Message-ID: <8471685.1075858840427.JavaMail.evans@thyme> Date: Mon, 29 Oct 2001 13:44:53 -0800 (PST) From: gary.kenagy@enron.com To: shelley.corman@enron.com Subject: FW: Physical Security of Gas Control and related computer and telecommunications rooms Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-From: Kenagy, Gary X-To: Corman, Shelley X-cc: X-bcc: X-Folder: \SCORMAN (Non-Privileged)\Inbox X-Origin: Corman-S X-FileName: SCORMAN (Non-Privileged).pst Shelley, I am trying to arrange for an audit of the Gas Control area, from a facility security perspective. John Brindle, in his response below, indicates that you may be discussing something similar with his team. I'll try to catch you in the next day or two so we can sync up. Gary -----Original Message----- From: Brindle, John Sent: Monday, October 29, 2001 12:28 PM To: Kenagy, Gary Cc: Killey, Sharon; Ringwelski, Mark; Norosky, Kyle Subject: RE: Physical Security of Gas Control and related computer and telecommunications rooms Gary - I will ask my assistant to set up an appointment after I hear back from you. I would indeed like to attend, but at the very least the individual handling our securty surveys, Mark Ringwelski, will be there. I should tell you that Mark's boss, Kyle Norosky, has been in contact with the VP who is responsible for Gas Control (her name escapes me at the moment). You might want to talk to her to ensure we are not running parallel efforts. I will wait to hear from you before scheduling the appointment. John -----Original Message----- From: Kenagy, Gary Sent: Monday, October 29, 2001 11:02 AM To: Brindle, John Cc: Rahn, Nick Subject: FW: Physical Security of Gas Control and related computer and telecommunications rooms John, I've been told that you handle security for the Enron building now. I'd like to meet with you this week to give you a tour of the facility and discuss some of my concerns regarding the Enron Gas Control area on EB42. They are listed in my notes below. I am particularly interested in arranging for a security audit of the area by a security professional. In the past the facility security was included as a small part of the IT audits. Let me know when you would be available to meet. Thanks, Gary Kenagy x33094 -----Original Message----- From: Woods, Steve Sent: Tuesday, October 23, 2001 4:06 PM To: Kenagy, Gary; Broom, Marcia Cc: Hagen, Bob; McFarland, Jean; Rahn, Nick; Abshire, Scott Subject: RE: Physical Security of Gas Control and related computer and telecommunications rooms Gary, See my comments below. Thanks, Steve -----Original Message----- From: Kenagy, Gary Sent: Monday, October 22, 2001 1:38 PM To: Woods, Steve Cc: Donovan, Bill; Hagen, Bob; McFarland, Jean; Rahn, Nick; Abshire, Scott Subject: RE: Physical Security of Gas Control and related computer and telecommunications rooms Steve, Back on September 17th I sent you the note below asking for guidance and assistance on some security issues. I haven't gotten any response from you. The facilities help desk did get the service elevator monitor in Gas Control fixed. I would still like to work with someone to address the bulleted issues I listed in the original note below. In addition to those, there are a couple more issues that have surfaced recently. 1) Given the planned restacking of the building and the significant increase in employees housed in EB, how does this impact the evacuation plan for the building when a complete evacuation is required? [Woods, Steve] Compared to our present population at Enron Center North (EB) the population will actually be less once all moves are completed. [Woods, Steve] The evacuation we completed on 9-11-01 after the N.Y. disaster went very quickly and without incident. 2) How are we supposed to be notified after-hours of weather related or any other events that security considers a threat to the building where they are recommending evacuation? During a recent weather event we were inside Gas Control (I believe it was Thursday evening, 09/20) and we did not get any notification, but we have been told that security was on a number of floors telling employees to evacuate due to a tornado threatening downtown. [Woods, Steve] Security console is supposed to notify Gas Control when weather approaches, we have reviewed these procedures and they are in place. I will ask security to follow up on this issue. Let me know who to work with. Thanks, Gary -----Original Message----- From: Abshire, Scott Sent: Monday, September 17, 2001 9:33 AM To: Kenagy, Gary; Woods, Steve Cc: Donovan, Bill; Hagen, Bob; McFarland, Jean; Rahn, Nick; Hotte, Steve Subject: RE: Physical Security of Gas Control and related computer and telecommunications rooms FYI... Jim Gearhart and Enron Net Works have removed all non-EDS contractor authorized access to all computer rooms, including Ardmore. These contractors will remain without access until an Enron background investigation is performed or it is verified that an Enron background investigation has already been performed. -Scott. -----Original Message----- From: Kenagy, Gary Sent: Monday, September 17, 2001 9:15 AM To: Woods, Steve Cc: Donovan, Bill; Abshire, Scott; Hagen, Bob; McFarland, Jean; Rahn, Nick Subject: Physical Security of Gas Control and related computer and telecommunications rooms Steve, Who do I initiate conversations with to review the physical building security issues listed below? Recent events would suggest that we need to be auditing these issues routinely. I assume you have worked with Wackenhut consultants or some other organization to perform these types of reviews in the past. These issues are generally addressed as secondary issues in the IT audits, but I think it might be best to address physical security reviews using qualified security professionals, rather than IT auditors. Bob Hagen and Jean McFarland are working on some significant enhancements to our existing Business Continuity processes and this would fit right in. Please let us know who we can work with to begin the review of the issues below ASAP. By the way, I called the facilities help desk with two issues last week and haven't heard back from anyone. The EB42 service elevator lobby video monitoring from the Gas Control Center is not working, and the service elevator doors on EB40 do not lock properly. Thanks in advance for your help, Gary x33094 What are the current risks of unauthorized personnel or visitors attaining access to the Gas Control Center and/or related computer rooms and telecommunications rooms? What are the current physical security policies and procedures for these secure areas? How can these be strengthened or improved upon? Does the current Gas Control Emergency Reaction Plan adequately address potential threats due to breaches of security? Who in the Enron organization is responsible for routine daily management of security and who is responsible for longer term planning? How are security issues communicated? Preventative measures? Early warning?