Chapter 1: Domain One: Security Fundamentals Flashcards
Access Control
The control of persons, vehicles and materials through the implenmentation of security measures for a protected area.
Alarm System
Combination of sensors, controls, and annunciators (devices that announce an alarm via sound, light, or other means) arranded to detect and report an intrustion or other emergency.
Asset
Anything that has tangible or intangible value to the organziation.
Auditor
Person with competence to conduct an audit. (ISO 9001:2011)
Closed-Circuit Television
(CCTV) See Video Surveillance.
Color Rendition Index
(CRI) A quantitative measure of 0 to 100 that indicates a light’s ablity to show a true color when compared to a reference source. A higher CRI number indicates a light’s ability to render a truer rendition of the color.
Conformity
Fulfillment of a requirement.
Consequence
Outcome of an event affecting objectives. (ISO Guide 73:2009)
NOTE 1: An event can lead to a range of consequences.
NOTE 2: A consequence an be certain or uncertain and can have postive or negative effects on objectives.
NOTE 3: Consequences can be expressed qualitatively or quantitatively.
NOTE 4: Initial consequences can escalate through knock-on effects.
Continual Improvement
Recurring process of enchancing the physical assest protection management system (PAPMS) to achieve improvements in overall physical access protection (PAP) management performance consistent with the organizations’s PAP management policy.
NOTE: The process need not take place in all areas of activity simultaneously.
Continuity
Strategic and tactical capability, pre approved by management, of an organziation to plan for and respond to conditions, situations, and events to continue operations at an acceptable predefined level.
Corrective Action
Action to eliminate the cause of a detected nonconformity (ISO 14001:2004)
Crime
An act or omission that isin violation of a law forbidding or commanding it for which the possible penalties for an adult upon conviction include incarceration; for which a corporation can be penalized by a fine or forfeit; or for which a juvenile can be adjudged delinquient or transferred to criminal court for prosecution. The basic legal definition of cime is all punishable acts whatever the nature of the penalty.
Crime Prevention Through Enviromental Design
(CPTED) An approach to reducing Crime or Security incidents through the strategic design of the built enviroment typically employing organizational, mechanical, and natural methods to control access, enhance natural surveillance and territoriality, and support legitmate activity.
Crisis
An unstable condition involving an impending aburpt or significant change that requires urgent attention and action to proect life, assets, property or the enviroment.
Critical Activity
Any function or process that is essential for the organization to deliver its products and/or services. (ISO/PAS 22399:2007)
Criticality Analysis
A process designed to systematically identify and evaluate an organizations’s assets based on the importance of its mission or function, the group of people at risk, or the significance of a disruption on the continuity of the organization.
Denial
Frustration of an adversary’s attempt to engage in behavior that would constitute an incident.
Detection
The act of discovering an attempt (successful or unsuccessful) to breach a secured perimeter (such as scaling a fence, opening a locked window, or entering an area without authorization).
Disruption
An intentional, unintentional, natural event that interrupts normal business functions, operations, or processes, whether anticipated or unanticipated.
NOTE: A disruption can be caused by either positive or negative factors that will disrupt normal functions, operations, or processes.
Document
Information and supporting medium. (ISO 9000:2000)
NOTE: The medium can be paper, magnetic, electronic, or optical computer disc; phtography or master sample; or a combination thereof.
Due Diligence
The care that a prudent person might be expected to exercise in the exmination and evaluation of risks.
Evacuation
Organized, phased, and supervised dispersal of people from dangerous or potentially dangerous areas. (ASIS International Business Continuity Guideline: 2005)
Event
Occurrence or change in a particular set of circumstances. (ISO Guide 73:2009)
NOTE 1: Nature, likelihood, and consequence of an event cannot be fully knowable.
NOTE 2: An even can be one or more occurrences and can have several causes.
NOTE 3: Likehood associated with the event can be determined.
NOTE 4: An event can consist of a non-concurrence of one or more circumstances.
NOTE 5: An event with a consequence is sometimes referred to as an “incident.”
Executive Protection
Executive, or Personnel, Prorection (EP) is the process of safeguarding key people from harm.
Exercises
Evauluating physical asset protection (PAP) management programs, rehearsing the roles of team members and staff, and testing the recovery or continuity of an organization’s systems (such as technology, telephony, administration) to demonstrate PAP management competence and capablity.
NOTE 1: Exercises include activities performed for the purprose of training and conditioning team members and personnel in appropriate responses with the goal of achieving maximum performance.
NOTE 2: An exercise can involve invoking response and operational continuity procedures but is more likely to invovle the simulation of a response and/or operational continuity incident, announced or unannounced, in which participants role-play to assess what issues might arise prior to a real invocation.
External Context
External enviroment in which the organization seeks to achieve its objectives. (ISO Guide 73:2009)
NOTE: External context can include:
The cultural, social, political, legal, regulatory, financial, technological, economic, natural, and competitive enviroment whether international, national, regional, or local;
Key driver and trends having impact on the objectives of the organization; and
Relationships with, and perceptions and values of, external stakeholders.
Facility Infrastructure
Plant, machinery, equipment, property, buildings, vehicles, information systems, transportation facilities, and other items of infrastructure or plant and related systems that have a distinct and quantifiable function or service.
Hazard
Possible source of danager or conditions (physical or operational) that have a capacity to produce a particular type of adverse effect.
Impact
Evaluated consequence of a particular outcome.
Incident
Event that has the capacity to lead to human, intangible, or physical loss or a disruption of an organization’s operations, services, or functions. If not managed, an incident can escalate into an emergency, crisis, or disaster.
Intangible Asset
Assets that do have a physical from to protect (such as reputation, relationships, creditworthiness).
Intergrity
The property of safeguarding the accuracy and completeness of assets. (ISO/IEC 13335-1:2004)
Interested Party
Person or group having an interest in the performance or success of an organization. (ISO/PAS 22399:2007)
NOTE: The term includes people and groups with an interest in an organizatio, its activities, and its achievements, such as customers, clients, partners, employees, shareholders, owners, vendors, the local community, first responders, government agencies, and regulators.
Internal Audit
Systematic, independent, and documented process for obtaining audit evidence and evauluating it objectively to determine the extent to which the management system audit crieria set by the organization are fulfilled.
NOTE: In many cases, particulary in smaller organizations, independence can be demonstrated by the freedom from responsiblitity for the activity being audited.
Internal Context
Internal environment in which the organization seeks to achieve its objectives (ISO Guide 73:2009)
NOTE: Internal context can include:
Governance, organizational structure, roles, and accountabilities;
Policies, objectives, and the strategies that are in place to achieve them;
The capablities understood in terms of resources and knowledge (such as capital, time, people, processes, systems, and technologies);
Perceptions and values of internal stakesholders;
Information systems, informatoin flows and decision-making processes (both forma and informal);
Relationships with, and perceptions and values of, internal stakeholders;
The organizations’s culture;
Standards, guidelines, and models adopted by the organization; and
Form and extent of contractual relationships.
Intrusion Detection System
(IDS) A system that uses sensors to detect an impending or actual security breach and to initiate an alarm or notification of the event.
Investigation
A systematic and thorough examination or inquriy into something or someone and the recording of that examination in a report.
Investigation Team Lead
(ITL) The person directly responsible for the team of personnel assigned to investigate an incident and has overall responsiblity for ensureing that an investigation is thorough, complete, and well documented in teh final report.
Investigation Unit Manager
The person directly respobible for the investigative function in an organization, sometimes referred to as the project manager or case manager, who may hold the title of chief security officer, security director, director of investigations, director of human resources, or something similar.
Lighting
Degree of illumination; also, the equipment, used indoors and outdoors, for increasing illumination - usually measued in lumens, lux, or foot-candle units.
Likelihood
Chance of something happening. (ISO GUide 73:2009)
NOTE 1: In risk mamagement terminology, the word “likelihood” is suded to refer to the chance of something happening, whether defined, measured, or determined objectively or subjectiviely, qualitatively, or quantitatively, and described using general terms or mathematically (such as a probability or a frequency over a given time period).
NOTE 2: The English term “likelihood” does not have a direct equivalent in some languages: instead, the equivalent of the term “probability” is often used. HOwever, in English, “probability” is often narrowly interpreted as a mathematical term. THerefor, in risk management terminology, “likelihood” is used with the intent that is should have the same broad interpretation as the term “probability” has in many languages other than English.
