Examkin

Question

Difficulty: HardRisk Identification, Assessment, and Response Strategies

A healthcare SaaS vendor maintains an electronic prescribing API valued at $800,000\$800,000. A security assessment identifies an unmitigated software vulnerability with an Exposure Factor (EFEF) of 0.350.35 and an Annual Rate of Occurrence (AROARO) of 0.500.50. To address this risk, the organization evaluates an inline security control with an annual recurring operating expense of $30,000\$30,000. Implementing this control will reduce the EFEF to 0.050.05 and the AROARO to 0.100.10. What is the net annual financial benefit of implementing this security control?

  1. $106,000\$106,000Answer
  2. B
    $136,000\$136,000
  3. C
    $110,000\$110,000
  4. D
    $250,000\$250,000

Answer

The net annual financial benefit of implementing the security control is $106,000\$106,000.
The value of $106,000\$106,000 represents the true net annual financial benefit. Baseline ALEALE is $140,000\$140,000 (800,000×0.35×0.50800,000 \times 0.35 \times 0.50) and mitigated ALEALE is $4,000\$4,000 (800,000×0.05×0.10800,000 \times 0.05 \times 0.10), yielding a gross loss reduction of $136,000\$136,000. Subtracting the $30,000\$30,000 annual safeguard cost yields a net benefit of $106,000\$106,000.

Step-by-Step Solution

1
Calculate initial Single Loss Expectancy (SLEinitialSLE_{initial}) and Annual Loss Expectancy (ALEinitialALE_{initial})
SLEinitial=$800,000×0.35=$280,000SLE_{initial} = \$800,000 \times 0.35 = \$280,000; ALEinitial=$280,000×0.50=$140,000ALE_{initial} = \$280,000 \times 0.50 = \$140,000
Quantitative risk analysis requires establishing baseline annual expected loss prior to mitigation.
2
Calculate mitigated Single Loss Expectancy (SLEmitigatedSLE_{mitigated}) and Annual Loss Expectancy (ALEmitigatedALE_{mitigated})
SLEmitigated=$800,000×0.05=$40,000SLE_{mitigated} = \$800,000 \times 0.05 = \$40,000; ALEmitigated=$40,000×0.10=$4,000ALE_{mitigated} = \$40,000 \times 0.10 = \$4,000
Determine the residual risk exposure following control implementation.
3
Calculate gross Annual Loss Reduction
Gross Risk Reduction=ALEinitial−ALEmitigated=$140,000−$4,000=$136,000\text{Gross Risk Reduction} = ALE_{initial} - ALE_{mitigated} = \$140,000 - \$4,000 = \$136,000
Identify total annual financial loss avoided due to the reduced exposure factor and frequency.
4
Calculate Net Annual Benefit
Net Benefit=Gross Risk Reduction−Annual Control Cost=$136,000−$30,000=$106,000\text{Net Benefit} = \text{Gross Risk Reduction} - \text{Annual Control Cost} = \$136,000 - \$30,000 = \$106,000
Subtract recurring operational expense of the safeguard to determine net return on security investment.

Key Concept

Quantitative Risk Analysis (ALE and Safeguard Cost-Benefit Calculation)
Estimated Time:2m 0s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic