A chief information security officer (CISO) is evaluating a proposed security safeguard fo… — CompTIA Security+

A chief information security officer (CISO) is evaluating a proposed security safeguard for an enterprise web application valued at $\$1,200,000$ . Threat intelligence and audit history indicate an Annual Rate of Occurrence ( $ARO$ ) of $0.5$ for major security breach attempts, with a current Exposure Factor ( $EF$ ) of $40\%$ . The proposed security control requires an annual subscription and maintenance cost of $\$45,000$ and is projected to reduce the Exposure Factor ( $EF$ ) to $10\%$ , while the $ARO$ remains unchanged. What is the net annual financial benefit of implementing this safeguard?

A
$\$180,000$
$\$135,000$ Answer
C
$\$60,000$
D
$\$315,000$

Answer

The net annual financial benefit of implementing the safeguard is

\$135,000

To calculate net annual financial benefit, compare initial Annual Loss Expectancy (

ALE_{prior}

) against post-control Annual Loss Expectancy (

ALE_{post}

) plus annual control cost. Initial

ALE = \$1,200,000 \times 0.40 \times 0.5 = \$240,000

. Post-control

ALE = \$1,200,000 \times 0.10 \times 0.5 = \$60,000

. Gross risk reduction is

\$240,000 - \$60,000 = \$180,000

. Subtracting the

\$45,000

annual safeguard cost leaves a net annual benefit of

\$135,000

Step-by-Step Solution

Calculate the baseline Single Loss Expectancy (

SLE_{prior}

) and Annual Loss Expectancy (

ALE_{prior}

)

SLE_{prior} = \$1,200,000 \times 0.40 = \$480,000

;

ALE_{prior} = \$480,000 \times 0.5 = \$240,000

Establishing the initial unmitigated annual financial risk before implementing security controls.

Calculate the post-mitigation Single Loss Expectancy (

SLE_{post}

) and Annual Loss Expectancy (

ALE_{post}

)

SLE_{post} = \$1,200,000 \times 0.10 = \$120,000

;

ALE_{post} = \$120,000 \times 0.5 = \$60,000

Determining the residual annual loss expected after the safeguard reduces the Exposure Factor.

Calculate the gross annual risk reduction

Gross Loss Reduction

= ALE_{prior} - ALE_{post} = \$240,000 - \$60,000 = \$180,000

Determining the total annual loss prevented by the control.

Deduct the annual cost of the safeguard to determine net annual financial benefit

Net Benefit

= \$180,000 - \$45,000 = \$135,000

Determining whether the safeguard is cost-effective by weighing risk reduction against control maintenance expenses.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic