Phy Sec - Imp Q Flashcards
Based on what principle Asset protection increases
ESRM
What is Security’s prime objective
To manage risks by balancing the cost of protection measures with their benefit
Critical requirement for successful ESRM adoption
Alignment of security strategy with the organizations overall strategy
Who is responsible for security risk
Asset owner
Key risk for all organizations
Cyber/Information Security
ESRM Cycle
Identify and Prioritize asset
Identify and Prioritize Risks
Mitigate prioritized risks
Continuous improvement
Asset Prioritization
Asset criticality
Risk Prioritization
Risks Potential
Risks are mitigated
In order of priority
To manage risk effectively
Security professional would eliminate or reduce the total number of incidents leading to loss
A goal of risk management is to
Manage loss effectively at the least cost
Comprehensive assets protection strategy
Based on strategy risk management approach
Risk Management
It is a systematic and analytical process by which an organization identifies, reduces and controls its potential risks and losses
Considering Assets
The first step in risk assessment is identification and valuation of assets/identifying the business’s assets (Although this step is frequently overlooked)
Threats fall into three categories
Intentional
Natural and
Inadvertent
Vulnerability is viewed as
A security weakness or gaps in an asset’s protection
Definition of Vulnerability
A weakness or organizational practice that may facilitate or allow a threat to be implemented or increase the magnitude of a loss threat.
A vulnerability is a weakness or business practice that can be exploited by an adversary or that makes an asset susceptible to damage from natural and inadvertent threats
Risk analysis
Process of identifying potential areas of loss and implementing countermeasures to mitigate probability of loss
Non linear junction detector
It is portable listening device and detect bugs even when they are turned off or malfunctioning
Risk mitigation
Several concepts support risk mitigation strategies. The four Ds , the five avenues to address risk and layered security
4 Ds of physical security
Deter
Detect
Delay
Deny
Detection
It can done by using surveillance and intrusion detection systems or even a management system that is located on the outermost defensive layer to provide the earliest detection
Strategies of managing risk
Risk avoidance
Risk transfer
Risk spreading
Risk reduction
Risk acceptance
Physical Security
Risk Reduction
Risk Avoidance
It is the most direct avenue for dealing with risk
The primary way to spread risk is
To geographically distribute and organizations assets
Risk Transfer
Purchase of insurance
Purpose of physical security
To protect assets (Asset Protection)
Primary function of Physical security / Security officer
Access control
Physical security measure aims
To either prevent a direct assault on premises or reduce the potential damage
Physical security measures must be considered in the context of what
4 Ds (basis for physical security projects)
Functions of physical security
Access Control
Deterrence
Detection
Assessment
Delay
Response and
Evidence Gathering
Components of physical security
Structural measures
Electronic systems
Human element
Incident Management
It is a foundation of enterprise risk and represents a key input into any risk assessment
No security program should be implemented
Without first identifying the assets the company is trying to protect, the threats against those assets and how vulnerable the assets are to the various threats
Security surveys
Largest portion of field work used to collect data and accumulate evidence to support countermeasures
Security risk assessment models are based upon
Asset
Threat
Vulnerability
Impact
Analysis
Mitigation approach
Each components of assessment process must be evaluate either
Quantitatively
Qualitatively
Qualititative
Qualitative analysis includes any approach that does not use numbers or numeric values to describe the risk components
Quantitative
Quantitative analysis includes any approach that uses numeric measures to describe the value of assets or the level (severity or probability) of threats, vulnerabilities, impact or loss events
What is critical to an estimate of risk at site
Asset Identification
Asset
An asset may be more critical or less critical. The impact of loss as measured in currency is best described as criticality
Inadvertent threats
Perhaps the most neglected threats are inadvertent threats
Scope creep
Small documented changes that could have significant impact on the project deadline
Security Survey
A particular relevant form of risk assessment is the physical security assessment also called as Security survey
Security Survey
A thorough physical examination of a facility and its systems and procedures, conducted to assess the current level of security, locate deficiencies and gauge the degree of protection needed
Security Survey focus on what
Security survey focuses on two things
The risk to the physical assets and property of an organization
The protection measures (against any risk) that comprise the realm of physical security
Security surveys are usually concerned
With measuring at least three basis factors : quality, reliability and cost using the techniques of observing, questioning, analyzing, verifying, investigating and evaluating
Checklist
It is a useful tool in security survey
Comprehensive Risk Assessment
It focuses equally on assets, threats, vulnerabilities, and consequences, a security survey places more emphasis on vulnerabiltiies
Outside inward approach
Under this approach the assessment team makes on the role of an adversary (Perpetrator) attempting to penetrate the physical defences of a facility
Inside outward approach
Here the assessment team takes on the role of the security professional (defender). They work from the asset or target out toward the outer perimeter. The assessors evaluate each successive layer of security, determining how the measures at that layer operate, how effective they are , how they contribute to the deter detect delay deny concept and how the layer could be improved
SWOT Analysis
Strengths, Weaknesses, Opportunities And Threats analysis. The technique originated in the business management community but can easily be adapted to the security analysis
The property perimeter is considered to be the
First (outer) ring of protection
Second (middle) ring , the buildings perimeter
Third (inner) ring, internal controls
Annual Loss Expectancy
Annual Loss Expectancy is the product of the cost of incident impact and the frequency of occurence
