Securing Your Assets With Effective Physical and Digital Risk Management

Speaker 1: Welcome to the Process Breakdown Podcast, where we talk about streamlining and scaling operations of your company, getting rid of bottlenecks and giving your employees all the information they need to be successful at their jobs. Now, let’s get started with the show. (singing)

Dr. Jeremy Weisz: Dr. Jeremy Weisz here, host of the Process Breakdown Podcast, where we talk about streamlining and scaling operations of your company, getting rid of bottlenecks and giving your staff everything they need to be successful at their job. I’m here with Chuck Randolph at AT-RISK International. I’m going to formally introduce Chuck in a second. But, Chuck, I always like to mention other episodes people should check out, and we’ll have to mention your podcast as well. But past guests include David Allen of Getting Things Done, Michael Gerber of The E Myth and many, many more. Let’s mention, give a shout out, tell people your name of your podcast, and what’s a couple of cool guests that you’ve had on, or topics?

Chuck Randolph: Yeah, yeah. Thanks, Jeremy. So the podcast that I co-host on, were on year five, it’s called Conversations in Close Protection. And we have a myriad of folks from the risk world. We’ve had authors like Spencer Coursen and Michael Trott. We’ve also had risk professionals on, CSOs. We’ve had many protectors. We do breakdowns of incidents. We recently just talked about the Haiti assassination. We also spend a lot of time talking about technology, strategy. We’ve had people like Fred Burton from Ontic on before. So I wish I could point to one or two, but if you’re interested in risk, or you’ve ever been interested in the protection world, or you’d like to know a little bit more about the bones of that stuff, go on over to Conversations in Close Protection.

Dr. Jeremy Weisz: Awesome. And before I introduce Chuck, this episode’s brought to you by SweetProcess. And if you’ve had team members ask you the same questions over and over again, and it may be the 10th time you’ve spent explaining it, there is actually a better way, there is a solution. SweetProcess is a software that makes it drop-dead easy to train and onboard new staff and save time with existing staff. And I was talking with one of the owners, Owen. Not only do universities, banks, hospitals, and software companies use them, but first responder government agencies use them in life or death situations. So you use SweetProcess to document all the repetitive tasks that eat up your precious time and your team’s time so you can focus on growing. You can sign up for a free 14 day trial, no credit cards required, at sweetprocess.com. Sweet like candy, S-W-E-E-T, process.com.

Dr. Jeremy Weisz: And I’m here with Chuck Randolph. He’s the senior director of global operations for AT-RISK International. And with experience in the security industry as a military officer, Chuck leads the way in planning, strategic development, tactical deployment, and management of globally sized risk management teams. And you wouldn’t know by looking at him if you are watching the video, but he has over 30 years experience. I was looking at his track record of working at Microsoft for 20 years, being an officer in the Army National Guard for 30 years. He’s worked at the Steering Committee, the US Department of State. He’s got a huge breadth of experience and knowledge. So I’m excited to chat. So, Chuck, thanks for being with me.

Chuck Randolph: Yeah, absolutely. Sometimes I will sit here and listen to that, thinking like, "Man, that guy sounds like a goofball and pretty cool." So, we’ll see.

Dr. Jeremy Weisz: We’re going to get into some, I sense, a lot of COs, some operational things and about leading risk management, but I want to just start with what AT-RISK International does and what you do.

Chuck Randolph: Yeah, absolutely. So AT-RISK is a very quiet consultancy. Often in the security world, you hear the idea of the gray person, or security, it should be a transparent function. AT-RISK has been around since 2003. It truly is a security consultancy from soup to nuts, doing things like threat management, operational assessment, providing boots on the ground type of protection work, intelligence. Some call it boutique intelligence. I just like to call it directed intelligence efforts, such as reports, risk, scenario-based red teaming, all kinds of things. So we’ve operated in over 118 countries. We’ve got offices in five different states and one in the UK and one in the Netherlands. I’ve been there about a year and I’m the senior director for global intelligence and operations. That just means a lot of the work that’s being done by the fine folks of AT-RISK falls up into my desk for management and operational oversight.

Dr. Jeremy Weisz: To put some color around it, what would be an example? What do you get calls about?

Chuck Randolph: Gosh, that’s a good question. So we were just talking before we turned the mics on, like you have your day, and probably like you and many, I have a process. My process is a book and I sit down and write in it, like, "I need to do…" Oftentimes, the five or six things that I know are sacrosanct for me to do that day get ripped out because of the needs. For example, we could get a phone call. And I’ll give you a range. The range could be, "Hey, I have a death threat that’s come to me, and I’m on my way to do a speech in Washington D.C. Can you guys help me with some threat management?" We could also get a call that says, "Hey, [crosstalk 00:05:43]-"

Dr. Jeremy Weisz: It’d be like, "I’m going to be at my speech in five minutes. So I need help." No.

Chuck Randolph: Of course, and that, Doc, that always comes in Friday at 5:00 PM, by the way. We also do work with multinationals and NGOs and government organizations to do assessments, training and other type of work overseas, perhaps maybe to provide subject matter experts for training teams. We could be working at any given time on a political campaign, doing threat assessment, an event, some call it event security, I would call it event risk management, to, "Hey, we’re a startup. We’re about to go public and we need some assistance putting together a security program or an apparatus," to, "We are a company that’s been around for a long time, but we suddenly believe that there might be a need to have a greater security presence or risk management presence in our company. Can you come in, do an assessment, and tell us what it’s about?" And then, I mean, there’s all kinds of things in between that too. So surveillance, surveillance protection, counter surveillance, protective surveillance, intelligence, risk assessment, travel security. I mean, I wish I could say, "Here’s the top two or three things," but it changes every day, my friend.

Dr. Jeremy Weisz: We’ll go into some of the processes and systems and operations around the… You’re talking about the convergence of digital and physical threats. And so I don’t know if you want to separate them out and talk about some of the things that companies should be thinking about to create process around digital threats, and then maybe talk about the physical piece, because I know a lot of people do think about the digital right now.

Chuck Randolph: Well, it’s interesting, because I think we look at digital, but we see it every day in the media. And we’ve talked about this on Conversations in Close Protection before as well. Before, you said this, you had this word convergence that I think was overused for a while, and now it’s coming back into fashion, because you do… For example, we’ve had governors who we know there were plots to kidnap. And part of that plot included somebody going out on, air quotes here for those listing, "the internet" or the interwebs and doing some open sourcing. "Hey, we know where this luminary lives. We found this information on him." I might say that’s a digital threat. Well, now on the protection side or the physical side, you also have folks that are looking at risk management, looking at protecting these individuals. And a good protection effort is more than just the bodyguard or the body person that’s right next to the individual, whether it’s a CEO or an entertainer.

Chuck Randolph: So I think what we’re seeing now is overlapping domains. I think it was, and I’m going to look because I happen to have something pulled up, when you brought this up, on something I’m working on, on a white paper I wrote, and I think it was C-suite population have faced an increase in both physical and digital threats this past year, in 2019, actually, 2019, 2020. And there was an article that said 69% of executives have seen a dramatic increase in physical threat activities against their company this year compared to the last few years. And a lot of that’s driven by COVID. A lot of that’s driven by threat. Now let’s overlay the 2020 Verizon digital threat report. And it says, "The data breach investigative report suggests corporate executives are targeted 12 times more in phishing and social engineering," wherein other years are concerned. You put those threats together and you might say, or if you’re listening, you’re like, "So what? What does one have to do with the other?"

Chuck Randolph: Well, what’s the saying? "We don’t know what we don’t know." So a lot of times I think a process that organizations need to stop and think about is what I might call like an intelligence driven operations-led threat informed philosophy. So in other words, Jeremy, if you’re running the cyber team and I’m running the physical team and we have somebody else over here that is perhaps in branding or social media, maybe we should start thinking about having a regular sync or using some type of software or platform to say, "Here’s what we’re seeing."

Chuck Randolph: Because it’s important, because you might look at that and say, "Hey, I’m seeing something here that’s interesting." I mean, you could call me up and say, "Hey, Chuck, I see this issue that you reported. Can you give me more about that?" And that might lead to something that we both might look at and say, "Okay, this is a deal." Because, at the end of the day, what did Stanley McChrystal say? "It takes a network to defeat a network." But if we’re bifurcating our own networks into our own tribes and our own cultures, then we’re creating fences in between fences, or what? Gaps. So, that’s a little wordy, but it’s a very passionate subject for me.

Dr. Jeremy Weisz: Yeah. No, I mean, I feel like, let’s say you’re talking to a startup, and do they typically have nothing in place? Do they typically have something in place for digital?

Chuck Randolph: They might. I mean, there are great companies out there that you can go to and do plug and play that will offer you digital protection. I mean, I won’t go through all of them, but there are many out there that will do that. But I believe that a lot of startups, they don’t… You and I, if we have a startup to make widgets, I don’t think our first thing that we’re going to say is like, "Gosh, let’s put a robust security structure in place." We’re not even thinking about that.

Dr. Jeremy Weisz: Exactly.

Chuck Randolph: We’re thinking like, "Dang. We’re making widgets. These are the greatest widgets in the world. We want everyone to buy the widgets and we want them to use our widgets. Awesome." And then at some point I think risk kind of walks in in the back fence. And then before you know it, there’s this dark figure in our room and you’re like, "Who’s that? Oh, that’s risk. And gosh, well, we better mitigate it." But what I’m finding more is that, and maybe it’s because of investor involvement or just people being more smart around risk, is these questions are being asked earlier on, like, "Hey, you have a startup. What have we thought about in terms of your digital footprint to detect, deter, disrupt or deny activity?" Because, hey, like I said, you and I may have a widget producing company, but gosh, we had a denial of service attack and nobody can order widgets online. Well, that’s going to affect our bottom line.

Chuck Randolph: And I think slowly also, maybe it’s been exacerbated by COVID, which seems to exacerbate a lot of things, people are now thinking about a physical exposure too. Because in the security world, whether it’s digital or physical, you have this idea of an endpoint. And a lot of times the endpoint, hey, our endpoint is at a headquarters. It’s a brick and mortar building that we’ve built digital and physical fences around. Well, those endpoints are no longer guaranteed to be in that brick and mortar headquarters. That endpoint could be at your house. It could be at a Starbucks. It could be at a McDonald’s. It could be, maybe you’re at the dunes, sitting at a park bench. So I think people are thinking more holistically too around the threats that are around, that are surrounding their executives or their key individuals or their key assets.

Dr. Jeremy Weisz: What should people do, Chuck? Like you mentioned, people start to slowly think about the risk. And from a digital perspective, what are some of the things they should start to think about and put in place?

Chuck Randolph: Individuals or companies?

Dr. Jeremy Weisz: Companies.

Chuck Randolph: So, that’s a great question. I think of conjunction, conjunction points or synchronization. And I’ll give you a quick aside. The last 15 years in my military career was in information operation. And really, it was like having another full-time job. But a lot of information operations in the army was about, at some level, synchronization. And that stuck with me as an officer. I mean, as an officer, a lot of times non-commissioned officers or sergeants and NCOs, they get to do all the fun, and the officers have to go away, do a bunch of planning courses. But every once in a while, some stuff sticks from those. And something that I learned as an IO, information operations practitioner, was this idea of like, "Look, my main role here is to get everyone on the same page." So I often think of conjunction points in terms of, what should we do if we’re standing up security functions?

Chuck Randolph: And if you think of just briefly things like assessments. If we’re doing digital and physical assessments, can we combine those? So if we’re going to the CEO, if we’re going to Jeremy the CEO of the widget company’s home, let’s make sure if we’re there to do a physical assessment, let’s add a digital lens. Or vice versa, if we’ve been asked to do the network, could we please go ahead and bring up like, "Hey, has anybody thought to do a physical assessment so that we can cover our bases?" That also includes things like social media scrubbing, personally identifiable information or PII that we need to find and take down. Communication, something else that I think is important, because oftentimes, and I think it’s getting better, but oftentimes digital and physical security folks aren’t always on the same sheet.

Chuck Randolph: And you can have this idea of common operating platforms. We’re all working from the same system, common operating the language, we’re all reporting in the same system, but something else that I think is an undersung hero of all this, Jeremy, is common operating information. For example, maybe you’re German, maybe I’m French. We might speak English because it’s what we learned in business college. But when you think about a problem or you dream, what do you dream in? Probably German, and I dream or think about problems in French. We have a cultural nuance and a unconscious bias, all these kind of things we can add in there. So if we have information that we can look at and we can all look at it from our lens and derive information by which we can make decisions, that’s common operating information.

Chuck Randolph: And from that, if you’re the digital person and I’m the physical person and we’re reporting up the chain, be it to maybe it’s the CEO, let’s just say the CEO, it’s important that we’re saying similar things. Because I think people often are like, "Hey, look, I’m the one. I ran up there and I have the information." But if you think about it from a CEO’s point of view, "Look, I need to make a decision." Maybe it’s, maybe we’ve had a breach. Maybe our product has been tampered with. Maybe, God forbid, we’ve had an active shooter or something in a building. This is now not the time for me to try to put on, "What tribe am I talking to?" So I think that idea of communications is something that we need to continue to stress.

Chuck Randolph: Monitoring. We’re both, again, digital and physical, we’re both monitoring for threats. If we can understand what each other is monitoring for and we can figure out what resources… I mean, you talk about at the top of the show, "Hey, we need to have ways in which we can take activities that we do time and time and time again, so that we can come to it, get common operating information, say, ‘Hey, this is something that affects physical. This is something that affects digital.’" One might say to the other, "I don’t care. It’s not my cup of tea." But, at the end of the day, what did we learn from watching GI Joe cartoons when we were kids? Knowing is half the battle.

Chuck Randolph: And then of course, the other bit that we’re seeing more of now, well, hopefully we’ll begin to see more of, is travel security. We have executives and people that are traveling around. Of course, you could say on one end, "If you go to Mexico, we don’t want you to get lifted." But in the same sense, we now have to put our digital hat on and say, "Hey, please don’t use the Wi-Fi at the coffee shop." So as many physical protocols as we put on people with travel, we need to make sure that we’re also looking at the digital lens over that and saying, "What’s the digital issue or the information or operational security issue?"

Dr. Jeremy Weisz: Chuck, you mentioned assessment. And so if you’re talking to a company and they’re like, "We need to shore up our digital threats," which will lead to the physical threats, like you said, where do you start people at? What I visualize is, well, do you start, "Let’s Google their name to see what personal information comes up"? Where do you start and what do you do as far as that assessment goes, when someone’s like, "Hey, can you see where we’re at?" Like you said, the knowledge. Can you give us where we’re at today?

Chuck Randolph: That’s a great question. Because if we went out to five different organizations and said cyber, we would probably get 25 different definitions of what that means. So for me as a consultant, if I was coming to you and said, "Hey, Jeremy, what is it that you’re afraid of?" That sounds like a very cheeky response, like, "What keeps you up at night?" Which, I hate that question. I’ll give you the answer, random traffic accidents. But what I would say is like, "Jeremy, how do you define cyber? Is it a network? Is it some IT function of a network? Okay. You’re worried about the network. Well, let’s think about a penetration test that’s done digitally, or let’s go through and do some governance and check the blocks."

Chuck Randolph: But as you just said, using this as an example, you said information that’s available. To me, that suggests that what we’re concerned about is a deeper… Well, think about things like 4chan or deeper web searches, dark places that our kids shouldn’t be at and we shouldn’t be at, those are professionals to go to. If that were the case, then I’d say, "Okay, we need to do some deep risk monitoring." Oftentimes, corporation in the intelligence world, things are run on what’s called intelligence requirements. But in other words, and you as a doctor, you certainly understand this, what’s key information you need to know, requirements? But what often isn’t happening is people aren’t having these discussions to derive requirements. It’s like, "Hey, go out there and do risk assessment." And then somebody charges forth and starts talking about things. But are we doing measurements of performance, or are we doing measurements of effectiveness where we’re doing targeted information that leads itself to answering questions? So back to your original question, how would you begin? I would begin, as with everything, a question.

Dr. Jeremy Weisz: Yeah, that makes sense. So you’re starting with, "What are you afraid of?" And then that probably opens up a rabbit hole of different things. Because if they say, "X," that X, there may be four things touching that thing that they’re afraid of. Then you have to assess all those different aspects.

Chuck Randolph: Yeah. And I’ll give you a cheat sheet too. If it’s a publicly traded company, I mean, you could go to the 10-K. Most publicly traded companies have the 10-K. It’s a financial document. They have to report it to the IRS, et cetera. It’s prepared. And while it’s mostly financial in nature, if you go to a 10-K, within that 10-K is a risk statement. It basically says, "This is what we’re afraid of." So back in an earlier life, and I’ve actually done it since I’ve come over to the consulting side too, is help people go through and look at their 10-K and say, "Okay, well, your company is concerned about IP loss. It’s concerned about brand issues." Maybe you’re an up-and-coming green energy company and you’re concerned about geopolitical issues from, say, Russia or China, who might be looking at the IP that you’re producing.

Chuck Randolph: So from that, if we don’t know, we can look at these, at the 10-K, and say, "Okay, well, your 10-K listed these eight things. So let’s build a monitoring function and an assessment function around these 10 things, and then let’s just start drilling down." So, okay, if we’re concerned about geopolitical risk, what’s the play for the CEO? What’s the play for the C-suite folks or the key individuals? What’s the play for the company? Okay. Who might come out? I mean, there’s all these things that we can derive that we can start making a plan around.

Chuck Randolph: So at worst, if you’re not able to ask the question, "What keeps you up at night, or what scares you, Jeremy?" I can come back and say, "Hey, Jeremy, I looked at your 10-K. Here’s what I think. Here’s what I think the monitoring should be around. Do you agree? Or would you add anything to that or take anything away?" And you might say, "Well, we’re not really concerned about this, but due to the IP loss, and we recently opened an office in Venezuela, we’re really concerned about these things." I mean, so you kind of get the process it goes through.

Dr. Jeremy Weisz: Chuck, I have one last question, but first of all, thank you. I want to encourage anyone to go to at-riskinternational.com, learn more about what they’re doing there. And this has been, again, just eye-opening to the different things that are out there. Because a lot of times, at least for me, this is not where my mind goes. And like you said, the company selling widgets is worried about selling widgets and not about everything else that’s going on in their small world and globally. So I appreciate you at least shining a light on this topic in general. And I wanted to end on, you’ve done this not just digitally, not just physically, but for some notable companies and people, including Goo Goo Dolls, Whitney Houston, you’ve helped protect as far as that goes. So I’d love to hear, I don’t know what pops out as a story in those days where you were protecting some of these, again, very front-facing, very public figures.

Chuck Randolph: Oh my gosh. Well, I’ve been to over [crosstalk 00:25:13]-

Dr. Jeremy Weisz: Kevin Costner played you in The Bodyguard, right?

Chuck Randolph: Yeah. Actually, that’s a funny story. So we were at the Academy Awards with Whitney Houston, at the time, her director of security Alan Jacobs, and I was doing what’s called advance. And Kevin Costner did come down to see Whitney. He walked up and looked at both of us and we looked at him, and she happened to just walk out of her door at that point. And she was like, "Sorry, boys, but my real bodyguard is here." And he was like, "Sorry, fellas." But it was a good joke that was had by all.

Chuck Randolph: I’ll give you a great story. And gosh, I mean, so many just run through my mind, like when I was in Africa with MTV and then down in Brazil with Tony Robbins. But I was with Norman Schwarzkopf after he came back and retired, and he was starting on the speaking circuit. I was brand new. I think this was like maybe my second detail ever as a executive protection person. And we’re at this venue. It’s a big venue. I’m what you might call the number four person on the detail. And for those who don’t understand what that is, I’m like the lowest man on the totem pole. So like, "Go get the cars ready. Go do this. Go do that."

Chuck Randolph: And I’m squeaky, my hair is much redder, and I didn’t have any gray in my beard. So I’m at stage right. Somebody else is at stage left. There’s people in the front of house. There’s like 60,000 people here, and there’s people out back. The detail leader went back to check on something with the car. And somebody failed to tell us about pyro. And I think it was asked and they said they didn’t know. So he gets up on stage. We get him to the venue. We walk up on stage. We haven’t been there that long. Sometimes you have the opportunity to what’s called advance a location, like, "Hey, I’m going to bring Jeremy here. I’m going to go early, see what everything is. Make sure everything’s good." Sometimes it’s like, boom, you got to go. So we had a quick advance. We show up. He walks up on stage. Pyro goes off like boom, boom, boom, boom, boom! Two-

Dr. Jeremy Weisz: Like flames?

Chuck Randolph: Yeah.

Dr. Jeremy Weisz: Or what is it? Yeah.

Chuck Randolph: Yeah, flames and two confetti cannons. And even though it’s shooting confetti, it makes the same sound as a cannon. So you have pyro going off and then you hear this boom, boom. He jumps down behind the podium. I get halfway up on stage. The other guy’s on the other side of the stage. Schwarzkopf stands up and puts his hands out. And this is like the mark of somebody who’s just with it. He stands up and he looks around, and without missing a beat, he’s like, "Saddam still can’t get me. Ha, ha, ha." And everybody roars in laughter. I’m already thinking like, "Well, crap, we’re going to get fired, and I probably need to go change my pants." But that was my second detail ever, and I thought, "Whoa." But needless to say, I’ve never failed to ask about pyro in the-

Dr. Jeremy Weisz: It’d be nice to know that ahead of time.

Chuck Randolph: Yeah, for sure. But, yeah, that’s great, and thanks for asking that question and making me think about the little memory trip there.

Dr. Jeremy Weisz: I love it. Thank you. Everyone check out at-riskinternational.com, more of Chuck Randolph’s podcast, SweetProcess, and more of the Process Breakdown. And, Chuck, I want to be the first one to thank you. Thanks so much.

Chuck Randolph: Yeah. Thank you, Jeremy.

Speaker 1: Thanks for listening to the Process Breakdown Podcast. Before you go, quick question, do you want a tool that makes it easy to document processes, procedures and/or policies for your company so that your employees have all the information they need to be successful at their job? If yes, sign up for a free 14 day trial of SweetProcess. No credit card is required to sign up. Go to sweetprocess.com, sweet like candy and process like process.com. Go now to sweetprocess.com and sign up for your risk-free 14 day trial. (singing)

Owen McGab Enaohwo: Hi, this is Owen, the CEO and co-founder, yeah, of SweetProcess. If you’ve enjoyed listening to this podcast interview, actually, you know what I want you to do? Go ahead and leave us a five star review on iTunes. That way we get more people aware of the good stuff that you get here on this podcast. Again, go onto iTunes and leave us a five star review. Looking forward to reading your review. Have a good day. (singing)