In Depth

TSA's Risk-based Approach to Security

George Naccara is betting that the lift of his risk-based reforms will overcome the drag of politics and bureaucracy. And the test bed for these innovations is Boston's Logan Airport

By Scott Berinato

March 01, 2006CSO

Part 1: Lift

Terminal A in Boston's Logan International Airport is so new it still has that new terminal smell. It's absurdly spacious with ceilings of significant altitude. Trash bins, benches and planters (currently holding poinsettias)pretty and also designed to bear up against bomb blastsrun the length of the sparsely adorned building, parallel to massive (blast-resistant) panes of glass that make up the terminal's front wall and look out on a state police officer who tells lingering motorists to move along on this bright blue day just before Christmas. The terminal is subdued. A few passengers check in and watch as their checked bags are conveyed behind a curtain, out of sight. George Naccara, Logan's federal security director, the Transportation Security Administration's head man here, hustles past the counters and down an escalator. He's going where the bags are going.

At about the same time, Rep. Ed Markey (D-Mass.) is hosting a press event in Terminal B, an older facility with low ceilings and narrow hallways. Markey is introducing the Leave All Blades Behind Act, legislation that would prevent TSA from removing some scissors and tools such as screwdrivers from its banned-items list, which was scheduled to happen two days hence. This change is a small but controversial part of Naccara's broader, ambitious agenda to reinvent TSAat Logan anywayas a risk-based decision-making organization. By whatever small amount the banned-items list reduces risk, Naccara argues, it's not nearly proportional to the resources it requires.

Every month, Logan's TSA screeners confiscate 12,000 banned items from the traveling public. Pocket knives, knitting needles, scissors and the like make up the vast majority. Once in a while, a serious blade shows up, as does the occasional ice pick. Screeners have confiscated a can with the words "Time Bomb" stamped on the side. It was perfume. Every so often they'll seize a carburetor. Once, a research doctor tried to stow seven human heads in the overhead bin.

"But the point is, 11,995 of those items pose no risk at all," Naccara says. "They're people going about their business who say, 'I forgot that was in there.'"

A more effective security operation, Naccara argues, will not waste time looking for and confiscating scissors and knitting needles. It will watch the behavior of the people who carry scissors and knitting needles; and it will use technology to look for more serious threats in a way that's both less random and more comprehensive than current methods. Naccara's insistence on ending the confiscation madness and reinventing TSA comes off as a kind of benevolent belligerence. He's also received some support from his boss in Washington, D.C., Kip Hawley, who has similar ideas about managing risk.

RESOURCE CENTER
Loading...
VIRTUAL CONFERENCE
Data Center Directions Virtual Conference

Data Center VCAttend this free, 100% online event exploring tools and techniques for making your data center deliver for today and tomorrow.

» Learn more and register here

WEBCAST
The Surest Path to Effective and Efficient Compliance

VeriSignIn this webcast, we explore why and how — with best practices, practical tips and solutions that work — to ease your compliance challenge.

» View the webcast

Featured Sponsors
Sponsored Links

Think your data is safe? Think again. It's time to Outthink the Threat. Get eBook now

Learn how the new Quad-Core AMD Opteron™ processor improves performance

IDC Defines an Identity and Access Management Submarket

Welcome to the age of Service-Oriented Security (SOS)

Configuration Assessment: Choosing the Right Solution

Data Protection: Challenges for the Traveling User

Key strategies for C-level executives and security staff

7 Requirements of Data Loss Prevention

Information Security: Data Drains and How to Prevent Loss

How Are Open Source Development Communities Embracing Security Best Practices?

Using Likewise to Comply with PCI Data Security Standard

Enabling Compliance with Converged Mainframe Security and Storage

IS/IT Project Mgt. Credentials From Villanova - 100% Online

Rolling the dice with your security? Take the Self-Assessment Test now

Digital Identity Protection and Data Security Get Personal

Everything Today's CISO Needs to Know About Using SSO to Succeed in the Web 2.0 Era

Revolutionizing Endpoint Security with a Single Agent

Envision Identity-Based Access Control for the Datacenter

E-LOAN Maintains Reputation as a Privacy Leader with Symantec

Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands

Prudential Financial Protects its Brand with Symantec

Envision Identity-Based Access Control for the Datacenter

IDC Defines an Identity and Access Management Submarket for Managing Privileged User Accounts and Meeting GRC Requirements

The Case for Business Software Assurance ~ Securing Your Applications