Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Study group > PSP Domain 1: Physical Security Assessment > Flashcards

PSP Domain 1: Physical Security Assessment Flashcards

1
Q

What are two types of assets?

A

Tangible and intangible.

Sources: PSP, 1.2.1, page 5 POA, Physical Security, 2.1, page 17

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are two objectives of collecting physical security program metrics?

A

To provide assurance to the organization on the effectiveness of the program and to facilitate improvement.
Sources: PSP, 4.2.4, page 65 POA, Physical Security, 4.2.4, page 71

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is commonly used to provide management with a snapshot of the effectiveness and efficiency of a physical security program?

A

Metrics summary chart.

Sources: PSP, 4.2.4, page 65 POA, Physical Security, 4.2.4, pages 71-72

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the purpose of a business impact analysis (BIA)?

A

To assess and prioritize organizational activities, and resources required to deliver its products and services.

Source: Guideline BC, 11.1.3, pages 12-13

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the purpose of a business continuity management system (BCMS)?

A

To enable an organization to identify, develop, and implement policies, objectives, capabilities, processes, and programs - taking into account legal and other requirements - to address disruptive events that might impact the organization and its stakeholders.

Source: Guideline BC, 8.0, pages 6-7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is considered the foundation for establishing the business continuity objectives, targets, programs, and plans?

A

The business impact analysis (BIA) and risk assessment.

Source: Guideline BC, 11.1.3.d, page 13

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What group of individuals is responsible for developing and implementing a comprehensive plan for responding to a disruptive incident?

A

The crisis management team (CMT). It consists of a core group of decision makers trained in incident management and prepared to respond to an event.

Source: Guideline BC, 11.1.5, page 14

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the term for activities, programs, and systems developed and implemented prior to an incident that may be used to support and enhance mitigation of, response to, and recovery from disruptions?

A

Preparedness (readiness).

Source: Guideline BC, 10.0, page 9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a threat?

A

Potential cause of an unwanted incident which may result in harm to individuals, assets, a system or organization, the environment, or the community.
Source: PSP Standard, 3.72, page 8

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a loss event profile?

A

A list of the kind of threats affecting the assets to be safeguarded.

Source: IPPS, Chapter 4, page 56

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a hazard?

A

A source of potential danger or adverse condition. Hazards are generally associated with nature.

Source: IPPS, Chapter 4, page 56

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Threats or loss risk events can fall into which three distinct categories?

A

Crimes, Noncriminal events such as man-made incidents or natural disasters, Consequential events caused by an enterprise’s relationship with another organization.

Source: IPPS, Chapter 4, page 56

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some examples of noncriminal threats?

A

Natural threats/disasters: hurricanes, tornadoes, major storms, etc. Man-made threats or disasters: labor strikes, airplane crashes, electrical power failures.

Source: IPPS, Chapter 4, page 57

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are examples of peripheral systems and interfaces?

A

Life safety systems, building controls, IT infrastructure, liaison relationships, outsourced services, and policies and procedures.
Source: POA, Physical Security, 2.3, page 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a consequential event?

A

An event that occurs because of a relationship between events or between two different organizations— the company suffers a loss as a consequence of that event or affiliation.

Source: IPPS, Chapter 4, page 57

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How is the probability that a threat will occur decided?

A

By considering the likelihood that a loss risk event may occur in the future.

Source: IPPS, Chapter 4, page 57

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are some factors that are used in determining the probability that a threat will occur?

A

Historical data at the site, The history of like events at similar companies, The makeup of the neighborhood and immediate vicinity, overall geographical location, Political and social conditions, Changes in the economy.

Source: IPPS, Chapter 4, page 57

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is vulnerability?

A

Any weakness that can be exploited by an aggressor (terrorist or criminal) or that makes an asset susceptible to damage from natural hazards or consequential events.

Source: IPPS, Chapter 4, page 59

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are some factors to consider in assessing asset vulnerability?

A

Lack of redundancy or backups for critical systems, Single points of failure, Collocation of critical systems/organizations, Inadequate response capability to recover from attack, Ease of aggressor access to a facility, Inadequate security measures in place, Presence of hazardous materials, Potential for collateral damage from other companies in area.

Source: IPPS, Chapter 4, page 59

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What legal and regulatory requirement procedures should be established as part of a physical asset protection program?

A

Identify the legal, regulatory, and other requirements to which the organization subscribes related to the risks to its assets, activities, functions, products, services, stakeholders, environment, and supply chain; Determine how these requirements apply to its risks; Ensure that these requirements are taken into account in establishing, implementing, and maintaining its physical asset protection program.
Source: PAP Standard, 5.4, page 13

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What should accompany the regular review of the physical security assessment report?

A

Monitor and follow up on the assessment findings, observations, and recommendations.
Source: PAP Standard, 7.2.1, page 19

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the seven functions of physical security?

A

Access control, Deterrence, Detection, Assessment, Delay, Response, Evidence gathering.

Source: POA, Physical Security, 2.2, pages 18-19

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What factors should be considered when selecting a risk mitigation strategy?

A

Availability, Affordability, Feasibility.

Source: POA, Physical Security, 3.2.5, page 35

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The effectiveness of individual countermeasures and the security system depends on what?

A

The adversary and the threat.

Source: POA, Physical Security, 3.2.5, page 36

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What must happen as a threat increases in sophistication?

A

The effectiveness of the countermeasures must also increase, or the additional risk must be managed by some other means.
Source: POA, Physical Security, 3.2.5, page 36

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are two categories of threats?

A

Manmade threats, Natural threats.

Source: POA, Physical Security, 3.2.2, page 33

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What metric measures time responsiveness of external dependencies in meeting a security department request?

A

External dependency responsiveness.

Sources: PSP, 4.3, page 66 POA, Physical Security, 4.3, page 72

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are some physical security design attributes?

A

Type of adversary, Amount of time the adversary requires getting to the assets inside, Number and type of detectors inside and out of the site, Delays that slows down the attack, Size, strength, and equipage of the response force.
Source: IPPS, Chapter 1, pages 2-3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The process of identifying threats and vulnerabilities, identifying the likelihood of an event arising from such threats or vulnerabilities, defining critical functions for operations, defining controls to reduce exposure, and evaluating cost of controls is called what?

A

Risk assessment.

Source: Guideline BC, 10.0, page 9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What four criteria can be used to rank assets based on criticality?

A

Workforce, Service delivery, Dependencies, Mission/objectives.
Source: POA Physical Security, 3.2.1, pages 32-33

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which analysis method does not use number, but instead uses comparative terms?

A

Qualitative analysis.

Sources: PSP, 3.2, page 27 POA, Physical Security, 3.2, page 29

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which analysis method utilizes numeric measures to describe value of assets or the level of threats, vulnerabilities, impact or loss events?

A

Qunatitative Analysis.

Sources: PSP, 3.2, page 27 POA, Physical Security, 3.2, page 30

33
Q

When is it most suitable to use qualitative analysis?

A

When evaluating basic security applications.

Source: POA, Physical Security, 3.2, page 29

34
Q

What is a SWOT analysis?

A

A situational business analysis that involves strategic evaluation of key internal and external factors. SWOT refers to strengths, weaknesses, opportunities, and threats.
Sources: PSP, 3.3.2, page 39 POA, Physical Security, 3.3.2, page 41

35
Q

What does SWOT stand for?

A

Strengths, weaknesses, opportunities, threats.

Sources: PSP, 3.3.2, page 39 POA, Physical Security, 3.3.2, page 41

36
Q

In a SWOT analysis, what are the external factors?

A

Opportunities and threats.

Sources: PSP, 3.3.2, page 39 POA, Physical Security, 3.3.2, page 41

37
Q

In a SWOT analysis, what are the internal factors?

A

Strengths and weaknesses.

Sources: PSP, 3.3.2, page 39 POA, Physical Security, 3.3.2, page 41

38
Q

What is the annual loss expectancy?

A

The product of the cost of incident impact and the frequency of occurrence.
Sources: PSP, 3.5, page 45 POA, Physical Security, 3.5, page 50

39
Q

What are some state and local requirements that should be considered for projects?

A

Code regulations, Guidelines or Standards, Permitting requirements, Contractual requirements.
Sources: PSP, 7.2, page 99 POA, Physical Security, 7.2, page 105

40
Q

What conditions affect the likelihood of occurrence??

A

Physical environment, social environment, Political environment, Historical experience, Procedures and processes, Criminal capabilities.

Source: IPPS, Chapter 4, page 58

41
Q

What data may be included in an incident management system?

A

Loss event history, Threat frequency analysis, Single and annual loss expectancy, Impact assessment.
Sources: PSP, 3.5, page 45 POA, Physical Security, 3.5, pages 49-50

42
Q

What tests of systems and procedures should be considered as part of a security survey?

A

Shipping and receiving, Alarms, Computer/server room security, General access controls.
Sources: PSP, 3.4.2, page 44 POA, Physical Security, 3.4.2, page 48

43
Q

With whom should you be coordinating when performing security system and procedure tests during a security survey?

A

The building owner or manager, and, if applicable, any outside agencies that may be involved.
Sources: PSP, 3.4.2, page 44 POA, Physical Security, 3.4.2, page 48

44
Q

What is checked during a security survey test on shipping and receiving?

A

Controls are checked by physical observation of selected shipments (incoming and outgoing) against bills of lading of inventory records.
Sources: PSP, 3.4.2, page 44 POA, Physical Security, 3.4.2, page 48

45
Q

What is evaluated during a security survey test on alarms?

A

The response as well as the reaction of facility occupants and security officers.
Sources: PSP, 3.4.2, page 44 POA, Physical Security, 3.4.2, page 48

46
Q

What is tested during a security survey test on a computer room or server room?

A

The security and access controls of computer/data processing areas during both working and nonworking hours.
Sources: PSP, 3.4.2, page 44 POA, Physical Security, 3.4.2, page 48

47
Q

How are general access controls tested during a security survey?

A

Attempt to gain access to the facility and selected internal areas during working and nonworking hours. Determine whether access is possible and, if so, whether employees challenge the ‘intruders’ after the fact.
Sources: PSP, 3.4.2, page 44 POA, Physical Security, 3.4.2, page 48

48
Q

How should areas, items and issues be evaluated during a security survey?

A

In terms of appropriateness for the situation, age, operability, maintenance, interoperability, aesthetics, and consistency with the current use of the space.
Sources: PSP, 3.4.1, page 40 POA, Physical Security, 3.4.1, page 43

49
Q

What should be reviewed when assessing key/card security during a security survey?

A

Accountability and policy, Record keeping and inventory, Recovery procedures (for keys), Changed when appropriate (turnover of key personnel, after a theft/burglary, etc.).
Sources: PSP, 3.4.1, page 41 POA, Physical Security, 3.4.1, page 44

50
Q

What are some examples of openings (other than windows and doors) that should be assessed during a security survey?

A

Manholes, Skylights, Roof hatches, Ventilator/air conditioning vents/shafts, Penthouses and penthouse/roof/veranda access, Sidewalk grates.
Sources: PSP, 3.4.1, page 41 POA, Physical Security, 3.4.1, page 44

51
Q

What should be examined when assessing the protection of utilities during a security survey?

A

Location and physical protection, Access control, Backup/emergency sources, Protection of telecommunications and data lines.
Sources: PSP, 3.4.1, page 43 POA, Physical Security, 3.4.1, page 47

52
Q

What is the first step in a risk assessment?

A

Identification and valuation of assets.

Sources: PSP, 1.2, page 5 POA, Physical Security, 3.1, page 28

53
Q

What are the Four Ds?

A

Deter, Detect, Delay, Deny.

Sources: PSP, 1.3.1, page 9 POA, Physical Security, 2.1, page 18

54
Q

What are the five risk treatments?

A

Accepting the risk, Transferring the risk, Spreading the risk, Avoiding the risk, Mitigating the risk.
Sources: PSP, 1.3.2, page 9 PAP Standard, 7.3, page 20

55
Q

What is the goal of a cost-benefit analysis?

A

To identify the optimal level of risk reduction at the best value available.
Source: PAP Standard, 7.3.1, page 20

56
Q

What are examples of four levels of risk?

A

Catastrophic, High, Moderate, Low.

Source: PAP Standard, 7.2, page 18

57
Q

What level of risk requires treatment at any cost for activities and functions to continue?

A

Catastrophic.

Source: PAP Standard, 7.2, page 18

58
Q

What level of risk cannot be further reduced without expenditure of costs disproportionate to benefits?

A

High.

Source: PAP Standard, 7.2, page 18

59
Q

What level of risk is negligible or can be managed with routine procedures?

A

Moderate.

Source: PAP Standard, 7.2, page 18

60
Q

What is the level of risk where an organization is prepared to pursue, retain, or take based on informed decisions?

A

Low.

Source: PAP Standard, 7.2, page 18

61
Q

What conditions tend to increase an asset’s exposure to the risk of loss?

A

Physical environment, such as location; Social environment, including crime rate and demographics; Political environment, including government stability and law enforcement resources; Historical experience, such as previous events; Procedures and processes for using and protecting assets; Criminal capabilities.
Sources: PSP, 3.1, page 26 POA, Physical Security, 3.1, pages 28-29

62
Q

What are two common approaches to measure vulnerability?

A

Observability and exploitability.

Sources: PSP, 3.2.3, page 31 POA, Physical Security, 3.2.3, page 34

63
Q

The ability of an adversary to see and identify a vulnerability is known as what?

A

Observability.

Sources: PSP, 3.2.3, page 31 POA, Physical Security, 3.2.3, page 34

64
Q

The ability of an adversary to take advantage of the vulnerability is known as what?

A

Exploitability.

Sources: PSP, 3.2.3, page 31 POA, Physical Security, 3.2.3, page 34

65
Q

When is observability reversed?

A

In assessing natural threats.

Sources: PSP, 3.2.3, page 31 POA, Physical Security, 3.2.3, page 34

66
Q

The determination of the actual cost of a security program against the impact in terms of loss reduction, financial savings, acquisition, life cycle, replacement or other measures is known as what?

A

Cost-benefit analysis

Sources: PSP, 3.3.1, page 35 POA, Physical Security, 3.3.1, page 38

67
Q

A measure based on a reference that involves quantity over time is known as what?

A

Metrics.

Sources: PSP, 4.1, page 50 POA, Physical Security, 4.1, page 53

68
Q

What are the technical criteria of the Security Metrics Evaluation Tool (Security MET)?

A

Reliability, Validity, Generalizability.

Sources: PSP, 4.1, page 51 POA, Physical Security, 4.1.2, page 55

69
Q

What are the operational criteria of the Security Metrics Evaluation Tool (Security MET)?

A

Cost, Timeliness, Manipulation.

Sources: PSP, 4.1, page 51 POA, Physical Security, 4.1.2, page 56

70
Q

What are the strategic criteria of the Security Metrics Evaluation Tool (Security MET)?

A

ROI, Organizational relevance, Communications.

Sources: PSP, 4.1, page 51 POA, Physical Security, 4.1.2, page 56

71
Q

What are the evaluation criteria for the Security Metrics Evaluation Tool (Security MET)?

A

Technical criteria, Operational criteria, Strategic criteria.
Sources: PSP, 4.1, page 51 POA, Physical Security, 4.1.2, page 55

72
Q

What are three major components of a physical security program?

A

Systems, Personnel, Compliance.

Sources: PSP, 4.2, page 54 POA, Physical Security, 4.1.2, page 57

73
Q

What are some common types of alarms on which data can be collected?

A

Forced Door, Door held open, Unauthorized access attempts, User-defined actions/alarms, Communications failure.
Sources: PSP, 4.2.1, page 54 POA, Physical Security, 4.2.1, pages 59-61

74
Q

What are two measurable physical security personnel metrics?

A

Response and training.

Sources: PSP, 2.2, pages 60-63 POA, Physical Security, 4.2.2, pages 65

75
Q

What is the first step in asset protection?

A

Perform a threat and vulnerability analysis.

Source: IPPS, Chapter 1, page 1

76
Q

What is one potential pitfall in choosing security technology?

A

Inability to thoroughly evaluate product claims prior installation.
Sources: PSP, 7.3, page 100 POA, Physical Security, 7.3, page 107

77
Q

What is a primary challenge for security system designers, especially in public buildings?

A

Balance the need for public access against ensuring public safety.
Sources: PSP, 7.3, page 100 POA, Physical Security, 7.3, pages 106-107

78
Q

How is risk calculated?

A

Risk = (Threat x Vulnerability x Impact) / 3

Source: POA, Physical Security, 3.2.4, p.35

Study group (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions