Examkin

Question

Difficulty: HardRisk Identification, Assessment, and Response Strategies

An enterprise logistics provider is conducting a quantitative risk assessment for a mission-critical database cluster valued at 2,000,000.ThreatmetricsindicatethataransomwareinfectionresultsinanExposureFactor(EF)of252,000,000. Threat metrics indicate that a ransomware infection results in an Exposure Factor (EF) of 25%, with an unmitigated Annual Rate of Occurrence (ARO) of 0.5. The security team plans to implement an endpoint detection and response (EDR) solution costing 30,000 annually, which is expected to lower the ARO to 0.1 without altering the EF. What is the net annual financial benefit (safeguard value) of implementing this security control?

  1. $170,000Answer
  2. B
    $200,000
  3. C
    $220,000
  4. D
    $470,000

Answer

The net annual financial benefit of implementing the safeguard is $170,000.
The net annual benefit (safeguard value) measures total financial savings generated by a security control after subtracting its operational expense. First, the Single Loss Expectancy (SLE) is computed as $2,000,000×0.25=$500,000\$2,000,000 \times 0.25 = \$500,000. Next, the baseline Annual Loss Expectancy (ALEinitialALE_{initial}) is $500,000×0.5=$250,000\$500,000 \times 0.5 = \$250,000. After applying the safeguard, the post-control Annual Loss Expectancy (ALEmitigatedALE_{mitigated}) becomes $500,000×0.1=$50,000\$500,000 \times 0.1 = \$50,000. Subtracting mitigated ALE from initial ALE yields a gross loss reduction of $200,000\$200,000. Finally, subtracting the $30,000\$30,000 annual safeguard cost results in a net annual financial benefit of $170,000\$170,000.

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLE)
SLE=Asset Value(AV)×Exposure Factor(EF)=$2,000,000×0.25=$500,000SLE = Asset\ Value (AV) \times Exposure\ Factor (EF) = \$2,000,000 \times 0.25 = \$500,000
SLE represents the financial loss incurred each time a single risk event occurs.
2
Calculate Initial Annual Loss Expectancy (ALE_initial)
ALEinitial=SLE×AROinitial=$500,000×0.5=$250,000ALE_{initial} = SLE \times ARO_{initial} = \$500,000 \times 0.5 = \$250,000
Initial ALE establishes the baseline annual monetary loss expected from the threat prior to safeguard implementation.
3
Calculate Mitigated Annual Loss Expectancy (ALE_mitigated)
ALEmitigated=SLE×AROmitigated=$500,000×0.1=$50,000ALE_{mitigated} = SLE \times ARO_{mitigated} = \$500,000 \times 0.1 = \$50,000
Mitigated ALE determines the residual annual expected loss after the safeguard reduces event occurrence frequency.
4
Calculate Net Safeguard Value (Annual Cost-Benefit)
Safeguard Value=(ALEinitial−ALEmitigated)−Annual Safeguard Cost=($250,000−$50,000)−$30,000=$170,000Safeguard\ Value = (ALE_{initial} - ALE_{mitigated}) - Annual\ Safeguard\ Cost = (\$250,000 - \$50,000) - \$30,000 = \$170,000
Net annual financial benefit accounts for both the loss exposure reduction and the ongoing cost of maintaining the control.

Key Concept

Quantitative Risk Analysis & Safeguard Cost-Benefit Value
Estimated Time:2m 0s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic