appreciate our security procedures.

So, several days later, when I dropped by to pick up the keys dropped off that  morning by the former janitorial service, my new client sported a bit of a grimace as he handed me the keys as turned in by the previous janitor - with the alarm code attached.

Really tight security

From my operations manager, over the weekend:

"Aurora had the alarm go off on her at -------- because her alarm code would not work.  She called the alarm company and gave them the abort code, which did not work either; and all they told her was that they would call someone and get back to her.  (Meantime, the alarm was sounding and the police really should have been dispatched.) We called the client emergency contacts; no answer from either.

"While I was on the phone with her someone showed up and said he was in charge of the alarm system and couldn't find her code anywhere in the database. He was able to give us a new code right away.

"When I was done talking with him I actually got a call back from the contact who had quit working at ------- and realized she had probably given us her personal alarm code. She gave me the new contact's number...."

So when the client's employee left, the client deleted her alarm code and changed the firm's abort code (the password you use should you need to talk with the alarm company).  So far, so good.  But allowing her to give us (we're a provider of janitorial service Phoenix) her personal alarm code in the first place is not wise, for several reasons.  The point of giving each individual and service provider a unique code is to be able to identify exactly who was in the facility at a given time (like, when the furniture disappeared...).

I don't know of a single alarm service that charges extra for allowing individual alarm numbers.  Generally, the alarm system allows an individual user to program in his own number, so that only the alarm service knows it; the employee is only known to the his employer as "user #17", or whatever.  Thus no-one, even management, can use another's number.

A while back, I had a client - an optometrist with a large inventory of designer eyeglass frames and sunglasses - use the same code for everyone (didn't want to deal with a lot of confusing numbers); he also issued keys to most everyone, and did not re-key, or change the alarm code, when he lost employees.  Too much bother.  And then was surprised when he was burglarized.

We're pretty aggressive about security, in both our own facility and in the facilities of all our office cleaning Phoenix clients.  Should we loose a janitor with key and/or code access, we suggest a re-keying (at our expense) to the client, and pretty much insist on a new alarm code.  Seems the right thing to do.

Come to think of it, the client that I first spoke of didn't change the locks when his employee left, either.