On December 11, a homemade explosive device was set off in an underground walkway connecting two New York City subway lines beneath the Port Authority bus terminal near Times Square, which accommodates 220,000 passenger trips per day. The attack occurred at 7:20 a.m. during the busy morning rush hour commute. Fortunately, the device only partially detonated, wounding just five people, who were treated for minor injuries.

Whereas the damage from this particular attack was minor compared to many of the other attacks the world has seen over the last year, the methods used—a “suicide bomber” attack, and one aimed to explode in in a highly concentrated area—have raised concerns. Despite what new threats come our way, it’s clear that older tactics never come off the table.

Although a suicide bomb is considered “low-tech,” it is perhaps one of the most difficult methods to detect and prevent, with the bomber himself or a remote handler ready to detonate at any time. Considering the manpower that would be called for, it is not feasible or sustainable to provide the amount of directed security at all locations at all times that would be necessary to prevent this type of scenario.

Attacks such as this underscore the need for businesses, communities, and individuals to be diligent about physical security. While local law enforcement can strengthen the barriers in public spaces, private industry can assist in protecting employees, customers, and those who are present in any public spaces under their control. To do this, companies must assess vulnerabilities, create a preparedness plan that includes measures to deter and respond to crisis situations, and practice these measures on a regular basis.

Assess Vulnerabilities: The first step in prevention is conducting a full risk assessment of physical spaces—identifying critical assets such as people, data connections, and information that would be impacted if disrupted by an attack—and an evaluation of possible threats. Understanding your company’s security vulnerabilities at corporate facilities and the immediately surrounding property becomes your first step in emergency preparedness.

When assessing risk, it is imperative to look at physical spaces three dimensionally; in other words, identifying risks above, below, and around you. For example, in densely populated areas such as New York, buildings that sit directly atop of major transportation hubs or have access to subway stations through the lobby are particularly vulnerable to an attack or smoke from a fire in the transit system.

Create a Preparedness Plan: Determining vulnerabilities and likelihood of identified scenarios will give you a roadmap for investments in mitigation and strategies for triaging to address the most impactful and high-risk assets first.

There are many steps companies can—and should—take when formulating their preparedness plan. These include the following:

• Work with law enforcement to arrange for terrorism awareness training for all employees. Such training educates staff on how to recognize unusual behavior, such as packages being left unattended or a person wearing a heavy coat in warm weather, and stresses the importance of employees reporting any unusual behavior as a critical step in prevention.
• Improve security protocols. Examine access control policies, and determine if barriers such as turnstiles or screening are necessary to help control lobby access. Ensuring adequate surveillance coverage to monitor the space and provide advance warning can mean the difference between a thwarted or successful attack.
• Prepare for crisis. The goal is deterrence and protection, but unfortunately the need exists to prepare for a successful attack. Having defined roles and a hierarchy of responsibilities in place in the event an attack occurs is essential to being able to account for and communicate with employees in a chaotic situation. Having a mechanism for employees to check in during a crisis is also a critical security measure, and this becomes even more critical when an attack takes place during rush hour when the majority of employees are commuting to or from work.

Practice: The final crucial step is to regularly evaluate your emergency preparedness plan through careful practice. Conducting tabletop exercises to test responses to scenarios and identify and minimize security gaps should be an ongoing exercise.

Seemingly random attacks such as suicide bombings that are impossible to prevent leave us feeling at our most vulnerable. Taking steps to understand risks and putting physical security plans in place to minimize these vulnerabilities have become critical components of corporate security. A full commitment to strong security measures, including a well-practiced emergency plan, is a preparedness measure all companies can—and should—take.