A financial technology enterprise evaluates a security countermeasure for its core transac… — CompTIA Security+

A financial technology enterprise evaluates a security countermeasure for its core transaction processing portal, which has an Asset Value ( $AV$ ) of $\$4,500,000$ . Prior to implementing the safeguard, quantitative risk assessment indicates an Exposure Factor ( $EF$ ) of $0.30$ and an Annualized Rate of Occurrence ( $ARO$ ) of $0.80$ .

To mitigate potential impact, the security team deploys a high-availability cloud mitigation service costing $\$48,000$ annually. With this safeguard active, the Exposure Factor ( $EF$ ) drops to $0.05$ , but automated threat scanning raises the effective Annualized Rate of Occurrence ( $ARO$ ) to $1.25$ .

What is the net annual cost benefit (net safeguard value in USD) realized by deploying this cloud mitigation service?

Answer: 750750 USD

Answer

The net annual cost benefit realized by deploying the safeguard is $750,750 USD.

The correct calculation evaluates the financial return on security controls by determining the net reduction in annual loss expectancy minus operational costs. Baseline ALE (

4,500,000 * 0.30 * 0.80 =

1,080,000) minus residual ALE (

4,500,000 * 0.05 * 1.25 =

281,250) gives a gross risk reduction of

798,750. Subtracting the annual safeguard cost (

48,000) yields a net financial benefit of $750,750.

Step-by-Step Solution

Calculate initial pre-control quantitative metrics (SLE and ALE)

SLE_initial =

1,350,000; ALE_initial =

1,080,000

Establishing baseline annual risk exposure requires multiplying the baseline asset value by initial exposure factor and initial annualized frequency.

Calculate post-control quantitative metrics (SLE and ALE)

SLE_modified =

225,000; ALE_modified =

281,250

Evaluating post-control risk requires accounting for both reduced loss severity (lower EF) and increased threat attempt frequency (higher ARO).

Determine gross annual loss expectancy reduction

Gross Loss Reduction = $798,750

Subtracting post-control ALE from pre-control ALE establishes the total financial risk avoided.

Calculate net safeguard value

Net Benefit = $750,750

Subtracting the annual operating expense of the safeguard ($48,000) from the gross loss reduction yields the true economic value of the security investment.

Key Concept

Quantitative Risk Assessment and Net Safeguard Value Calculation

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic