Core Concepts and Principles Flashcards

What best distinguishes business continuity planning from disaster recovery planning?

Answer: Business continuity keeps critical business functions running, while disaster recovery focuses on restoring technology and infrastructure

BCP covers the continuation of essential operations, and DR is usually a narrower part focused on restoring systems.

Under Enterprise Security Risk Management (ESRM), who typically makes the final decision about accepting a security risk?

Answer: The asset owner or business leader

ESRM treats security as a partner that advises, while asset owners make the risk decisions.

Which three elements make up Cressey's fraud triangle?

Answer: Pressure, opportunity, and rationalization

Cressey found that occupational fraud generally needs financial pressure, an opportunity, and a rationalization.

In premises security negligence cases, which factor is most important in deciding whether an organization owed a duty to provide security?

Answer: The foreseeability of the criminal act

Courts usually look at whether the harm was reasonably foreseeable, often based on prior similar incidents.

Which is generally considered a behavioral indicator of a potential insider threat?

Answer: Repeated attempts to access information outside one's job duties

Unexplained attempts to reach data beyond assigned duties are a common warning sign of insider risk.

A security survey is best described as:

Answer: An on-site review of a facility's security program to identify weaknesses and recommend improvements

A security survey is a critical on-site examination that finds deficiencies and recommends protective measures.

The systems approach to security emphasizes:

Answer: Integrating people, procedures, and technology to work together

Effective protection comes from coordinating personnel, policies and procedures, and hardware as one system.