Security System Analysis Flashcards

What is 'piggybacking' (also called tailgating) in the context of access control security analysis?

Answer: An unauthorized person following an authorized person through a controlled entry point

Piggybacking or tailgating occurs when an unauthorized individual enters a secured area immediately behind an authorized user without using their own credential.

A forensic locksmith is analyzing a high-security facility's card access logs. Entries show credentials used at a reader before they were officially issued in the system. This most likely indicates:

Answer: Card cloning or credential duplication prior to issuance

Access events predating official credential issuance strongly suggest the card data was cloned during manufacturing or distribution and used before authorized distribution.

In security system forensics, what does CPTED stand for and why is it relevant?

Answer: Crime Prevention Through Environmental Design — affects how physical layouts deter or enable criminal activity

CPTED (Crime Prevention Through Environmental Design) uses physical space design—lighting, sight lines, access points—to reduce criminal opportunity and is essential in security vulnerability assessments.

A forensic analysis of an electronic safe shows multiple consecutive wrong-code entries followed by a lockout period. What forensic inference is MOST appropriate?

Answer: A brute-force or trial-and-error attack was attempted against the safe's combination

Consecutive wrong-code entries in the event log are a hallmark indicator of a brute-force attack against the electronic lock's combination.

Which wireless alarm system frequency band is MOST susceptible to consumer-grade jamming devices?

Answer: 433 MHz and 315 MHz unlicensed ISM bands used by many older wireless sensors

Many older wireless security sensors operate on 433 MHz or 315 MHz, which are easily overwhelmed by readily available jamming hardware targeting those ISM bands.

What is the forensic significance of 'event log rollover' in an access control or alarm system?

Answer: Critical event records may have been overwritten, destroying potential evidence of the incident

When a system's event log reaches capacity and overwrites the oldest entries, forensically relevant data about the incident may be permanently lost.

A forensic locksmith notes that a door alarm was bypassed in the control panel by zone number before the intrusion. What is the most forensically significant implication?

Answer: The suspect had knowledge of the alarm system layout and had access to the control panel or code

Intentional zone bypassing before an intrusion event implies insider knowledge of the system configuration and either access to the panel or the user code.