Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPP by Matty > Security Principles & Practices > Flashcards

Security Principles & Practices Flashcards

1
Q

Managers’ technicals skills are better the closer they are to the actual work, true or false?

A

True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Higher level managers have greater ____ and ______ skills than lower level managers?

A

interpersonal and conceptual.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Conceptual skills are?

A

The ability to manage more people in more functions toward desired outcomes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Interpersonal skills can be described as?

A

The ability to communicate effectively, to inspire trust and motivate others. Relationship building.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are policies?

A

Established rules that define behavior and actions within an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are procedures?

A

Instructions on how to follow policies and rules within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Strategic Management Process

A

A linear process that involves establishing a vision, objectives, strategy, execution and monitoring to guide the management of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Strategic Vision

A

The aspirations of management for the future of the company and the course of action to achieve those aspirations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Mission Statement

A

A statement that defines the long-term purpose and reason for the existence of a company.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Core Values

A

The beliefs, traits, and norms that are expected from personnel in conducting business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Organizational Culture

A

The expectations, experiences, and values that guide the behavior of members within an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Enterprise Assets

A

Traditionally protected assets such as people, property, and information, as well as reputation, relationships, and creditworthiness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Standards

A

Criteria, guidelines, and best practices that are used to enhance quality and reliability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Management System Standards

A

Standards such as ISO 9001 for quality management, ISO 14001 for environmental management, and ISO 31000 for risk management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Plan Do Check Act Cycle

A

An operating principle of management systems standards that involves planning, implementing, checking, and taking corrective actions to improve performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Enterprise Security Risk Management (ESRM).

A

A strategic approach that connects security practices to the overall strategy of an organization using globally accepted and established risk management principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ESRM Cycle

A

A process of security risk management that emphasizes understanding and managing the assets of an organization. It describes how security risks are to be mitigated.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Asset Prioritization

A

The ranking of assets based on their criticality to the mission and strategy of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Risk Prioritization

A

The ranking of risks based on their potential to undermine the mission and strategy of an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Risk mitigation

A

The process of reducing risk through the implementation of security measures, policies, and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Cost-benefit analysis

A

The evaluation and comparison of the value and cost of different risk treatment options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Risk control

A

The modification and reduction of risk through the implementation of security measures and strategies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Prevention procedures

A

Measures taken to minimize the likelihood of a disruptive event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Liaison

A

The act of leveraging resources, sharing best practices, and collaborating with others. It is one of the most significant force multipliers and is a proactive medium.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Security Awareness

A

The consciousness of a security program and its effect on reducing risks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Security Awareness Program

A

A program designed to educate employees on protecting assets and reducing losses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Security awareness levels

A

Different training levels provided to different categories of employees to enhance their security awareness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Developing a security awareness program

A

The process of tailoring a security awareness program to the specific needs of an organization and providing training to different departments and levels of employees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Security awareness techniques

A

Various methods used in a security awareness program, including written materials, audiovisuals, briefings, integration into operations, drills, and exercises.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Security awareness program evaluation

A

The measurement of the effectiveness of a security awareness program and the documentation of its value.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is an asset owner?

A

The person most directly responsible for successful operation of the asset. In ESRM, the asset owner is assigned responsibility for the risk to an asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are four ways to manage risk?

A

Reduce, accept, transfer, eliminate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the deciding factors between qualitative or quantitative approaches to a risk assessment?

A

-Reliability & Validity of data;
-The nature of the risk factors and whether they are quantifiable;
-The target audience for the outputs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is risk tolerance?

A

The amount of uncertainty an organization is prepared to accept in total or more narrowly within a certain business unit, a particular risk category, or for a specific initiative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What four steps are part of the risk assessment process?

A

1) asset identification, valuation and characterization;
2) risk identification;
3) risk analysis; and
4) risk evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is terrorism?

A

An act of violence designed to achieve a political end.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is a cost-benefit analysis?

A

A method for evaluating and comparing the value and cost of risk-treatment options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What 6 things should be considered when assessing consequences?

A
  • Costs: human, financial and image;
    Impacts: Human Rights, indirect and environmental
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are 5 benefits of liaison?

A
  • Leverage the resources of others;
    -share best practices and lessons learned;
    -collaborate on specific case or incidents;
  • more effectively address common issues;
    -share information, equipment and facilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is cost-effectiveness?

A

Producing good results for the money spent.

41
Q

What is security awareness?

A

Consciousness of an existing security program, its relevance and the effect of one’s behavior on reducing security risks.

42
Q

What is the goal of a security awareness program?

A

To promote compliance with security policies and procedures, as well as provide timely communications and training to guide individual and organizational attitudes and behaviors.

43
Q

What drives the need to use a security consultant?

A

A specific problem, need, challenge or goal.

44
Q

What is a chief security officer?

A

A senior executive level function responsible for providing comprehensive, integrated risk strategies to help protect an organization from a wide spectrum of threats.

45
Q

All organizations have three common characteristics?

A

1) Distinct purpose (expressed through a mission statement and goals);
2) People; and
3) Deliberate structure

46
Q

PODSCORB?

A

Henri Fayols management principles:
Planning, organizing, deciding, staffing,
directing, coordinating, reporting, budgeting.

47
Q

Three common leadership styles, include:?

A

1) Authoritarian;
2) Democratic;
3) Laissez Faire

47
Q

What is a firm’s vision?

A

A firm’s aspirations for the future….where we are going.

48
Q

What is a firm’s mission?

A

Describes the scope and purpose of its present business….”who we are, what we do, and why we are here.”

49
Q

What is a mission statement?

A

1) Communicates business functionality and operational methods.;
2) Specifies a businesses’ products or services, level of quality and other tangible aspects of the business and its plans.

50
Q

Insurance coverage on an asset is a form of….?

A

Risk transfer

51
Q

Copyrights do not have to be registered.

A

But it is best to do so.

52
Q

HR is the first line of defense for……?

A

To prevent losses by hiring good workers.

53
Q

Procedures can be changed.

A

Procedures can be changed to meet changing conditions and demands.

54
Q

What is annual loss expectancy?

A

ALE is a calculation that helps you to determine the expected monetary loss for an asset due to a particular risk over a single year. It can be used in a cost-benefit analysis: If a threat or risk has an ALE of $5,000, then it may not be worth spending $10,000 per year on a security measure which will eliminate it.

55
Q

Interoperability in communications?

A

The ability of emergency response agencies to talk to one another - wirelessly- via communication systems - to exchange voice and or data.

56
Q

Strategy efficiency?

A

Measured by time and costs.

57
Q

Strategy effectiveness?

A

Measured by outcomes.

58
Q

A mission statement should do what 6 things?

A
  1. Identify the firm’s products or services.;
  2. Specify the buyer needs it seeks to satisfy;
  3. ID the customer groups or markets it hopes to serve;
  4. Specify its approach to pleasing customers;
  5. Set the firm apart from its rivals; and
  6. Clarify the firm’s business intentions to its stakeholders.
59
Q

Explain the “do” part of the plan-do-check-act cycle?

A

Under “do,” the security manager looks at the planning analysis, then devises a solution, prioritizes the next steps, and develops a detailed action plan.

60
Q

ESRM has three primary components?

A
  1. the context of ESRM - organizational aspects the security manager must understand to adopt ESRM successfully;
  2. the ESRM cycle - the actual process of security risk mngment;
  3. the foundation of ESRM - including organizational concepts that support the ESRM approach and maximizes its impact.
61
Q

What is the initial ESRM step?

A

Understanding the organization; this is at least as important as understanding the threats the organization faces.

62
Q

What is the first process in the ESRM cycle?

A

Identify and prioritize assets. The prioritized list of assets is the basis for the remainder of the ESRM cycle.

63
Q

What are the two types of governance that are relevant from the perspective of ESRM?

A

Organizational governance

and

ESRM governance

64
Q

Vulnerabilities can be measured in two ways?

A

Observability and exploitability.

65
Q

The risk that remains after target hardening, security controls, countermeasures and threats have been addressed?

A

Residual risk

66
Q

Private and personal information pertaining to an organization’s employees, management, business, relationships and customers is often referred to as…?

A

Personally identifiable information.

67
Q

Packages may be searched for contraband manually or by active interrogation using x-ray. Is that safe for employees?

A

Advanced backscatter x-ray technology exposure is safe for screening personnel.

68
Q

An organizational strategy is also called?

A

A strategic plan

69
Q

An organizational strategy defines and supports?

A

Long-term goals.

70
Q

An organization’s vision can best be described as?

A

Where the business will be in the long term.

71
Q

ESRM includes?

A

physical security, brand protection and travel risk

72
Q

In assets protection, convergence generally means?

A

Integration of traditional physical and IT security

73
Q

The process of assessing security-related risks from internal and external threats to an entity, its assets and personnel is best described as?

A

Risk assessment

74
Q

What does the K stand for in the cost of loss formula

A

Criticality, total cost of loss

75
Q

A security weakness or practice that may facilitate or allow a threat to occur is?

A

A vulnerability

76
Q

In this step, the assessor combines all the information on assets, threats and vulnerabilities and then considers the potential impact?

A

Risk analysis

77
Q

What are key components of organizational resilience standards?

A

Risk assessment and management (pg 20)

78
Q

What best describes an organizational resilience management system?

A

A framework for managing and mitigating risks to ensure business continuity.

79
Q

What is an example of a physical security measure?

A

Implementing access control systems at entry points (pg 22)

80
Q

What is one of the key principles of Crime Prevention Through Environmental Design?

A

Enhancing natural surveillance through proper lighting & visibility (pg 23)

81
Q

What is an example of a physical barrier used for site hardening and security?

A

Erecting a fence or wall around a perimeter (pg 23)

82
Q

What is not an option for the security manager to consider when selecting an intrusion detection system?

A

Solution reduces liability on the part of the organization (pg 25)

83
Q

What exemplifies the concept of cost benefit analysis in security measures?

A

Implementing a cost-effective access control system with limited features.

84
Q

What is a consulting hourly fee schedule?

A

The assignment is expected to last less than a day but the exact amount of time may be unclear.

85
Q

What are the seven key skills of a CSO?

A

relationship leader
executive leader
subject matter expert
governance team leader
risk executive
strategist
creative problem solver

86
Q

What are indirect costs of security?

A

Harm to reputation and employee morale
Loss of goodwill and employees

87
Q

What members should comprise a vulnerability assessment team?

A 
Security specialist (leader), 
Security systems engineer, 
Response expert,
Data analyst,
Operations representatives,
Subject matter experts (E.g. locksmiths, technical writers, legal experts).
88
Q

What is the formula for residual risk?

A

R = T x A x V

where

R = residual risk
T = threat
A = asset to be protected
V = vulnerability.
89
Q

What is the formula for lost income cost?

A

I = i/365 x P x T

where

I = income earned,
i = annual percent rate of return,
P = principal amount (in dollars) available for investment,
t = time (in days) during which P is available for investment.
90
Q

What is the cost of loss formula?

A

K = (Cp + Ct + Cr + Ci) - (I-a),

where

K = criticality, total cost of loss,
Cp = cost of permanent replacement,
Ct = cost of temporary substitute,
Cr = total related costs,
Ci = lost income cost,
I = available insurance or indemnity,
a = allocable insurance premium amount.
91
Q

What are the five avenues of addressing risk?

A 
Avoidance,
Transfer,
Spreading,
Reduction,
Acceptance.
92
Q

What are the five D’s of security?

A 
Deter,
Deny,
Detect,
Delay,
Destroy.
93
Q

What are the five forces shaping assets protection globally?

A 
Technology and touch,
Globalization in business,
Standards and regulation,
Convergence of security solutions,
Homeland security and the international security environment.
94
Q

What is the formula for loss event probability?

A

P = f/n

Where

P = The probability that a given event will occur,
f = The number of actual occurrences of that event,
n = The total number of experiments seeking that event.
95
Q

What hypotheses did Clark and Hollinger posit to explain employee theft?

A 
External economic pressures,
Youth,
Opportunity,
Job dissatisfaction,
Social control.
96
Q

What are the six main obstacles to an effective security awareness program?

A 
Low credibility of security department,
Organizational culture,
Naïveté,
Perception of a minimal threat,
Departmental/employee indifference,
Lack of reporting capability
97
Q

Two types of transparency are particularly relevant from the perspective of ESRM, and they are?

A

Risk transparency and
Process transparency

CPP by Matty (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions