Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

PSPbyMJB > Chapter 2 > Flashcards

Chapter 2 Flashcards

1
Q

What are the three approaches to performing a security survey?

A

Outside-In Approach, Inside-Out Approach, Functional (Security Discipline) Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a SWOT Analysis used for in the security survey process?

A

To focus on Strengths, Weaknesses, Opportunities, and Threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How can outside support like consultants benefit the risk assessment process?

A

By providing a fresh perspective, collective knowledge, and regulatory compliance assistance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What tests should be considered during the security survey process?

A

Shipping and receiving controls, intrusion detection alarms, computer lab security, access controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What criteria should the security survey report adhere to?

A

Accurate, clear, concise, timely, considerate of slant or pitch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the goal of a security survey in relation to leadership?

A

To provide actionable intelligence for informed decision-making regarding risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can automated assessment tools assist in security surveys?

A

By processing, analyzing, comparing, and storing large amounts of data efficiently.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define risk management.

A

Risk management is the systematic approach of identifying, calculating, and minimizing risks to an acceptable level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the main objective of security?

A

The main objective of security is to manage risks by balancing protection measure costs with benefits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the three categories in which assets can be divided?

A

Tangible assets, intangible assets, and mixed assets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How can assets be valued?

A

Assets can be valued using relative value based on priority or the Cost-of-Loss Formula.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What does the basic Cost-of-Loss Formula consist of?

A

The Cost-of-Loss Formula consists of Cp, Ct, Cr, Ci, and I, yielding the total cost of loss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is one method to prioritize assets based on security risk?

A

Security risk can be calculated and used to rank or prioritize each asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How many steps are involved in the risk assessment process?

A

The risk assessment process involves six basic steps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the initial steps in the risk assessment process?

A

The initial steps include identifying and valuing assets, identifying threats, and determining vulnerabilities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the goal of risk management programs in organizations?

A

The goal is to develop a comprehensive protection strategy based on sound practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What formula is used to determine risk results?

A

Threat x Vulnerability x Impact /3 = Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Why is multiplication used instead of addition in the Risk Formula?

A

To determine the value; each element is scaled from 0-100.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How is overall risk placed back on a 0 to 100 scale?

A

By using the cubed root in the risk formula.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the goal of risk analysis?

A

To provide management with decision-making information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why is it important to prioritize risk based on criticality?

A

Because it is not practical to eliminate all risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What should be considered when determining protective measures?

A

Budgetary constraints, available resources, and adverse effects.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What must a physical security professional consider when selecting protective measures?

A

Adversary’s sophistication, capabilities, and types of threats.

24
Q

Why should physical security measures be scalable and agile?

A

To constantly evolve and improve in a changing environment.

25
Q

What are the two main types of risk assessments mentioned?

A

Qualitative and Quantitative assessments.

26
Q

When should Qualitative assessments be used?

A

For low-value assets or basic security applications.

27
Q

When should Quantitative assessments be used?

A

For high-value assets or to describe specific values.

28
Q

How many methods are there to address identified risks within an organization?

A

There are five methods mentioned.

29
Q

Why must residual risks be analyzed within an organization’s risk management program?

A

Despite best efforts, some risks always remain.

30
Q

What approach do some professionals prefer when conducting risk assessments?

A

A blended approach using both qualitative and quantitative methods.

31
Q

Why should automated tools not be solely relied upon in conducting a physical security assessment?

A

Automated tools are not good at assessing intangible factors and are only as good as the program inputs.

32
Q

Explain the significance of the saying ‘garbage in, garbage out’ in the context of automation of results.

A

It highlights that the quality of automated results is only as good as the input data.

33
Q

What are some considerations that may affect the effectiveness of automated assessment tools?

A

1) Qualification of the assessor, 2) Cost of commercial tools, 3) Complexity of software, 4) Poor assessment of intangible factors.

34
Q

Define All-Hazards approach in physical security.

A

A holistic, full-scope, and balanced approach to understanding prevalent threats.

35
Q

Explain the difference between a hazard and a peril with an example.

A

A hazard contributes to a peril; e.g., stress (hazard) leading to an active shooter incident (peril).

36
Q

List the three characterizations of threats.

A

Natural, Intentional (man-made), Inadvertent (accidents, errors, and omissions).

37
Q

What is a vulnerability in the context of security?

A

A gap or weakness that allows a threat to compromise an asset or function.

38
Q

Explain the difference between vulnerability and threat.

A

Vulnerability is controllable by the organization; threat is typically outside the organization’s control.

39
Q

How can vulnerabilities be calculated?

A

By measuring them in terms of observability and exploitability.

40
Q

What does ‘impact’ refer to in risk management?

A

It refers to the severity of the situation when an incident occurs.

41
Q

What factors can affect likelihood of occurrence and risk exposure?

A

Historical events, physical environment, political environment, social environment, procedures, and processes.

42
Q

What is risk analysis in the context of security?

A

The process of identifying potential areas of loss and implementing countermeasures.

43
Q

How can risk analysis be achieved?

A

By calculating impact and prioritizing identified risks.

44
Q

Why is it important to analyze high consequence loss events?

A

Even if low likelihood, they can have significant impacts on security.

45
Q

What are the five methods of addressing risk?

A

Risk Avoidance, Risk Assumption, Risk Transfer, Risk Reduction, Risk Spreading.

46
Q

Which method of addressing risk involves the elimination of the risk source?

A

Risk Avoidance.

47
Q

What is the most direct way to remove risk?

A

Risk Avoidance.

48
Q

What is the aim of risk reduction?

A

To reduce vulnerability of assets.

49
Q

How is risk reduction achieved?

A

Through site-hardening and reducing vulnerability of assets.

50
Q

What is a security survey also known as?

A

A physical security assessment.

51
Q

What does a security survey focus on?

A

Vulnerability aspects.

52
Q

What is the purpose of a security survey?

A

To assess current security level and identify vulnerabilities.

53
Q

What does a security survey examination entail?

A

An on-site examination to assess security level and vulnerabilities.

54
Q

What may be appropriate to conduct alongside a security survey?

A

Cost-benefit analysis.

55
Q

What components are typically included in a cost-benefit analysis?

A

Cost, Reliability, Delay.

56
Q

Why may a checklist be helpful during a security survey?

A

To ensure no important elements are missed and maintain a sequential process.

PSPbyMJB (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions