I think the sad part is that they had probably had some security guy tell them this already but people where just making fun of him because people don't believe things they can not see - so it takes a "pretend to be SPYs charade" to make people actually care.
Any system that relies on humans always remembering everything and acting perfectly is inherently naive and broken. The security guard isn't there to check badges in a properly secure environment, only to respond to incidents.
But the lowly security guard also does not want to piss of a higher class being, which is so high, it is above all that. "How dare you question me! Don't you know who I am?"
This attitude for example is what makes it hard for that low guard.
Generally, if you act, like you belong somewhere and have the right to do so, your are seldom stopped.
The counter defence would be indeed, just follow strictly security protocoll for everyone with no exceptions.
And well, hire professional security. I briefly worked in security, in a company supposedly with higher standard. Well, I would not hire them, for anything serious. General staff morale is very low, in that low payed sector.
Maybe, but you better believe everyone has to scan a valid badge if they want to get into the office in the first place. And through every door.
I worked at a place that stressed this at company meetings - “no holding doors, if someone says they forgot their badge don’t let them in etc”
At one meeting the CEO got up and talked and praised one of the employees because they actually did this to him, the CEO; shut the door in his face made him walk back to his car to get his badge. Was very funny to see a place actually walk the talk on this.
Overall though of course you’re right. People are going to be nice and you can’t stop it.
Companies that want to prevent tailgating need to spend the money on mantraps or other infrastructure that is clearly designed to allow one person through at a time.
So pay a reasonable wage that actually boosts the morale of the security staff to ensure they do their best and not just act like a velvet rope?
So sadly for many only the threat of dismissal forces those unhappy ranks to do their job. Others have a strong work/duty ethic, and will do their best. One thing that can help overall is an entire corporate culture, where everyone is lambasted for such failures.
"You saw that <security guard> wasn't doing his job, and you didn't tell anyone? You're in trouble too!", and so on.
That is precisely what you not want to do, all that breeds is a culture of hyper-paranoid ass-covering and blame deflection.
So. Much. This.
The number of people who do “just enough” to not get fired is staggering.
There is no “work ethic”.
At least in the military when somebody fucks up during training the entire $GROUP gets punished. It doesn’t take long before people start taking “rules” seriously.
There needs to more consequences and accountability.
It’s a threat of violent coercion, even though daddy never personally hit you or anyone you served with.
It’s how all abusive relationships work, they just operationalized and scaled it to an unprecedented degree.
And then you come out of that abusive relationship with a quick reintegration course and track your duty, but no honor, back to the private sector. If vets weren’t a protected category, they’d be subject to more discrimination due to the warped psyche basic training is designed to produce.
only the threat of dismissal forces those unhappy ranks to do their job
Here's an example. Your salary is $1M per year, or $10k. In both cases, you hate work, hate your job, don't want to do it, and...
can never be fired.
How does better pay help?
Better pay may help, but only conjoined with the threat of it being taken away if you don't do your job.
And amusingly, you throw out the "better pay" line without even knowing the salary.
That's probably higher than average.
If you are the kind of company that has a focus on all aspects of security, and assumes a sophisticated actor is attacking, you will have a better chance at defending against unsophisticated actors.
If you plan your security around only defending 'less-sophisticated' actors then you might quickly find one slips through the cracks.
Same thing with attitudes to security of leadership teams. And if past events are indicative, there's way more leadership teams that don't give a rats ass about security than ones that do. Particularly when you're holding other people's valuables (data).
I've now coined the phrase, accidentally.
Along those lines, however, it's peace of mind against an actual intrusion, but it's also peace of mind against lawsuits for dereliction of duty, etc.