I recently had the opportunity to visit Colombo for few days. Srilanka as a country seems to be changing rapidly after the conclusion of the unrest. The people are very positive; investments are coming in to the country and the mood is very upbeat. One still gets to see few glimpses of the war, when an old captured tank is carried on a trailer across the city. The most visible aspect is that of the “check posts” across the country. There are many police and army check posts on the roads, e.g. from the Bandaranaike International Airport to the hotel we came across at least 8 – 10 of them and we were stopped at 2.

During the day we traveled across the business areas, where too there were several check posts. What happens at the check post is interesting:

  1. There is a young commando with full battle gear and an automatic assault rifle, who waves a stop signal. The commando’s are very young in their early twenties.
  2. As soon as our car driver saw it, he stops the car on the left where there is a check post. (I asked the driver, what happens if you don’t stop. He said with a straight face “they shoot”)
  3. At the check post the drivers lowers the window.
  4. Another young commando asks a few questions
  5. All Srilankan’s in the car show the commando their identification card. All Srilankan’s have an unique ID card with photo and number!
  6. The commando asks about us, and the driver says we are foreigners. “India” the commando asks us, we nod, he smiles and we move on

The above takes just about 2-3 minutes even on a very busy city road. Few meters down the road is a sensitive installation (e.g. an army office) which seems to have the most impressive physical security system. Multiple layers of armed commandos, barricades, spikes on the ground, bunkers with heavy artillery etc.

Two things standout for me:

  1. The security posture is serious, effective and efficient: You don’t see the commando’s relaxed, they are serious about their jobs but there is no unnecessary steps, the check is over in 2-3 minutes
  2. The people know their role and comply: The Srilankan’s don’t step out without their ID card. They don’t complain about being stopped. An auto (yes they have Bajaj auto’s there) is stopped so is a BMW.They don’t throw their weight around. They know and appreciate the security is for them.

Needless to say there are weaknesses in the security posture also and they might not be so diligent after few months/ years when the memories of the war fade and the risk perception is lower.

There is a simple but very important learning for us here. The security posture we develop needs to be:

  1. Applicable
  2. Effective
  3. Committed
  4. Efficient
  5. 5.Accepted (by the users)

AECEA here we go another acronym!

One would say its “obvious”, a word with Dictionary.com defines as “easily seen, recognized, or understood; open to view or knowledge; evident” however we all know we tend to miss what’s in plain sight. This Colombo experience reminded me about basics of Risk management and the security posture.