Physical Security Assessment Flashcards
How is risk measured?
The value of the asset in relation to the threats and vulnerabilities associated with it.
How is a security risk rating calculated?
Asset value rating
X
Threat likelihood rating
X
Severity of incident rating
X
Vulnerability rating
=
Security risk rating
Conditions that tend to increase assets’ exposure to the risk of loss can be divided into which categories?
Physical – Includes factors such as the organization’s types and location of facilities, the operational technology or industrial control systems, and the criticality of on-site processes and assets.
Nonphysical – Includes factors such as geo-political landscape, culture, speed of decision-making, and intensity of competition.
Logical – Includes information and digital assets and the network or digital space that connects them.
How often should the risk assessment process be revisited?
It should be a cyclical and continuous effort since the elements are constantly subject to change over time.
What is the purpose of a security survey?
Determine and document the current security posture,
Identify deficiencies and excesses in existing security measures,
Compare the current posture with a determination of the appropriate level of security of protection needed,
Recommend improvements in the overall situation.
What factors should be addressed with considering vulnerabilities?
Lack of redundancy or backups for critical functions,
Single points of failures,
Collocation of critical systems, organizations, or components,
Inadequate response capability to recover from an attack,
Ease of aggressor access to a facility,
Inadequate security measures in place,
Presence of hazardous materials,
Potential for collateral damage from other companies in the area.
What is the difference between a physical security assessment and a security survey?
A security survey focuses more on vulnerabilities.
Is a cost-benefit analysis used in a physical security assessment or in a risk assessment?
A cost-benefit analysis should be used in both.
What are the functions included in a functional approach to a physical security assessment?
Security architecture and engineering,
Structural security measures,
CPTED,
Electronic security systems,
Security officers and the human element.
What are typical areas to assess in a physical security assessment?
Barriers, doors, windows/other openings, locks, safes and other containers, signage, lighting, alarm systems, electronic systems, security services, vehicle/traffic/parking controls, utilities protection, visitor management, and package handling.
Why should automated assessment tools only be used to ASSIST in completing an assessment?
May give a false sense of knowledge in security assessment,
High cost,
Complexity of software
Computers cannot factor in unquantifiable characteristics.
What is asset prioritization based on?
Each asset’s criticality to the organization’s mission and overall strategy.
What is the defense-in-depth approach?
An adversary must avoid or defeat a number of protective devices or features in sequence.
Why does each layer of security require a separate act by the adversary?
This causes uncertainty in the perpetrator’s mind, increases attack preparation time, adds steps to the intrusion, and allows time for a security or police response.
What is an important thing to consider when addressing layered security?
Interdependencies at each layer.
What is the principle of balanced protection?
The protection system’s individual applications and components will be integrated and converged so that they provide an equal level of protection.
What is involved in the appraisal component of the security survey?
Developing and communicating recommendations for enhancements.
What is the focus of a physical security assessment?
The risks to the physical assets and property of an organization, and the protection measures (against any risk) that comprise the realm of physical security.
The physical security assessment could provide the basis for what?
A comprehensive and integrated security analysis and risk assessment across the organization,
Identifying security gaps,
Identifying the range of potential solutions and its advantages/disadvantages,
Assisting in the development of organization security risk management, continuity, response, and recovery programs.
What costs should be considered in a cost-benefit analysis?
Technology costs,
Opportunity costs,
Process impact costs,
Time costs
Personnel costs
Overall capability costs.
What are three common approaches to a physical security assessment?
Outside-Inward approach,
Inside-Outward approach,
Functional approach.
This physical security assessment approach occurs when an assessment team takes the role of perpetrator and begins outside the facility focusing on the successive layers of Security.
Outside-Inward approach.
This physical assessment approach occurs when an assessment team takes the role of defender and works their way from the asset out toward the outer perimeter.
Inside-Outward approach.
This physical security assessment approach occurs when an assessment team evaluates security functions/disciplines and correlates the findings from the assessment component.
Functional (security discipline) approach.
What are five criteria of a good security survey report?
Accuracy,
Clarity,
Conciseness,
Timeliness,
Slant or pitch
What are the objectives of physical access control?
Deter potential intruders,
Distinguish authorized from unauthorized people,
Delay and prevent intrusion attempts,
Detect intrusions and monitor intruders,
Trigger appropriate incident response by communicating to security officers and police,
Deny by opposing or negating the effects of an overt or covert action.
What is an asset?
Anything that has tangible or intangible value to an enterprise.
What is risk analysis?
A process for identifying asset values, threats, and vulnerabilities to ascertain risks.
How is an asset’s criticality determined?
Based on the mission/goals of the organization and how the company would recover in the event that the asset was no longer available.
What are the three steps to identifying a company’s assets?
Define company’s primary business functions,
Identify site/building infrastructure and systems,
Identify company’s tangible, and intangible assets .
What two types of cost should be considered when valuing an asset?
Direct costs and indirect costs.
What are some factors to consider in valuing assets?
Injuries or deaths related to facility damage,
Asset replacement costs,
Revenue loss due to lost functions,
Backup/system redundancy existence,
Availability of replacements,
Critical/Sensitive information value,
Impact on revenue and reputation.
When determining asset values, what are some direct costs?
Financial losses (value of goods),
Increased insurance premiums
Insurance, deductibles,
Lost business,
Labor expenses incurred as a result of the event,
Management time dealing with the event,
Punitive damage awards not covered by insurance.
When determining an asset values, what are some indirect costs?
Negative media coverage,
Long-term negative consumer perception,
Public relations cost to overcome image, problems,
Lack of insurance coverage due to higher risk category,
Higher wages needed to attract future employees,
Shareholder suits for mismanagement,
Poor employee morale leading to work stoppages and higher turnover.
What legal and regulatory requirement procedures should be established as part of a physical asset protection program?
Identify the legal, regulatory, and other requirements, to which the organization subscribes related to the risks to its assets, activities, functions, products, services, stakeholders, environment, and supply chain;
Determine how these requirements applied to its risks;
Ensure that these requirements are taken into account in establishing, implementing, and maintaining its physical asset protection program.
What are two types of assets?
Tangible and intangible.
What are two ways assets can be valued?
They can be assigned a relative value, such as a number from 1 (low) to 5 (high), based on priority.
Apply a cost-of-loss formula.
What is the cost-of-loss formula to calculate an asset value?
K = Cp + Ct + Cr + Ci - I
K = total cost of loss
Cp = cost of permanent replacement
Ct = cost of temporary substitute
Cr = total related costs (remove old asset, install new, etc.)
Ci = lost income cost
I = available insurance or indemnity
What are the two types of adversaries?
Adversary who uses intrusion to gain access to the target asset, and an adversary who plans to attack the site from outside.
What are two common physical security compliance metrics in the public sector?
Compliance of facilities and compliance of systems.
What are two objectives of collecting physical security program metrics?
To provide insurance to the organization on the effectiveness of the program and to facilitate improvement.
This is commonly used to provide management with a snapshot of the effectiveness and efficiency of a physical security program.
Metrics summary chart.
What is the purpose of a Business Impact Analysis?
To assess and prioritize, organizational activities, and resources required to deliver its products and services.
What is the purpose of a business continuity management system (BCMS)?
To enable an organization to identify, develop, and implement policies, objectives, capabilities, processes, and programs – taking into account legal and other requirements – to address disruptive events that might impact the organization and its stakeholders.
What is considered the foundation for establishing the business continuity objectives, targets, programs, and plans?
The Business Impact Analysis (BIA) and Risk Assessment.
What are the 4 phases of business continuity?
Readiness,
Prevention,
Response,
Recovery/Resumption.
A group of individuals responsible for developing and implementing a comprehensive plan for responding to a disruptive incident, consisting of a core group of decision-makers trained in incident management and prepared to respond to an event is known as…
…the Crisis Management Team.
