Ever since my first day at the school, I was greeted by the security guard at the entrance.
This is normal and exactly how it should be. A school needs some kind of barrier between the public and the students inside. Not everyone who walks through the door should automatically be allowed to enter.
The first questions I received were simple:
“Who are you?”
“Why are you here?”
The problem was that the guard had almost no way to properly verify my answer.
There was no clear visitor list, no temporary badge system and no standard procedure for checking whether somebody was expected. In many cases, the guard had to rely on memory:
“Have I seen this person before?”
“Did the principal say someone was coming?”
“Is this really a contractor?”
This becomes even harder in the morning when hundreds of students enter the building at almost the same time.
The guards also did not always look clearly identifiable. Some had no visible badge or standardized uniform.
So, instead of only writing a report about it, I decided to work directly with the guards.
Gathering the guards
I gathered the security guards and organized a few short meetings with them with authorization, of course.
The purpose was not to tell them that everything they were doing was wrong.
Instead, we discussed what was already working and what situations were difficult for them.
I asked questions such as:
- What do you do if someone says the principal invited them?
- What happens if a parent refuses to wait outside?
- What do you do if a student opens the door for a stranger?
- Who do you call during an emergency?
- What happens if somebody asks to see CCTV recordings?
This was useful because some problems only become visible when you talk to the people actually doing the job.
One guard explained that during the morning rush it is almost impossible to watch every person entering while also answering questions from parents and visitors.
Preparing the training material
After the meetings, I prepared simple training materials.
I did not want to give them a 100-page security manual nobody would read.
Instead, I created short instructions for common situations.
For example:
Unknown visitor
- Stop the person at the entrance.
- Ask who they are.
- Ask why they are visiting.
- Ask for identification when appropriate.
- Contact the person they claim to be visiting.
- Do not allow access until the visit is confirmed.
Another scenario was an IT contractor.
Someone saying:
“I am from IT. I need access to the server room.”
should not be enough.
The guard should verify the person with the administration before allowing access.
This connects directly with cybersecurity. If an unknown person gains physical access to a network room, many digital security controls become useless.
Practical situations
We also discussed realistic scenarios.
One was a parent demanding to enter without authorization.
Another was a student holding the door open for a stranger.
We covered suspicious bags, student fights, fire alarms, missing students and unknown people walking toward classrooms.
For every situation, I tried to keep the procedure simple:
Observe → Verify → Contact → Act → Record
I also looked at official guidance and legislation relevant to schools in Estonia and Moldova.
In Estonia, the Basic Schools and Upper Secondary Schools Act includes specific requirements concerning physical and mental security in schools, prevention of dangerous situations, emergency planning, surveillance systems and control of entry to and exit from school premises. Official Estonian legislation — Riigi Teataja
For Moldova, I referred to materials published by the Ministry of Education and Research of the Republic of Moldova, including measures developed together with the Ministry of Internal Affairs for ensuring student safety in educational institutions and preventing violence. Ministry of Education and Research of Moldova — General Education
One important point was incident reporting.
I suggested using this structure:
Who → What → When → Where → What happened → What action was taken → Who was contacted
it is better to write:
“Unknown adult entered at 14:20, had no visitor badge and could not identify the teacher he claimed to be visiting.”
That information is much more useful later.
Incident management
Some of these ideas were familiar to me from the ICS0032 Incident Management course at TalTech.
The same basic principle applies to both cybersecurity and physical security.
You should already know what to do before an incident happens.
During an emergency is not the right time to decide who should call the principal or who should contact emergency services.
Preparation makes the response faster and less confusing.
Conclusion
At first, I thought the main problem was simply that the guards needed badges.
After speaking with them, I realized the real issue was bigger.
They needed clear procedures, better communication and training for unusual situations.
The guards were already performing an important job. My task was to make their work more structured and predictable.
For me, this was another reminder that cybersecurity does not always happen behind a computer screen.
Sometimes security starts with the person standing at the front door.
Comments (0)
no comments yet.