Examkin

Question

Difficulty: HardRisk Identification, Assessment, and Response Strategies

A healthcare organization is evaluating a Web Application Firewall (WAF) safeguard for its cloud-hosted Patient Portal API. The API system has an estimated Asset Value (AVAV) of $400,000\$400,000. Threat modeling indicates that an unmitigated API breach has an Exposure Factor (EFEF) of 0.500.50 and an Annual Rate of Occurrence (AROARO) of 0.250.25. Deploying the WAF will cost $12,000\$12,000 annually and is projected to reduce the Exposure Factor to 0.100.10, while keeping the AROARO constant. What is the net annual financial benefit of implementing this security safeguard?

  1. A
    $40,000\$40,000
  2. $28,000\$28,000Answer
  3. C
    $38,000\$38,000
  4. D
    $52,000\$52,000

Answer

The net annual financial benefit of implementing the safeguard is $28,000\$28,000.
The net financial benefit of a safeguard is determined by comparing the baseline annual loss expectancy against the post-mitigation annual loss expectancy plus control cost. Baseline ALE=$400,000×0.50×0.25=$50,000ALE = \$400,000 \times 0.50 \times 0.25 = \$50,000. Post-mitigation ALE=$400,000×0.10×0.25=$10,000ALE = \$400,000 \times 0.10 \times 0.25 = \$10,000. Gross risk reduction is $50,000−$10,000=$40,000\$50,000 - \$10,000 = \$40,000. Subtracting the annual safeguard cost of $12,000\$12,000 leaves a net annual benefit of $28,000\$28,000.

Step-by-Step Solution

1
Calculate the initial Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE) prior to safeguard implementation.
Initial SLE=AV×EF=$400,000×0.50=$200,000SLE = AV \times EF = \$400,000 \times 0.50 = \$200,000. Initial ALE=SLE×ARO=$200,000×0.25=$50,000ALE = SLE \times ARO = \$200,000 \times 0.25 = \$50,000.
Quantifying baseline risk exposure before applying controls requires establishing baseline annual loss expectations.
2
Calculate the modified SLE and residual ALE following WAF deployment.
Modified SLE=$400,000×0.10=$40,000SLE = \$400,000 \times 0.10 = \$40,000. Modified (Residual) ALE=$40,000×0.25=$10,000ALE = \$40,000 \times 0.25 = \$10,000.
Determining post-control exposure reflects the remaining annualized risk after control enforcement.
3
Determine annual loss reduction (ALE savings) achieved by the WAF.
ALE Reduction=Initial ALE−Residual ALE=$50,000−$10,000=$40,000ALE \text{ Reduction} = \text{Initial } ALE - \text{Residual } ALE = \$50,000 - \$10,000 = \$40,000.
The gross value of a risk control is the reduction in expected annualized losses.
4
Subtract annual safeguard cost from gross annual loss reduction to find net annual benefit.
Net Benefit=$40,000−$12,000=$28,000\text{Net Benefit} = \$40,000 - \$12,000 = \$28,000.
A safeguard is cost-effective if the net benefit (ALE reduction minus safeguard cost) is positive.

Key Concept

Quantitative Risk Assessment & Cost-Benefit Analysis of Controls (ALE = AV * EF * ARO)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic