Phy Sec Flashcards
How system approach can be defined
System approach can be defined as a logical method for problem solving in which a comprehensive solution is developed in relation to a problem having several dimensions
What do you understand by Design Basis Threat
The Design Basis Threat (DBT) as the adversary against which the utility must be protected (Patterson, 2007). Determining the DBT required consideration of the threat type, tactics and mode or operations, capabilities, threat level, and likelihood of occurrence
Define risk management
Risk Management is coordinated activities to direct and control an organization with regard to risk
After the threats and assets are defined what is generally performed to establish a baseline of PPS effectiveness in meeting goals and objectives
Vulnerabilities assessment
What is vulnerability? What are the differences between vulnerability assessment and vulnerability analysis
Vulnerability assessment is the process of identifying and quantifying vulnerabilities. The term vulnerability analysis which is a method of identifying the weak points of a facility, entity, venue or person (ASIS, 2012) has also been used to describe this process. Vulnerability has been defined as intrinsic properties of something that create susceptibility to a source of risk that can lead to consequence (ISO/IEC 2009).Garcia. Vulnerability is a weakness that can be exploited by an adversary.
How residual risk is calculated
For now it is sufficient to note that risk captures the relationship among threats, asset value, and system effectiveness, and is often shown in this form, R = T x A x VT = threat, a combination of threat definition and like of attack A = assets to be protected V = vulnerability, represented by system effectiveness
What are the goals of a vulnerability assessment
The goal of VA is to identify PPS components in the functional areas of detection, delay and response and gather data to estimate their performance against particular threats
When the time for assessment is begin
Once an alarm is initiated and reported, it is time for assessment to begin
What is the principle of probability theory
It is a principle of probability theory that the larger the number of actual cases or events of the kind that includes the predicted event, the greater the agreement between the predicted pattern and the actual pattern of occurence
What are the key concepts must be understood before it is possible to design a system that meets the identified goals and objectives
These concepts are
1. System
2. Integration
3. System approach and
4. Risk Management
What is the basis of risk management
Informed decision making is the basis of risk management
As a security professional, when you say that the risk is conditional
Where there is no data to support an estimate, another approach is to assume that there will be an attack and then evaluate risk on this basis. In this case, the risk is conditional i.e the condition is that there will be an attack
While conducting vulnerability assessment what security systems engineer needs to understand
Security systems engineer needs to understand detection, delay and response technologies and security system integration
What are the key measures of effectiveness for the detection function
Key measures of effectiveness for the detection function are
- the probability of sending adversary action
- the time required for reporting and assessing the alarm
What is the primary job of a vulnerability assessment team
The VA teams primary job is to determine security system effectiveness
What is the difference between a system and integration
A system is a collection of products, process, or both, combined to provide a solution to a problem or goal. Integration is the combination of a variety of components (such as people, procedures and technology) to form a system
Write down the difference between compliance based VA and performance based VA
Compliance based approaches depend on conformance to specified policies or regulation, the metric for this analysis is the presence of the specified equipment and procedures. Performance bases approaches, on the other hand, actually evaluate how each element of the PPS operates and what it contributes to overall system effectiveness
What are the key to the vulnerability assessment
The key to the vulnerability assessment is to thoroughly evaluate the site PPS so that all paths to the assets are equally protected, and to consider what vulnerabilities exist given the defined threats, considering their motivation, tools, competence and knowledge
After the residual risk is calculated and then start the process for establishing PPS goals and objectives. The objective included what are the elements
This section described the process for establishing PPS goals and objectives. These objectives include threat definition, asset identification, and establishing acceptable risk levels to facilitate system design or before equipment is purchased.
How threat can be defined
Threat is combination of adversary capabilities, equipment, motivation or intent and likelihood of attack
What is threat spectrum
Threat spectrum is one of the methods of defining threats to a facility which uses categories or labels to describe the threat characteristics for various levels of threats
What do you mean by annualized loss expectancy
Annualized loss expectancy, is the product of the potential loss from an event and the likelihood of the event
What do you mean by risk
In general risk refers to the all the adverse outcomes that an organization wishes to avoid and is a function of the probability that such consequences will occur, the in magnitude, and their imminence
In risk assessment, that analyst attempts to answers what three questions
- What can go wrong
- What is the likelihood that it would go wrong
- What are the consequences