Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPP > Security principles and practices > Flashcards

Security principles and practices Flashcards

1
Q

What are indirect costs of security?

A

Harm to reputation,
Loss of goodwill,
Loss of employees,
Harm to employee morale.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What members should comprise a vulnerability assessment team?

A 
Security specialist (leader), 
Security systems engineer, 
Response expert,
Data analyst,
Operations representatives,
Subject matter experts (E.g. locksmiths, technical writers, legal experts).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the goal of a vulnerability assessment?

A

To identify physical protection system (PPS) components in the functional areas of detection, delay, and response and to gather data to estimate their performance against particular threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three primary functions of a physical protection system (PPS)?

A

Detection,
Delay,
Response.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the two key measurements for the effectiveness of the detection function of a physical protection system (PPS)?

A

Probability of sensing adversary action,

Time required for reporting and assessing the alarm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How is the response function of a physical protection system (PPS) measured?

A

The response function of a PPS is measured by the time between receipt of a communication of adversary action and the interruption of the adversary action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the vulnerability assessment team’s primary job as it pertains to a physical protection system (PPS)?

A

To determine security system effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two basic analytical approaches to a risk assessment?

A

Compliance based,

Performance based.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the formula for residual risk?

A

R = T x A x V

where

R = residual risk
T = threat
A = asset to be protected
V = vulnerability.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A well engineered physical protection system (PPS) exhibits which three characteristics?

A

Protection in depth,
minimum consequence of component failure (redundancy),
balanced protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three contributors to cost of replacement?

A

Purchase price or manufacturing cost,
Freight and shipping charges,
Make ready or preparation cost to install it or make it functional.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the formula for lost income cost?

A

I = i/365 x P x T

where

I = income earned,
i = annual percent rate of return,
P = principal amount (in dollars) available for investment,
t = time (in days) during which P is available for investment.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the cost of lost formula?

A

K = (Cp + Ct + Cr + Ci) - (I-a),

where

K = criticality, total cost of loss,
Cp = cost of permanent replacement,
Ct = cost of temporary substitute,
Cr = total related costs,
Ci = lost income cost,
I = available insurance or indemnity,
a = allocable insurance premium amount.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the elements of a systems approach to developing a physical protection system (PPS)?

A

Assessment of vulnerability,
Implementation of countermeasures,
Evaluation of effectiveness.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What three questions does a risk assessment attempt to answer?

A

What can go wrong?
What is the likelihood it would go wrong?
What are the consequences?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What four questions does risk management attempt to answer?

A

What can be done?
What options are available?
What are the associated trade-offs in terms of costs, benefits, and risks?
What are the impacts of current management decisions on future options?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the design basis-threat?

A

The adversary against which the utility must be protected. It is used to help design and evaluate a physical protection system (PPS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the three general measures of valuing assets?

A

Cost,
Consequence criteria,
Policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the difference between asset protection and Security,

A

Asset protection includes all security functions, as well as related functions such as investigations, risk management, safety, compliance, and emergency management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Assets protection is increasingly based on what principal?

A

Risk management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the five avenues of addressing risk?

A 
Avoidance,
Transfer,
Spreading,
Reduction,
Acceptance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the five D’s of security?

A 
Deter,
Deny,
Detect,
Delay,
Destroy.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What four major areas does assets protection cover in the telecommunications sector?

A

Information security,
Network/computer security,
Fraud protection,
Physical security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the five forces shaping assets protection globally?

A 
Technology and touch,
Globalization in business,
Standards and regulation,
Convergence of security solutions,
Homeland security and the international security environment.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

According to Davidow and Malone, what is the centerpiece of the new global economy?

A

The virtual product, where major business functions are outsourced with hardly any internal departmentalization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the three managerial dimensions of assets protection?

A

Technical expertise,
Management ability,
Ability to deal with people.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the two general types of insurance?

A

Property,

Liability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the three classifications of loss in insurance policies?

A

Direct loss,
Loss of use,
Extra expense loss (e.g. cost of defending a liability suit or paying a judgment).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the five basic coverages of a crime insurance policy?

A

Employee dishonesty bond,
Money and securities coverage inside the premises,
Money and securities coverage outside the premises,
Money order and counterfeit paper currency coverage,
Depositors’ forgery coverage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

For insurance against business interruption, what are the two types of valuation methods?

A

Actual loss sustained,

Valued loss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

In Pastor’s public/private, substitute/supplement model of policing, which cell represents the rarest scenario?

A

Public/substitute.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What three factors are driving the growth of private policing?

A

Economic and operational issues,
(Fear of) crime and violence,
Order maintenance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is the optimal relationship between police and private security?

A

Institutionalized coordination and cooperation through structural and contractual relationships.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What was the purpose of the Hallcrest reports?

A

To compare the US security industry to public law enforcement quantitatively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is the most significant distinction between public and private policing?

A

Cost.

36
Q

What are the main costs that make public policing more expensive than private security?

A

Police officer salaries and benefits,
911 calls,
Alarm response,
Alternative services such as traffic control.

37
Q

What are the four explanations for cost savings when using private security versus public police?

A

More flexible labor,
Richer incentives and penalties,
More precise allocation of accountability,
Less constraint on process, more focus on results.

38
Q

What five categories of distinction between public and private policing were identified by Carlson?

A

Philosophical (public police have more moral authority),
Legal (private police have limited power of arrest),
Financial (private police cost less),
Operational (private police are more flexible),
Security/political (private police give citizens more control over their safety by augmenting public police efforts).

39
Q

What is the most important distinction between public and private police?

A

The delivery system (government versus corporations).

40
Q

Where is it common for private security to supplement police in a public environment?

A

Business improvement districts.

41
Q

What is likely to be the key component for alternative security providers in the future?

A

Order maintenance operations.

42
Q

What is the best practice for security officer training?

A

Develop a training curriculum that focuses on the particular role or function to be performed.

43
Q

What are the types of security consultants?

A

Security management consultants (Largest group),
Technical security consultants,
Forensic security consultants.

44
Q

What are the best sources for finding security consultants?

A

Colleagues,
Security associations,
Industry specific associations.

45
Q

As a rule of thumb, what kind of travel allowances should a consultant receive?

A

The same as those given to members of the client’s senior management.

46
Q

Who does a company typically assign to serve as project coordinator for a security consultant?

A

The CSO or vice President of security.

47
Q

What is the emerging trend in consultant fees?

A

Project based pricing rather than hourly fees.

48
Q

In all industries, what are the most consistent predictors of theft?

A

The employee’s access to property and the perceived chances of being detected.

49
Q

To what three issues should an organizational resilience management policy reflect senior management’s commitment?

A

Compliance with legal requirements;
Prevention, preparedness, and mitigation of disruptive incidents;
Continual improvement.

50
Q

With which four ISO standards is ASIS’s Organizational resilience standard aligned?

A

IS0 9000,
ISO 14001,
ISO 27001,
ISO 28000.

51
Q

According to ASIS’s CSO standard, how many years of direct experience at a senior level should a CSO applicant have?

A

3 to 5 years.

52
Q

What workers are most likely to steal electronics components in manufacturing environments?

A

Engineers.

53
Q

What is a surety bond?

A

Insurance that protects an organization if there is a failure to perform specific tasks within a certain time period.

54
Q

Turnover costs run to what percentage of a security officer’s salary?

A

25% or more.

55
Q

What are the seven key skills of a CSO?

A 
Relationship leader,
Executive leader,
Subject matter expert,
Governance team leader,
Risk executive,
Strategist,
Creative problem solver.
56
Q

According to Donald Cressey, what are the three factors leading to fraud?

A

Perceived non-shareable financial problem,
Perceived opportunity for a trust violation,
Series of rationalizations to justify behavior.

57
Q

What is Edwin Sutherland’s theory of crime?

A

Criminal behavior is most often correlated with a person’s association with a criminal environment, according to Sutherland.

58
Q

Which two characteristics must a lost event have before Security countermeasures can be planned?

A

A measurable loss,

A loss that did not result from speculative risk.

59
Q

What is the formula for loss event probability?

A

P = f/n

Where

P = The probability that a given event will occur,
f = The number of actual occurrences of that event,
n = The total number of experiments seeking that event.
60
Q

What is the first step in a qualitative general security risk assessment?

A

Understand the organization.

61
Q

What are useful categories for security data analysis?

A

Claims avoided,
Proofs of loss,
Recovered physical assets,
Uninsured claims or causes of action.

62
Q

What types of incidents should an asset protection program consider?

A

Major incidents and events, as well as incidental cost avoidances and asset or value recoveries that occur in the course of operations.

63
Q

What percentage of business failures result from employee theft?

A

The US Chamber of Commerce estimates that 30% of business failure result from employee theft.

64
Q

What percentage of revenues do US businesses lose to fraud?

A

US organizations lose 6% of their annual revenues to fraud.

65
Q

In the retail industry, how much greater in dollars is employee theft than shoplifting?

A

Employees steal 15 times as much as shoplifters.

66
Q

In food service, employee theft imposes how much of a tax on every dollar spent?

A

Employee theft in food service is equal to a 4% tax

67
Q

What items are most frequently stolen by employees?

A

Time,
Finished goods,
Scrap and waste,
Intellectual property.

68
Q

What hypotheses did Clark and Hollinger posit to explain employee theft?

A 
External economic pressures,
Youth,
Opportunity,
Job dissatisfaction,
Social control.
69
Q

According to Clark and Hollinger, what fraction of employees admitted to stealing from their employer?

A

1/3 of employees reported stealing from their employer.

70
Q

Who commits most workplace property theft?

A

Employees with the greatest access to the property and least perceived chance of detection.

71
Q

Who commits the most theft in hospitals?

A

Nurses.

72
Q

What is the most consistent predictor of theft in all industries?

A

The employees perceived chance of being detected.

73
Q

According to Joseph Wells, what three factors are present in every fraud?

A

Financial pressure,
Opportunity,
Justification.

74
Q

What is “lapping?”

A

Lapping is pocketing small amounts from incoming invoices payments and then applying subsequent payment to cover the missing cash from the previous invoice, and so on.

75
Q

Which of the three “shuns” (termination, prosecution, restitution) does the victim most good?

A

Restitution.

76
Q

According to Louis and Maxwell, levels of fear are the greatest when there is a concern about which two factors?

A

Crime,

Instability.

77
Q

What is the principal value of security awareness to executive management?

A

Awareness of the security program’s financial contribution to the bottom line.

78
Q

What is the primary purpose of a security awareness program?

A

To educate employees on how to protect company assets and reduce losses.

79
Q

What are the features of the most effective security awareness training programs?

A

They engage staff and let them have fun.

80
Q

What are the six main obstacles to an effective security awareness program?

A 
Low credibility of security department,
Organizational culture,
Naïveté,
Perception of a minimal threat,
Departmental/employee indifference,
Lack of reporting capability
81
Q

Through what measures can security departments create positive contacts with staff to promote security awareness?

A

Conducting home protection clinics,
Lending property marking devices,
Offering group purchases of alarms,
Conducting personal protection programs,
Conducting cyber security awareness programs,
Conducting children’s fire prevention campaigns.

82
Q

What are the three organizational models for security forces?

A

Vertical or hierarchical,
Shamrock,
Network.

83
Q

What is the hierarchical model of organizational structure?

A

In the hierarchical model, authority comes from the top and flows down three series of managers to the front line staff.

84
Q

What is the Shamrock model of organizational structure?

A

In the shamrock model,
Leaf one represents a small core of professionals and managers who skills are critical to the organization,
Significantly larger, the second leaf consists of third-party suppliers with special expertise,
The third leaf consists of part time and temporary workers who are employed as needed.

85
Q

What is the network model of organizational structure?

A

In the network model, employees are connected not just to their immediate supervisor and their direct reports, but too many others in the organization; people come together for particular tasks and disband or re-organize as needed.

CPP (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions