PSAP flashcards
PSAP · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Access control decision elements
- Identification is the claimed identity, authentication is the proof, authorization is the permission granted, and accountability is the recorded audit trail of the decision and action.
- Annualized loss expectancy
- ALE equals single loss expectancy multiplied by annualized rate of occurrence. It converts qualitative risk into a monetary figure used to justify a control's cost.
- Defense in depth
- Layering deterrence, delay, detection, assessment, and response so that failure of one barrier does not defeat the whole system. Each layer covers another's weakness.
- Least privilege
- Granting each credential holder only the access needed for their role, reviewed on a defined cycle. It limits insider risk and the blast radius of a compromised credential.
- Role-based access control
- Permissions are grouped into roles tied to job functions, and users are assigned roles rather than individual door rights. Changes follow role changes, simplifying review and revocation.
- Intelligent controller
- A door-level panel that stores the local access database and schedules and makes grant or deny decisions without the host. It continues operating during network outages.
- Request-to-exit device
- A sensor or switch (push button, PIR, or integrated REX) that signals the controller to release the lock for egress. It prevents a valid exit from generating a forced-door alarm.
- Door position switch
- A reed or Hall-effect contact that reports whether the door is open or closed. The controller uses it to detect held doors and forced doors and to supervise the opening.
- OSDP protocol
- A bidirectional serial protocol between reader and controller that supports encrypted secure channel, tamper reporting, and reader configuration. It replaces one-way Wiegand for higher assurance.
- End-of-line resistor
- A resistor placed at the far end of a supervised circuit so the panel can distinguish normal, alarm, open, and short conditions. It detects cut or shorted wiring.
- Wiegand interface
- A one-way clock-and-data reader interface transmitting the credential number in clear, typically 26 to 40 bits. It cannot authenticate the card, so cloning and replay are possible.
- High-frequency smart card
- A 13.56 MHz credential supporting mutual authentication and encrypted sectors, such as MIFARE DESFire or SEOS-class cards. It resists cloning better than 125 kHz proximity cards.
- Crossover error rate
- The point where a biometric system's false accept rate equals its false reject rate. A lower crossover error rate indicates a more accurate matcher at the chosen threshold.
- Anti-passback
- A rule preventing a credential from entering twice without an intervening exit. It may be hard (deny), soft (allow with log), or time-based (reset after an interval).
- Multi-factor authentication
- Combining at least two different factor types: something you know, something you have, or something you are. Two credentials of the same type do not qualify.
- Fail-safe lock
- A lock that unlocks when power is lost, such as a maglock or electric strike on an egress path. Life-safety egress normally requires fail-safe release on alarm or outage.
- Fail-secure lock
- A lock that remains locked when power is lost, such as some electric bolt locks. It protects the asset during outage but must not be used where free egress is required.
- Maglock holding force
- The electromagnetic holding strength rated in pounds, commonly 600 to 1,200. It requires a request-to-exit device and a code-compliant means of release on the egress side.
- Electric strike
- A strike plate replacement that releases the latch on a signal. It requires the door to be latched and is unsuitable where the frame cannot be modified or positive latching must be maintained.
- Held-door alarm
- An alarm generated when a door remains open beyond a programmable time after a valid grant. It detects propped doors and tailgating and is reported to monitoring.
- Fire alarm release interface
- A supervised relay from the fire alarm system that releases access-controlled egress doors on alarm. It is part of the fire system and is tested during commissioning.
- Door schedule
- A design document listing each opening with its credential group, schedule, hardware type, and monitoring requirement. It becomes the basis for the bill of materials.
- Commissioning test
- Per-door verification of grant, deny, request-to-exit, door position, forced and held alarms, fire release, and power-fail behavior, recorded and signed off before handover.
- As-built documentation
- Final records including door schedules, wiring diagrams, IP addressing, controller configuration exports, and credential group definitions. They are essential for maintenance and audit.
- Network segmentation for PACS
- Placing controllers and readers on a dedicated VLAN with access control lists limiting traffic to the host server and management systems, with no direct internet exposure.
- OSDP Secure Channel
- An encrypted, authenticated mode of the OSDP reader-to-controller protocol. It prevents eavesdropping and replay that are possible with clear-text Wiegand transmission.
- Default credential change
- Replacing vendor default passwords and accounts on controllers and hosts before commissioning. Unchanged defaults are a leading cause of PACS compromise.
- Log correlation with NTP
- Synchronizing PACS, video, and network devices to a common time source so authentication events and door alarms align with recorded video during investigation.
- Forced-door alarm
- An alarm generated when a door opens without a valid grant or request-to-exit. It indicates intrusion or tailgating and triggers a defined monitoring response.
- Credential lifecycle
- Issuance, activation, suspension, reissue on loss, and termination on separation. Terminated credentials are removed from controller databases, not only from the host.
- Access review
- Periodic reconciliation of the credential database against the authoritative HR roster. Orphaned and duplicate accounts are removed and the review is documented for audit.
- NFPA 101 egress rule
- Doors must be openable from the egress side without a key or special knowledge. Access-controlled egress doors must release on fire alarm or power loss per the code edition.
- PIV credential standard
- FIPS 201, issued under HSPD-12, defines the federal Personal Identity Verification credential. It is widely referenced for high-assurance identity proofing and credentialing.