Corporate Security in a world with superpowers

Question

There have been questions about how to protect against specific superpowers in the context of high-value/high-risk target with answers that require a very controlled environment, this question is more what steps a competent security manager would be able put in place given the constraints of productivity, budget and staff retention at a normal office.

It's a U.S. like environment, with similar laws, including restrictions on use of lethal force and significant issues with forcing implantation of devices and similar intrusive practices. Tech level is maybe 5-10 years further along (self driving cars and natural language virtual assistants, but no general AI to rule the world)

Super powers are not new, they've been around for a couple of generations. A relatively high percentage (10-20%) of the population have powers, but almost all of those are uninteresting in the context of the question (change hair color at will). Only a very small percentage of the population has tactically useful powers at a powerlevel that is useful for anything. Actual powers are varied, and generally are at the spider-man level or below.

This is not a world where super heroes and super villains exist. No legalized vigilantism. There are criminals that have super powers and there are police and military who have superpowers. Vast majority of people with powers work regular 9-5 type jobs (maybe exploiting their powers if they are useful at all).

The facility to protect is a normal office, think branch office of an insurance company, a graphic design shop or a company that manages real estate. Mostly concerned with protecting people, intellectual property, infrastructure and physical assets that don't have much individual value. No major terrorist organizations are targeting your organization, which is great, but it does mean the CEO is always trying to cut your budget. (If you want to talk about functional manufacturing facilities or warehouses that is also of interest to me, but not the main point of this question)

Competing interests:

1. Budget constraints - Your boss balks at every expense.
2. Inconvenience or productivity - The employees need to be able to effectively collaborate and do their jobs.
3. Employee retention - If the employees (or managers) find the process too onerous or invasive they will leave to work at another company.

So, what technology or processes does a competent security manager put in place with their limited dollars and influence that they would feel protects against a broad cross section of powers, with the understanding that the chance of being targeted by such an individual is fairly low.

Scope:

1. Mostly interested in physical security
2. Computer security already has to deal with the idea of a compromised node, so this is probably an issue that can be informed by real world research without the need for world building.
3. Key cards, locks, etc would be an interesting space to explore that I haven't come up with an interesting idea for yet.

So far this my answer, but I'd to hear ideas approaching from other angles.

Relatively easy and with low intrusiveness would be a dual spectrum (visible light/thermal) cameras backed by an AI to always be watching and noticing discrepancies. Get enough cameras to get close to full coverage. Pressure plates add to it, but more expensive after construction probably.

A little more expensive for company morale might be tracking badges on everyone at work. If the suveilence system noticed a person without a tracking badge that would be an alert.

What would you do if you were the security manager?

Answer 1

Nothing at all.

The low prevalence and diversity of useful powers means it is not worthwhile to implement highly specific security measures. A high fence won't stop people who can fly, password-protected systems won't stop people who can read minds, cameras won't stop people who can turn invisible, heavy locks won't stop someone who can teleport, etc. It's unlikely that anyone targeting your organization actually has superpowers, and if they do, you likely won't have implemented whatever measure is needed to stop it. Your security measures are only as strong as the weakest link, and with an unknown diversity of superpowered threats, you have a lot of potential weak links.

As we all know, villains tend to congregate in groups, giving the group a wide array of powers at their disposal. If you haven't defended against every possible superpower, you are still vulnerable, so implementing any measures at all is usually just a waste. Most offices like the ones you describe already have minimal security which can be circumvented by a determined individual. Office security is usually designed to prevent casual intrusion but not a targeted criminal attack from even normal people, so expecting to defend against a targeted criminal attack from someone with superpowers probably isn't even on the table.

To put some numbers on this, suppose your \$1M-a-year company might lose an entire year's worth of profit from a superpower attack. The odds of any attack at all are pretty low, though, perhaps 1/100 for a given year. The odds that the attacker has superpowers is also low, perhaps 1/100, giving you a 1/10000 chance of being subject to a superpower attack in a year. Given that you have only a 1/10000 chance of losing \$1M due to an attack, you're justified in spending only $100 this year on your security system, and you need to make it 100% effective at that price - it's simply not going to happen. Spend any more than that, and you have a negative expected ROI for your security system. You're better off eating the loss, or as @Alexander suggested in the comments, just buying an insurance policy (which will also have negative ROI, but does not require a world-class security system for your run-of-the-mill office).

I'd expect the minimum cost of almost any effective system to run into the tens of thousands, if not hundreds of thousands or millions of dollars. In the example above, you can increase both the cost and likelihood of a superpowered attack by orders of magnitude, and still not reach the break-even point. Defending against superpowered attacks is only worthwhile for targets with a high likelihood of being attacked, in which the expected damages would be enormous. It's simply not feasible for your average company that is not a high-value, high-likelihood target.

Answer 2

Lawyers

"Mostly concerned with protecting people, intellectual property, infrastructure and physical assets that don't have much individual value"

Super villains rarely have a desire to rob photocopying shops for stationary supplies. Stealing intellectual property means they need to commercialize their theft to make it worth it.

Simple answer is sue the people responsible.

Answer 3

/ with the understanding that the chance of being targeted by such an individual is fairly low/

Spread the risk across many such facilities, using insurance.

This is how it is working with unlikely and expensive events now. Rather than massive security to prevent unlikely events, the events happen and the facilites who suffer loss are compensated. If it a robbery, the robbers are not resisted - they leave with what they want. This is essentially what is happening with cybercriminals now: the criminals hold hostage the infrastructure of the facilities and get what they want in the form of a payoff. An event which could be devastating for an individual facility is more of an inconvenience when spread across the many facilities at risk.

The best defense is a good offense.

The problem is when the events become more frequent. This is also the case for cyber crime. Insurance becomes more expensive as in our world. My proposed solution: Certain individual insurers can charge lower rates and companies insured by these insurers will advertise they are so insured. These insurance companies have a "reimbursement" arm which is deployed against entities that inflict damage on insured facilities. The insurance company covers the loss to its insured facility, then reclaims its money (with interest) from the criminals responsible.

The "reimbursement agencies" would make for exciting fiction! I could imagine that these might be autonomous and retained for given jobs by the insurers. Agencies differ in methods and also ethical standards. Some are government arms. Perhaps at one point 2 or more agencies are deployed by different insurers against the same criminals.

Answer 4

As in real life, minimal security is the norm. Security is seen by most corporations as a low concern, because most people aren't criminals and security is not earning money.

In real life, you can have super power like powers as well. You could get a gun and attack a major corporation. If you're hot, you could seduce an employee to mind control them into giving secrets, and these things do happen rarely.

There are a few steps they take to deter these things.

1. A wall around your property. If people can't just walk in, they need to either be good at climbing or be loud to get in. A wall slows people down for a bit.

2. Cameras everywhere to watch stuff. You can see people (and teleporters) doing their thing.

3. A few guards with guns to patrol the area.

4. Badges to get access to areas and access sensitive data.

Unless the superheroes have a very specific powerset, this would deter most people. For heavy threats?

They'd also need a heavy threat response team. I imagine some companies would get a bunch of ex military people and superhero heavy hitters and some teleporters or helicopters, and in the rare incidents where super powered people went crazy, go crush them with overwhelming force. Numerous businesses across the country would sign up for a small monthly fee.

They'd also have someone regularly go to police meetings and other ones that monitored crime, to find out if there was anyone with an unusual power to counter.

All of these are fairly cheap security measures. I see no need to modify them in a superhero world. You could do more with knowledge of specific threats, but you didn't describe any of the superpowers they would face.

Answer 5

Exactly the way we do it in the real world

Physical security in the corporate world is almost never about being impenetrable, it's about being good enough to prevent crimes of opportunity. For 99.9% of businesses, that means a lock on the door, a receptionist at the front desk, and maybe a few hundred dollars worth of surveillance equipment.

However...

• A locked door can be defeated just as easily by kicking it in or picking as phasing through it.
• A receptionist can be convinced to authorize you with a good lie just as easily as with mind control.
• A camera can be defeated as easily with a mask as by turning invisible.

So if you consider this in terms of normal people, what keeps a person from commiting crimes against a corporation is not thier inability to defeat all the security options in place, but an inability to do it without risk. It only takes one layer of security foiling you to turn your calculated risk into jail time. Committing a crime is easy, not getting arrested thereafter is actually the hard part. And since the police have supers too, it is very likely that there are even more ways for an individual criminal to get caught in your world than there are in ours.

By stacking several layers of mundane security features, a criminal may have a single power that gives them a distinct advantage against one of the countermeasures, but does nothing to reduce the risk of being exposed by the others. Since no one power defeats all countermeasures with 100% certainty, your would be super criminals are more or less equally deterred from taking the risk as normal people are in real life from grabbing a gun and mask and doing the same thing.

Answer 6

Back up your business data offsite

To be fair that's a free tip for any business owner, whether you live in a world with superpowers or not. Equipment can be replaced, but data is lost forever. Back it up, once a day, on a remote server, there's plenty of companies that'll take care of that for you so you don't even have to worry about it, and in the event all your computers are destroyed by Superbadman, or something far more likely like a flooding, at worst you lose a day of data.

Other than that and typical office security (whatever is typical for your business), not much you can realistically do. I want you to think that right now that, somewhere in the world, there's possibly a UAV with missile lock on an unsuspecting target. If as a security manager the sound of protecting against drone strikes sounds expensive and ridiculous, I'd like you to rethink just how much of a threat a rogue superpowered criminal is to your business.

Answer 7

You say in the question you're Mostly interested in physical security, but later explain in comments:

The threat model is primarily the protection of intellectual work product of the company. The threat is not originating from terror or state actors, but more likely competing companies. They may hire professionals to acquire those work products, and those professionals may include those with superpowers. The threat is not one single person with one single power, just as we don't protect our computers from only one virus. We have to make a compromise between security, usability and cost

Depending on what you consider by "intellectual work product", there might be:

• is it "and original and highly useful idea nobody has though about"? Patent it and thus let everybody know about it, making no point in stealing it, and get protection by law. The idea/method will get out of the bag sooner or later anyway:

  • either someone else will think of same or better idea, or
  • disgruntled or money-hungry employee will steal it out on his phone or whatever and sell it to competition (or make competing startup himself) , or
  • you'll eventually produce product or service from which somebody skillfull enough will be able to reverse-engineer it and recreate same or better product

  All of those happen today without superpowers (and most of them are way cheaper and easier then running in dodging bullets and stealing HDD from a server), and if you patented it, you'd at least have some recourse. (not that patent litigation in cheap or painless, but is usually better then nothing)

• is it "some great computer software you're going to sell" ? Really? It's going to get "pirated" before you know it, probably by some of your regular employees, or even more likely by one of thousand exploits in your IT infrastructure. It will be out superpowers or not.

  You can try to protect yourself with copyright, or insurance, but really, you should've open sourced the whole thing and built your business model some way that is not doomed to crumble to dust.

• is it "some novel clothing design by popular brand"?

  Just trademark it. World will be overflown with cheap copies on ebay the week it makes it out (or before, by regular employees trying to make buck on the side, as it is trivial to hold in you head and you don't even need data-exfiltration methods),

• is it "some immensely huge amount of data that requires a lot of work and time to collect, and you sell access to very limited API to query it"?

  This at least is the only one that might in some cases might be somewhat related to physical security. Still, solution is IT-based: instead of storing it all in one datacenter (it is huge, right, so you can't keep on few hard disks situated in your company anyway!!), you should shard it with redundancy over multiple datacenters in multiple continents. Any single person is not going to all that trouble for miniscule chances they'd be able to successfully collect thousands of hard disk around the world and reassemble them correctly (and if they do, you'd sue them on database protection rights anyway - and your sysadmins would surely notice disks disappearing way before they could get it all)

• is it something else? what exactly? (especially which form of so-called "intellectual property" exactly)

And anyway, if it is anything based on value of particular combination of zeros and ones (and if you say "intellectual works", it is), you'd use regular techniques as we do today:

• repetitive offsite backups (to prevent loss of data, not just in case of physical breach, but also hardware malfunctions etc)
• data encryption (to prevent someone from gaining knowledge by stealing physical pieces of hardware)
• access control (smartcards with passphrases, biometry, and other forms of multi-factor authentication) to prevent unauthorized online access
• insurance to recoup hardware costs (helps not just with theft of equipment, but also earthquakes, fires, floods etc). Also optionally you might insure for data leaks or whatever.

TL;DR: you don't really need anything extra to target adversaries with superhuman abilities that responsible company does not already account for today. And if they don't, the company in question will probably fail sooner or later (likely sooner) - regardless of existence of any superpower adversaries.

Answer 8

Always start by dealing with the most likely threats first.

Which of these is the most likely type of attacker that you're going to face?

• Someone who can fly
• Someone who can turn invisible
• Someone who can liquefy and flow under the door (think T-1000 from Terminator 2)
• Someone inside the organization who has a grudge, or who wants to make some extra money by selling secrets
• Someone who walks boldly past your security, carrying a clipboard

If your organization is anything like most companies today, there'll be a number of incredibly low-tech attack vectors that you simply aren't guarding against. (Seriously, the clipboard is effective against a crazy number of security checkpoints.) Why stress out about the highly unlikely possibility of a flying invader if anyone can just walk in wearing a post office uniform saying "Package for John Doe, where's his desk please"?

Adopt a multi-pronged defense that doesn't concern itself with specific attack vectors. Others have mentioned insurance, and of course the standard legal protections (copyright, trademark, patent, as applicable to what you're doing). Having basic security cameras can help against a wide variety of attacks, since you get a good chance of having some footage of the infiltration that can be perused afterwards. But most importantly, make sure that people actually know each other. The hardest place to defend is one in which there's constant staff turnover, because anyone can slip in, pretending to be the new guy/gal.

It probably isn't applicable here, but for some types of business, you can actually buy some top-quality security guards for a fairly low figure. For instance, a sign saying "free coffee for on-duty police officers" might reduce revenue a small amount, but who's gonna rob the Starbucks with a constant stream of blue uniforms going in and out? :)