Course Title

1. Introduction to Integrated Security

• The converged security threat landscape including (physical breaches, cyber intrusions, insider threats, and social engineering — and how they interconnect)

• Applicable standards including (ASIS PSC.1: Management System for Quality of Private Security Company Operations and ISO/IEC 27001:2022 Annex A.6.3 and physical security controls)

• Security roles and responsibilities including (dedicated security personnel, all-staff security awareness obligations, and management accountability under ISO/IEC 27001:2022)

• The cost of security failures including (data breach consequences, reputational damage, regulatory penalties, and physical asset loss in Middle East organizational contexts)

• Overview of the HIRARC methodology applied to security threat assessment throughout the course

2. Physical Security — Access Control and Perimeter Protection

• Physical security perimeter principles in accordance with ASIS PSC.1 and ISO/IEC 27001:2022 Annex A including (layered perimeter design, controlled entry points, and security zone classification)

• Access control systems and their operation including (card readers, biometric systems, PIN-code entry, and manual key management procedures)

• Tailgating and piggybacking prevention including (recognition techniques, challenge procedures, and physical barrier enforcement at entry points)

• Visitor management procedures including (identity verification, visitor registration, escort requirements, and temporary access badge issuance and retrieval)

• Secure area management including (clear desk and clear screen policies, restricted zone enforcement, and document and asset handling in sensitive areas)

• CCTV and surveillance system awareness including (operator responsibilities, footage retention obligations, and privacy considerations in Middle East regulatory contexts)

3. Threat Detection, Patrol, and Incident Response

• Security patrol techniques and patrol planning including (fixed and mobile patrol patterns, patrol documentation, and checkpoint reporting procedures)

• Threat recognition and suspicious behavior identification including (behavioral indicators of unauthorized access, theft, workplace violence precursors, and suspicious package identification)

• Applying HIRARC to physical security threat assessment including (identifying credible threat scenarios, rating likelihood and consequence, and selecting proportionate response controls)

• De-escalation techniques for security personnel including (managing aggressive or non-compliant individuals, verbal communication control, and when to escalate to law enforcement)

• Emergency response procedures including (lockdown activation, evacuation support, bomb threat response, and coordination with civil defense and law enforcement authorities)

• Security incident documentation including (incident report writing, evidence preservation, chain of custody, and regulatory notification requirements)

4. Cybersecurity Awareness and Information Security

• Information security principles under ISO/IEC 27001:2022 including (Confidentiality, Integrity, and Availability — the CIA triad — and their practical meaning for all personnel)

• Data classification and handling including (classification levels — public, internal, confidential, and restricted — and correct handling, storage, and disposal procedures for each)

• Password security and access management including (strong password construction, multi-factor authentication, prohibition on password sharing, and correct response to suspected account compromise)

• Phishing and email-based attacks including (identifying phishing indicators — suspicious sender, urgency, link mismatches — and correct response — do not click, report to IT security)

• Safe internet and device use including (acceptable use policy compliance, public Wi-Fi risks, removable media restrictions, and screen lock requirements for unattended devices)

• Data breach and cybersecurity incident reporting in accordance with ISO/IEC 27001:2022 Annex A.6.3 including (what to report, to whom, and within what timeframe)

5. Social Engineering Recognition and Defense

• Social engineering attack types and their mechanics including (phishing, vishing — voice phishing, smishing — SMS phishing, pretexting, impersonation, and baiting)

• Psychological manipulation tactics used in social engineering including (urgency creation, authority impersonation, reciprocity exploitation, and fear-based pressure)

• Recognizing social engineering in physical environments including (impersonation of maintenance workers, delivery personnel, or authority figures to gain unauthorized site access)

• Defense behaviors against social engineering including (verify before acting, confirm identity through official channels, never disclose credentials or sensitive information under pressure, and report all suspected attempts)

• Insider threat awareness including (recognizing behavioral indicators of malicious insider activity, the role of access control in limiting insider threat impact, and reporting obligations)

6. HSE, Quality, and Security Management Integration

• Integration of security within the organizational Health, Safety, and Environment (HSE) management system including (security threats in the risk register, security incident reporting within HSE frameworks, and security-HSE interface during emergency response)

• Quality management in security operations in accordance with ISO/IEC 27001:2022 including (security policy documentation, training records, incident log maintenance, and access control audit trails)

• Security KPIs and performance monitoring including (incident frequency, access control compliance rate, phishing simulation results, and patrol completion rates)

• Continuous improvement in security programs including (Plan-Do-Check-Act — PDCA applied to security threat assessment updates, policy revision, and lessons learned integration from incidents)

• Regulatory and legal compliance in Middle East security environments including (local law enforcement coordination obligations, data protection regulatory requirements, and civil defense notification procedures)

7. Case Studies and Group Discussions

• Case studies from physical and cybersecurity incidents in Middle East organizational environments including (tailgating-enabled data center breaches, phishing attacks that compromised financial systems, social engineering impersonation incidents at corporate facilities, and insider threat events in high-security environments) and the importance of proper integrated security training in protecting organizational assets, data, and personnel

• Group discussion on security challenges in regional professional contexts including (managing access control in large multi-tenant facilities, security culture development in high-turnover workforces, and balancing hospitality norms with visitor security protocols in the Middle East)

• Security scenario exercise including (participants assess a presented combined physical and cyber threat scenario, apply HIRARC to identify risks, and develop an integrated security response plan for peer and facilitator review)