Assessment and Evaluation Flashcards

In a common risk formula used in security assessments, risk is a function of which three elements?

Answer: Threat, vulnerability, and consequence

Risk rises with the likelihood of a threat, the vulnerability to it, and the impact if it succeeds.

What is the primary purpose of a red team exercise in evaluating physical security?

Answer: To realistically test defenses by simulating an adversary's attempts to defeat the system

Red teams act as adversaries to expose real-world weaknesses that checklists might miss.

An assessor observes employees regularly holding badge-controlled doors open for others. What vulnerability should be documented?

Answer: Tailgating/piggybacking that defeats access control

Letting people follow through without authenticating bypasses access control regardless of the hardware's quality.

Which assessment approach assigns ratings such as 'high', 'medium', and 'low' instead of numeric probabilities and dollar values?

Answer: Qualitative assessment

Qualitative methods use descriptive scales when precise numeric data is unavailable or impractical.

After new security countermeasures are installed, what is the purpose of a post-implementation evaluation?

Answer: To verify the countermeasures perform as intended and reduce risk as projected

Post-implementation review confirms the measures are effective and finds any adjustments needed.

When performing path analysis, why does an assessor identify the 'most vulnerable path'?

Answer: Because overall system effectiveness is limited by the path with the lowest probability of interruption

A rational adversary picks the weakest path, so that path determines the system's real effectiveness.

Which CPTED-related observation would an assessor most likely note as weakening natural surveillance?

Answer: Overgrown shrubs and poor lighting that block sightlines near entrances

Natural surveillance relies on clear sightlines and good lighting so legitimate users can see suspicious activity.