Threat Assessment and Recognition Flashcards

What is the primary purpose of threat assessment in a security console operation?

Answer: To identify, evaluate, and manage potential threats before they materialize

Threat assessment aims to proactively identify, evaluate, and manage potential threats before they escalate into actual incidents.

Which behavior is most commonly associated with pre-attack surveillance by a potential threat actor?

Answer: Taking photographs or sketching security camera locations and entry points

Pre-attack surveillance typically involves gathering intelligence about security measures, including documenting camera positions, guard rotations, and entry/exit points.

What does the informal security term 'JDLR' stand for?

Answer: Just Doesn't Look Right

'JDLR' stands for 'Just Doesn't Look Right,' referring to the intuitive recognition of something that seems out of place or suspicious.

When a console operator observes an individual repeatedly walking past a facility entrance and peering inside, this behavior is best classified as:

Answer: Potential pre-incident surveillance

Repeated passes by a facility entrance while looking inside are classic indicators of pre-incident surveillance and should be documented and reported.

What is 'baseline behavior' in the context of security threat recognition?

Answer: The normal patterns of activity and behavior expected in a given environment

Baseline behavior refers to the normal, expected patterns of activity in an environment, allowing security personnel to identify deviations that may signal a threat.

Which of the following behaviors is most indicative of a potential insider threat?

Answer: An employee who accesses restricted areas outside their normal work hours without authorization

Unauthorized access to restricted areas outside normal work hours is a significant behavioral indicator of a potential insider threat.

When a console operator identifies a credible potential threat, what is the most appropriate immediate action?

Answer: Document observations and immediately notify supervisory personnel per established protocols

The appropriate response is to document observations and immediately notify supervisory personnel while following established protocols, maintaining the proper chain of command.