SFPC Physical Security Measures 3 — Questions and Answers
Question 1: What is the role of 'physical security surveys' in a security program?
- Interviewing employees about job satisfaction
- Systematic assessments of a facility's physical security measures to identify vulnerabilities and recommend improvements (Correct answer)
- Annual inspections of fire safety equipment only
- Reviews of access badge issuance procedures
Correct answer: Systematic assessments of a facility's physical security measures to identify vulnerabilities and recommend improvements
Physical security surveys systematically evaluate all aspects of a facility's physical security program to identify vulnerabilities and recommend countermeasures to reduce security risks.
Physical security surveys are systematic assessments conducted to evaluate the effectiveness of a facility's physical security measures. They examine all aspects of physical security including perimeter protection, access control systems, surveillance capabilities, security personnel, lighting, and procedures. The survey results in a written report identifying vulnerabilities and recommending specific improvements.
Question 2: What is a 'defense-in-depth' approach to physical security?
- Focusing all security resources on the outer perimeter
- Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area (Correct answer)
- Deploying all security guards at the main entrance
- Installing the most advanced technology available at a single checkpoint
Correct answer: Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area
A layered approach to physical security uses multiple concentric security rings so that an adversary must overcome each layer successively, significantly increasing the difficulty of reaching the protected target.
Defense-in-depth in physical security means applying multiple overlapping layers of security controls starting from the outer perimeter and moving inward toward the most sensitive areas. Typical layers include: outer perimeter (fencing, lighting), inner perimeter (building skin, access controls), reception/lobby controls, secured area access controls, and vault-level protection for the most sensitive assets. Each layer requires the attacker to expend more effort and time.
Question 3: What is the purpose of 'security seals' on equipment and containers?
- Decorative purposes only
- To provide tamper evidence, indicating whether a container or piece of equipment has been accessed or modified without authorization (Correct answer)
- To identify ownership of equipment
- To attach shipping labels
Correct answer: To provide tamper evidence, indicating whether a container or piece of equipment has been accessed or modified without authorization
Security seals provide tamper evidence on equipment, containers, and access points, making it apparent if someone has accessed or modified what is sealed without authorization.
Security seals are devices applied to containers, equipment, or access points that provide visible evidence of unauthorized access or tampering. When a seal is broken, cut, or shows signs of manipulation, it indicates that the item was accessed without authorization since the seal was applied. Security seals are used on classified storage containers, evidence bags, equipment panels, and sensitive cargo to maintain chain of custody and tamper evidence.
Question 4: What is 'two-person integrity' (TPI) in physical security?
- Having two security guards on duty at all times
- A control requiring two authorized individuals to be present whenever access to highly sensitive materials or areas occurs (Correct answer)
- Using two different types of locks on secure areas
- A requirement for two-factor authentication on all systems
Correct answer: A control requiring two authorized individuals to be present whenever access to highly sensitive materials or areas occurs
TPI requires two authorized individuals to be present simultaneously when accessing, handling, or performing operations on particularly sensitive materials or areas, preventing any single individual from acting unilaterally.
Two-Person Integrity (TPI) is a physical security control that requires a minimum of two authorized individuals to be present simultaneously when handling or accessing certain sensitive materials, systems, or areas. TPI prevents any single individual from having unilateral access to the most sensitive items, reducing the risk of insider theft or sabotage. TPI is commonly required for nuclear materials, cryptographic items, and certain classified operations.
Question 5: What is the significance of 'security zones' in physical security planning?
- Areas designated for security staff breaks
- Defined areas with different security levels and controls that determine what level of access and protection is required in each zone (Correct answer)
- Areas where security cameras are installed
- Zones defined by employee departments
Correct answer: Defined areas with different security levels and controls that determine what level of access and protection is required in each zone
Security zones define areas with different security requirements, ensuring that the most sensitive assets are surrounded by the strongest protective measures while allowing less restricted access to lower-sensitivity areas.
Security zones are defined areas within a facility where different levels of security controls are applied based on the sensitivity of what is being protected. Typically, zones progress from public areas (minimal controls) through administrative areas, controlled areas, restricted areas, to high-security areas (maximum controls). Zoning enables organizations to apply appropriate security resources efficiently and create layered protection for the most critical assets.
Question 6: What is the purpose of a 'security badge' or 'access control card' in physical security?
- To identify employees for payroll purposes only
- To control physical access by verifying identity and authorization, allowing entry only to appropriately authorized individuals (Correct answer)
- To track employee attendance for HR purposes
- To provide employee benefit information
Correct answer: To control physical access by verifying identity and authorization, allowing entry only to appropriately authorized individuals
Security badges and access control cards serve to verify an individual's identity and authorization level, allowing electronic access systems to grant or deny entry to specific areas based on programmed permissions.
Security badges and access control cards are physical security tools that serve dual purposes: they identify the cardholder and encode access permissions that are read by electronic access control systems. When a cardholder presents their badge to a reader, the system checks the encoded permissions and grants or denies access to that specific door or area. Modern systems include credentials that can be rapidly revoked or modified when an employee's status changes.
SFPC Physical Security Measures 3
What is the role of 'physical security surveys' in a security program?