Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

PSP > Physical Security Assessment > Flashcards

Physical Security Assessment Flashcards

(118 cards)

Start Studying
1
Q

How is risk measured?

A

The value of the asset in relation to the threats and vulnerabilities associated with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How is a security risk rating calculated?

A

Asset value rating
X
Threat likelihood rating
X
Severity of incident rating
X
Vulnerability rating
=
Security risk rating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Conditions that tend to increase assets’ exposure to the risk of loss can be divided into which categories?

A

Physical – Includes factors such as the organization’s types and location of facilities, the operational technology or industrial control systems, and the criticality of on-site processes and assets.

Nonphysical – Includes factors such as geo-political landscape, culture, speed of decision-making, and intensity of competition.

Logical – Includes information and digital assets and the network or digital space that connects them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How often should the risk assessment process be revisited?

A

It should be a cyclical and continuous effort since the elements are constantly subject to change over time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the purpose of a security survey?

A

Determine and document the current security posture,

Identify deficiencies and excesses in existing security measures,

Compare the current posture with a determination of the appropriate level of security of protection needed,

Recommend improvements in the overall situation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What factors should be addressed with considering vulnerabilities?

A

Lack of redundancy or backups for critical functions,
Single points of failures,
Collocation of critical systems, organizations, or components,
Inadequate response capability to recover from an attack,
Ease of aggressor access to a facility,
Inadequate security measures in place,
Presence of hazardous materials,
Potential for collateral damage from other companies in the area.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the difference between a physical security assessment and a security survey?

A

A security survey focuses more on vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is a cost-benefit analysis used in a physical security assessment or in a risk assessment?

A

A cost-benefit analysis should be used in both.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the functions included in a functional approach to a physical security assessment?

A

Security architecture and engineering,
Structural security measures,
CPTED,
Electronic security systems,
Security officers and the human element.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are typical areas to assess in a physical security assessment?

A

Barriers, doors, windows/other openings, locks, safes and other containers, signage, lighting, alarm systems, electronic systems, security services, vehicle/traffic/parking controls, utilities protection, visitor management, and package handling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why should automated assessment tools only be used to ASSIST in completing an assessment?

A

May give a false sense of knowledge in security assessment,
High cost,
Complexity of software
Computers cannot factor in unquantifiable characteristics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is asset prioritization based on?

A

Each asset’s criticality to the organization’s mission and overall strategy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the defense-in-depth approach?

A

An adversary must avoid or defeat a number of protective devices or features in sequence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Why does each layer of security require a separate act by the adversary?

A

This causes uncertainty in the perpetrator’s mind, increases attack preparation time, adds steps to the intrusion, and allows time for a security or police response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an important thing to consider when addressing layered security?

A

Interdependencies at each layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the principle of balanced protection?

A

The protection system’s individual applications and components will be integrated and converged so that they provide an equal level of protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is involved in the appraisal component of the security survey?

A

Developing and communicating recommendations for enhancements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the focus of a physical security assessment?

A

The risks to the physical assets and property of an organization, and the protection measures (against any risk) that comprise the realm of physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

The physical security assessment could provide the basis for what?

A

A comprehensive and integrated security analysis and risk assessment across the organization,
Identifying security gaps,
Identifying the range of potential solutions and its advantages/disadvantages,
Assisting in the development of organization security risk management, continuity, response, and recovery programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What costs should be considered in a cost-benefit analysis?

A

Technology costs,
Opportunity costs,
Process impact costs,
Time costs
Personnel costs
Overall capability costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are three common approaches to a physical security assessment?

A

Outside-Inward approach,
Inside-Outward approach,
Functional approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

This physical security assessment approach occurs when an assessment team takes the role of perpetrator and begins outside the facility focusing on the successive layers of Security.

A

Outside-Inward approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

This physical assessment approach occurs when an assessment team takes the role of defender and works their way from the asset out toward the outer perimeter.

A

Inside-Outward approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This physical security assessment approach occurs when an assessment team evaluates security functions/disciplines and correlates the findings from the assessment component.

A

Functional (security discipline) approach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are five criteria of a good security survey report?
Accuracy, Clarity, Conciseness, Timeliness, Slant or pitch
26
What are the objectives of physical access control?
Deter potential intruders, Distinguish authorized from unauthorized people, Delay and prevent intrusion attempts, Detect intrusions and monitor intruders, Trigger appropriate incident response by communicating to security officers and police, Deny by opposing or negating the effects of an overt or covert action.
27
What is an asset?
Anything that has tangible or intangible value to an enterprise.
28
What is risk analysis?
A process for identifying asset values, threats, and vulnerabilities to ascertain risks.
29
How is an asset’s criticality determined?
Based on the mission/goals of the organization and how the company would recover in the event that the asset was no longer available.
30
What are the three steps to identifying a company’s assets?
Define company’s primary business functions, Identify site/building infrastructure and systems, Identify company’s tangible, and intangible assets .
31
What two types of cost should be considered when valuing an asset?
Direct costs and indirect costs.
32
What are some factors to consider in valuing assets?
Injuries or deaths related to facility damage, Asset replacement costs, Revenue loss due to lost functions, Backup/system redundancy existence, Availability of replacements, Critical/Sensitive information value, Impact on revenue and reputation.
33
When determining asset values, what are some direct costs?
Financial losses (value of goods), Increased insurance premiums Insurance, deductibles, Lost business, Labor expenses incurred as a result of the event, Management time dealing with the event, Punitive damage awards not covered by insurance.
34
When determining an asset values, what are some indirect costs?
Negative media coverage, Long-term negative consumer perception, Public relations cost to overcome image, problems, Lack of insurance coverage due to higher risk category, Higher wages needed to attract future employees, Shareholder suits for mismanagement, Poor employee morale leading to work stoppages and higher turnover.
35
What legal and regulatory requirement procedures should be established as part of a physical asset protection program?
Identify the legal, regulatory, and other requirements, to which the organization subscribes related to the risks to its assets, activities, functions, products, services, stakeholders, environment, and supply chain; Determine how these requirements applied to its risks; Ensure that these requirements are taken into account in establishing, implementing, and maintaining its physical asset protection program.
36
What are two types of assets?
Tangible and intangible.
37
What are two ways assets can be valued?
They can be assigned a relative value, such as a number from 1 (low) to 5 (high), based on priority. Apply a cost-of-loss formula.
38
What is the cost-of-loss formula to calculate an asset value?
K = Cp + Ct + Cr + Ci - I K = total cost of loss Cp = cost of permanent replacement Ct = cost of temporary substitute Cr = total related costs (remove old asset, install new, etc.) Ci = lost income cost I = available insurance or indemnity
39
What are the two types of adversaries?
Adversary who uses intrusion to gain access to the target asset, and an adversary who plans to attack the site from outside.
40
What are two common physical security compliance metrics in the public sector?
Compliance of facilities and compliance of systems.
41
What are two objectives of collecting physical security program metrics?
To provide insurance to the organization on the effectiveness of the program and to facilitate improvement.
42
This is commonly used to provide management with a snapshot of the effectiveness and efficiency of a physical security program.
Metrics summary chart.
43
What is the purpose of a Business Impact Analysis?
To assess and prioritize, organizational activities, and resources required to deliver its products and services.
44
What is the purpose of a business continuity management system (BCMS)?
To enable an organization to identify, develop, and implement policies, objectives, capabilities, processes, and programs – taking into account legal and other requirements – to address disruptive events that might impact the organization and its stakeholders.
45
What is considered the foundation for establishing the business continuity objectives, targets, programs, and plans?
The Business Impact Analysis (BIA) and Risk Assessment.
46
What are the 4 phases of business continuity?
Readiness, Prevention, Response, Recovery/Resumption.
47
A group of individuals responsible for developing and implementing a comprehensive plan for responding to a disruptive incident, consisting of a core group of decision-makers trained in incident management and prepared to respond to an event is known as…
…the Crisis Management Team.
48
Activities, programs, and systems developed and implemented prior to an incident that may be used to support and enhance mitigation of, response to, and recovery from disruptions is known as what?
Preparedness (readiness).
49
What is a threat?
Potential cause of an unwanted incident which may result in harm to individuals, assets, a system or organization, the environment, or the community.
50
What is a lost event profile?
A list of the kind of threats affecting the assets to be safeguarded.
51
What is a hazard?
A source of potential danger or adverse condition. Hazards are generally associated with nature.
52
Threats or loss risk events can fall into which three distinct categories?
Crimes Noncriminal events such as man-made incidents or natural disasters, Consequential events caused by an enterprise’s relationship with another organization.
53
What are some examples of non-criminal threats?
Natural threats/disasters: hurricanes, tornadoes, major storms, etc. Man-made threats or disasters: labor strikes, airplane crashes, electrical power failures.
54
What are examples of peripheral system and interfaces?
Life safety systems, building controls, IT infrastructure, liaison relationships, outsourced services, and policies and procedures.
55
What is a consequential event?
An event that occurs because of a relationship between events or between two different organizations – the company suffers a loss as a consequence of that event or affiliation.
56
How is the probability of a threat occurring decided?
By considering the likelihood that a loss risk event may occur in the future.
57
What factors are used in determining the probability of a threat?
Historical data at the site, The history of like events at similar companies, The make up of the neighborhood and immediate vicinity, Overall geographical location, Political and social conditions, Changes in the economy, And other factors.
58
What is vulnerability?
Any weakness that can be exploited by an aggressor (terrorist or criminal) or that makes an asset susceptible to damage from natural hazards or consequential events.
59
What are some factors to consider in assessing asset vulnerability?
Lack of redundancy or backups for critical systems, Single points of failure, Collocation of critical systems/organizations, Inadequate response capability to recover from attack, Ease of aggressor access to a facility, Inadequate security measures in place, Presence of hazardous materials, Potential for collateral damage from other companies in the area.
60
What are examples of four levels of risk?
Catastrophic, High, Moderate, Low.
61
What level of risk requires treatment at any cost for activities and functions to continue?
Catastrophic.
62
What level of risk cannot be further reduced without expenditure of costs disproportionate to benefits?
High.
63
What level of risk is negligible or can be managed with routine procedures?
Moderate.
64
What is the level of risk where in organization is prepared to pursue, retain, or take based on informed decisions?
Low.
65
What should accompany the regular review of the physical security assessment report?
Monitor and follow up on the assessment findings, observations, and recommendations.
66
What are two categories of threats?
Man-made threats, Natural threats.
67
This metric measures time responsiveness of external dependencies in meeting a security department request.
External dependency responsiveness.
68
What are some physical security design attributes?
Type of adversary, Amount of time the adversary requires getting to the assets inside, Number and type of detectors inside and out of the site, Delays that slow down the attack, Size, strength, and equipage of the response force.
69
The process of identifying threats and vulnerabilities, identifying the likelihood of an event arising from such threats or vulnerabilities, defining critical functions for operations, defining controls to reduce exposure, and evaluating cost of controls is called what?
Risk assessment.
70
What is the goal of a cost-benefit analysis?
To identify the optimal level of risk reduction at the best value available.
71
Which analysis method does not use number, but instead uses comparative terms?
Qualitative analysis.
72
Which analysis method utilizes numeric measures to describe value of assets or the level of threats, vulnerabilities, impact, or loss events?
Quantitative analysis.
73
When is it most suitable to use qualitative analysis?
When evaluating basic security applications.
74
What is a SWOT analysis?
A situational business analysis that involves strategic evaluation of key internal and external factors.
75
What does SWOT stand for?
Strengths, Weaknesses, Opportunities, Threats.
76
In a swot analysis, what are the external factors?
Opportunities and threats.
77
In a swot analysis, what are the internal factors?
Strengths and weaknesses.
78
What is the annual loss expectancy
The product of the cost of incident impact and the frequency of occurrence.
79
What are some state and local requirements that should be considered for projects?
Code regulations, Trade or industry guidelines, or best practices, Standards, Permitting requirements, Contractual requirements.
80
What conditions affect the likelihood of occurrence?
Physical environment, Social environment, Political environment, Historical experience, Procedures and processes, Criminal capabilities.
81
What data may be included in an incident management system?
Loss event history, Threat frequency analysis, Single and annual loss expectancy, Impact assessment.
82
What tests should be considered as part of a security survey?
Shipping and receiving, Alarms, Computer/server room, security, General access controls.
83
With whom should you be coordinating when performing security system and procedure tests during a security survey?
The building owner or manager, and, if applicable, any outside agencies, that may be involved.
84
What is checked during a security survey test on shipping and receiving?
Controls are checked by physical observation of selected shipments (incoming and outgoing) against bills of lading of inventory records.
85
What is evaluated during a security survey test on alarms?
The response as well as the reaction of facility occupants and security officers.
86
What is tested during a security survey test on a computer room or server room?
The security and access controls of computer/data processing areas during both working and nonworking hours.
87
How are general access controls tested during a security survey?
Attempt to gain access to the facility and selected internal areas during working and non-working hours. Determine whether access is possible and, if so, whether employees challenge, the “intruders” after the fact.
88
How should areas, items and issues be a valuated during a security survey?
In terms of appropriateness for the situation, age, operability, maintenance, interoperability, aesthetics, and consistency with the current use of the space.
89
What should be reviewed when assessing key/card security during a security survey?
Accountability and policy, Recordkeeping and inventory, Recovery procedures (for keys), Changed when appropriate (turnover of key personnel, after a theft/burglary, etc.).
90
What are some examples of other (not windows and doors) openings that should be assessed during a security survey?
Manholes, Skylights, Roof hatches, Ventilator/air conditioning, vents, shafts, Penthouses and penthouse/roof/veranda access, Sidewalk grates.
91
What should be examined when assessing the protection of utilities during a security survey?
Location and physical protection, Access control, Back up/emergency sources, Protection of telecommunications and data lines.
92
What is the first step in a risk assessment?
Identification and valuation of assets.
93
What are the four Ds?
Deter, Detect, Delay, Deny.
94
What are the five risk treatments?
Accepting the risk, Transferring the risk, Spreading the risk Avoiding the risk, Mitigating the risk.
95
What are the seven functions of physical security?
Access control, Deterrence, Detection, Assessment, Delay, Response, Evidence gathering.
96
What factors should be considered when selecting a risk mitigation strategy?
Availability, Affordability, Feasibility.
97
The effectiveness of individual countermeasures and the security system depends on what?
The adversary and the threat.
98
What must happen as a threat increases in sophistication?
The effectiveness of the countermeasures must also increase, or the additional risk must be managed by some other means.
99
What four criteria can be used to rank assets based on criticality?
Workforce, Service delivery, Dependencies, Mission/objectives.
100
Which risks should be prioritized?
Those risks that have the potential to cause significant mission impact or harm.
101
What conditions tend to increase an asset’s exposure to the risk of loss?
Physical environment – includes factors such as types and locations of facilities, operational technology, and criticality of on-site assets. Non-physical environment – includes factors, such as Geo-political landscape, culture, speed of decision making and compliance requirements. Logical environment – includes information and digital assets and the network or digital space that connects them.
102
What are two common approaches to measure vulnerability?
Observability and exploitability.
103
The ability of an adversary to see and identify a vulnerability is known as what?
Observability.
104
The ability of an adversary to take advantage of the vulnerability is known as what?
Exploitability.
105
When is observability reversed?
In assessing natural threats.
106
How is risk calculated?
Risk = (Theat X Vulnerability X Impact) / 3
107
The determination of the actual cost of a security program against the impact in terms of loss reduction, financial savings, acquisition, lifecycle, replacement, or other measures is known as what?
Cost-benefit analysis.
108
A measure based on a reference that involves at least two points is known as what?
Metrics.
109
What are the technical criteria of a Security Metrics Evaluation Tool (MET)?
Reliability, Validity, Generalizability.
110
What are the operational criteria of a Security Metrics Evaluation Tool (capital MET)?
Cost, Timeliness, Manipulation.
111
What are the strategic criteria of a Security Metrics Evaluation Tool (MET)?
ROI, Organizational relevance, Communications.
112
What are the high-level evaluation criteria for a Security Metrics Evaluation Tool (MET)?
Technical criteria, Operational criteria, Strategic criteria.
113
What are the three major physical security metrics?
Systems, Personnel, Compliance.
114
What are some common physical security systems metrics?
Forced door, Door held open, Unauthorized access attempts, User-defined actions/alarms, Communications failure.
115
What are two measurable physical security personnel metrics?
Response and training.
116
What is the first step in asset protection?
Perform a threat and vulnerability analysis.
117
What is one potential pitfall in choosing security technology?
In ability to thoroughly evaluate product claims prior to installation.
118
What is the primary challenge for security system designers?
Balance the need for public access against ensuring public safety.

PSP (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions