Industry Best Practices Flashcards

An event has a single loss expectancy (SLE) of $50,000 and an annualized rate of occurrence (ARO) of 0.2. What is the annualized loss expectancy (ALE)?

Answer: $10,000

ALE equals SLE multiplied by ARO, so $50,000 x 0.2 = $10,000.

A commonly cited standard for a perimeter security chain-link fence is which configuration?

Answer: 7 feet of fabric plus a 1-foot top guard of barbed wire

Common guidance specifies 7 feet of fabric topped with a 1-foot barbed wire guard for roughly 8 feet total.

An exterior intrusion sensor is triggered by a deer crossing the detection zone. How is this alarm classified?

Answer: Nuisance alarm

Nuisance alarms are caused by environmental or non-threat stimuli such as animals or weather, while false alarms stem from equipment faults.

Which practice is most effective for an insider threat program?

Answer: Integrating information from HR, IT, legal, and security to identify behavioral indicators

Insider threat best practice fuses data from multiple functions to spot concerning behavior early.

When designing a video surveillance system, what should primarily determine the required camera resolution and pixel density?

Answer: The operational purpose, such as detection, recognition, or identification

Defining whether a view must detect, recognize, or identify drives the pixels-on-target requirement.

A mailroom employee finds a package with excessive postage, no return address, and an oily stain. What is the best practice response?

Answer: Do not open it, isolate the area, evacuate, and notify authorities

Suspicious packages should be left undisturbed, the area isolated and evacuated, and trained responders notified.

What best distinguishes a security policy from a security procedure?

Answer: A policy states management's intent and direction, while a procedure gives step-by-step instructions

Policies are high-level statements of intent; procedures detail how to carry them out.