14.4 Security Audits, Verification of Findings, Countermeasure Selection, and Cost-Benefit Analysis

14.4 Security Audits, Verification of Findings, Countermeasure Selection, and Cost-Benefit Analysis

The Security Assessment area (10% of the exam) runs from threat assessment through recovery planning. Section 14.2 covers threat and vulnerability assessment and Section 14.3 covers disaster recovery. This section covers the middle of the process, four blueprint tasks: participate in a security audit (building inspections, security surveys, security analysis), verify audit findings against the assessment objectives, identify countermeasures (physical, electronic, organizational), and coordinate cost/benefit, feasibility, and present value studies.

---

Performing the Security Audit

A security audit gathers evidence about how well the facility is protected today. It has three parts.

1. Building Inspection

Walk the layers from the property line to the cabinet (Section 13.1). Check fences, gates, vehicle barriers, lighting, building openings, roof hatches, louvers and culverts larger than about 96 in² (620 cm²), door construction, hinges and locks, slab-to-slab walls, ceiling and raised-floor voids, and cage roofs. Record each observation with photographs and locations.

2. Security Survey

The survey is a structured review using checklists based on the client's security plan and the relevant standards. ANSI/BICSI 002 Section 12 defines what a data center security plan should cover; NFPA 730 (Guide for Premises Security) and ASIS International standards give further criteria. Survey activities include:

• Interviews with security officers, operations staff, and managers about procedures and known problems.
• Document review: security policies, visitor and escort records, key and credential management, guard post orders, and incident reports.
• System review: access control configuration and logs, camera coverage and recording retention, intrusion alarm zones, and alarm response records.
• Observation and testing: night lighting checks, door-forced and door-held alarm tests, tailgating tests, and response-time drills, all authorized in writing beforehand.

3. Security Analysis

The analysis compares what the inspection and survey found with the threat assessment (Section 14.2) and the security objectives. It identifies where protection falls short, which threats each gap exposes, and how serious the resulting risk is.

---

Verifying Findings Against the Assessment Objectives

The blueprint asks the consultant to verify audit findings against the assessment objectives: ascertain the security status, the current state, and the protection levels. Verification turns observations into defensible findings:

1. Confirm the facts with evidence. A camera that looked dead may simply have been in a privacy mode. Check logs, test the device, or repeat the observation.
2. Trace each finding to an objective. For example: "Objective: all computer room entries are individually logged and restricted to authorized staff. Finding: the secondary data hall door logs the badge but its maglock releases on the request-to-exit sensor from outside."
3. Compare current and required protection levels. State what the plan requires, what exists, and the gap.
4. Identify the root cause. A propped door may reflect a missing door alarm, a broken closer, or a culture problem. The countermeasure depends on which.
5. Rate the risk using threat, vulnerability, and impact (Section 14.2), and record any risk the client chooses to accept.
6. Review with operations before the report is issued, so findings are accurate and nothing is a surprise.

---

Selecting Countermeasures

Countermeasures fall into three groups:

Good designs layer them so each layer deters, detects, delays, or supports response, and the total delay exceeds detection plus response time (Section 13.1). Organizational measures often fix root causes that hardware cannot, and life-safety codes limit some physical choices: an egress door cannot be locked in a way that traps occupants (Section 13.3).

---

Cost-Benefit, Feasibility, and Present Value

Annualized Loss Expectancy

$SLE = AV \times EF \qquad ALE = SLE \times ARO$

• $AV$ = asset value, including business interruption cost
• $EF$ = exposure factor, the fraction of value lost in one event
• $SLE$ = single loss expectancy
• $ARO$ = annual rate of occurrence
• $ALE$ = annualized loss expectancy

A countermeasure's annual benefit is the reduction in ALE it achieves: $ALE_{\text{before}} - ALE_{\text{after}}$.

Present Value

Compare the upfront cost with the stream of net benefits over the countermeasure's life:

$NPV = \sum_{t=1}^{n} \frac{B_t - C_t}{(1+r)^t} - C_0$

where $B_t$ is the yearly benefit, $C_t$ the yearly operating cost, $C_0$ the initial cost, and $r$ the discount rate.

Worked Example: Protecting the Generator Yard

The generator yard sits beside a public road. The consultant estimates the value at risk, including equipment and business interruption, at 8 million USD, with an exposure factor of 0.5 for a vehicle-ramming event and an annual rate of occurrence of 0.02.

$SLE = 8{,}000{,}000 \times 0.5 = 4{,}000{,}000\text{ USD} \qquad ALE = 4{,}000{,}000 \times 0.02 = 80{,}000\text{ USD/year}$

Option 1: crash-rated bollards. Installed cost 450,000 USD, maintenance 5,000 USD per year, 20-year life. They cut the ARO to 0.002, so the ALE falls to 8,000 USD.

$\text{Net annual benefit} = (80{,}000 - 8{,}000) - 5{,}000 = 67{,}000\text{ USD}$

$PV = 67{,}000 \times \frac{1 - 1.07^{-20}}{0.07} = 67{,}000 \times 10.594 \approx 709{,}800\text{ USD}$

$NPV = 709{,}800 - 450{,}000 \approx 259{,}800\text{ USD (positive)}$

Option 2: an added guard patrol. It costs 120,000 USD a year and halves the ARO to 0.01, cutting ALE by 40,000 USD a year. The yearly cost exceeds the yearly benefit, so the NPV is negative.

The bollards are justified; the patrol is not, at least for this threat. The analysis must also pass feasibility checks: Can the bollards fit without blocking fuel truck access? Do local permits allow them? Can they be installed without an outage? Some risks, especially to life safety, are addressed regardless of the financial result.

---

Common Exam Traps & DCDC Pitfalls

• Reporting unverified observations: Every finding needs evidence and a link to an assessment objective.
• Confusing ALE and SLE: SLE is the loss from one event; ALE is the expected loss per year.
• Comparing nominal costs: Discount benefits and costs over the countermeasure's life before deciding.
• Ignoring organizational controls: Policies, training, and staffing often fix the root cause more cheaply than hardware.
• Letting cost override life safety: Financial analysis supports decisions; it does not permit unsafe egress or unprotected people.