Cards 1-40 Flashcards
(40 cards)
Risk is measured by: Determining the __________ in relation to the ____ and _____ associated with it.
V of the A
T and V
Determining the value of the asset in relation to the threats and vulnerabilities associated with it….
Security risk rating = AV X TL X S of I X V
Security risk rating =
asset value x threat likelihood x Severity of incident x Vulnerability
What are the three categories of assets that are exposed to risk?
-P
-Np and
-L
Physical, non-physical and logical….
Physical:
- facilities;
- operational & industrial control systems &
- on-site processes and assets.
Non-physical:
- geo-political landscape;
- culture,
- speed of decision making and
- intensity of competition;
Logical:
- information & digital assets and
- the network or digital space that connects them.
The risk assessment process should be revisited?
cyclically and continuously because of the elements that are constantly subject to change.
The purpose of a security survey?
-determine current seurity posture
-IDentify deficiencies and excesses,
-compare current SP with what would be appropriate; and
-recommend improvements.
When considering vulnerabilities, what 8 factors should be addressed?
-lack of backup for critical functions;
-single points of failure;
-co-location of critical systems, organizations and components;
-inadequate preparedness for attacks;
- inadequate security
-too easy for an aggressor to attack the facility;
-presence of hazardous material
-potential for collateral damage from nearby companies
A security survey focuses more on vulnerabilities than a…..
Physical Security assessment
A cost benefit analysis should be used in both a…….
Physical security assessment and a risk assessment.
The five functions included in a functional approach to a physical security assessment include:
S A&E
SSM
CP…
ESS
SO and the HE
- Security architecture and engineering;
- Structural security measures;
- C, P, T, E, D
- Electronic Security Systems;
- Security officers and the
Human element
Typical areas assessed in a physical security assessment include:
B, D, W, O
L, S and C
S, L, A and E systems
VT and PC
Barriers, doors, windows, openings;
-locks, safes and containers;
-signage; lighting; alarm and electronic systems;
-vehicle traffic and parking controls;
-visitor management;
-package handling
Automated assessment tools should only assist in completing surveys because they…..
- may give a false sense of knowledge;
-may have a high cost;
-may have complex software; and - they can’t capture unquantifiable characteristics.
Defense in depth?
An adversary must overcome a number of protective features in Sequence
Why does each layer of security require a separate act by the adversary?
-causes Uncertainty in the perp’s mind;
-increases attack preparation time;
- adds steps to the intrusion and
-allows for more police or guard force response time.
Layered security should have i______ at each of the layers?
Interdependencies
Purposely left blank
Purposely left blank
What is the principle of balanced protection?
-the protection system’s individual applications and components will be integrated and converged so that they provide an equal level of protection.
The appraisal component of the security survey involves…?
D_____ and c______ recommendations for e_______
Developing and communicating recommendations for enhancements.
What is the focus of a physical security assessment?
The _______to the physical ______and _____of an organization and the _____ ______ (against any risk) that constitute the realm of physical security.
Risks
Assets
Property
Protection
Measures
The physical security assessment could provide the basis for …what?
A C & IS analysis and RA
ID SG
ID a range of S and P&C and
Ass in the D of the O’s SRM C, R and RP
A comprehensive & integrated security analysis and risk assessment;
-identifying security gaps;
-identifying a range of Solutions and their pros and cons; and
-assisting in the development of the org’s security risk management
continuity, response and recovery programs.
What costs are considered in a cost-benefit analysis?
T and T
P and P
O and O C C
- Technology and time;
- Process and personnel; and
- Opportunity and Overall capability costs
The 3 most common approaches to a physical security assessment?
Outside-inward approach;
Inside-Outward approach; and
Functional approach
What is it called when the assessment team acts as the aggressor and moves from outside the facility through successive layers of security toward the asset?
Outside-inward physical security assessment approach
When the assessment team acts as the defender and works from the asset out towards the outer perimeter it’s called….?
The inside-outward physical security assessment approach
When the security assessment team evaluates security functions/disciplines and collates the findings from the assessment component it’s called?
The functional (security discipline) physical security assessment approach
