Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

A regional healthcare provider is performing a quantitative risk assessment for its web-based patient telemetry portal. The asset value (AVAV) of the portal infrastructure is estimated at $800,000\$800,000. A threat assessment projects that a web application breach occurs once every two years (ARO=0.5ARO = 0.5), with an estimated Exposure Factor (EFEF) of 25%25\% per incident. To mitigate this risk, the organization evaluates a Web Application Firewall (WAF) service costing $30,000\$30,000 annually, which is expected to reduce the Exposure Factor to 5%5\%. Based on quantitative risk analysis principles, what is the net annual financial benefit of implementing this security safeguard?

  1. $50,000\$50,000Answer
  2. B
    $80,000\$80,000
  3. C
    $130,000\$130,000
  4. D
    $110,000\$110,000

Answer

The net annual financial benefit of implementing the Web Application Firewall safeguard is $50,000\$50,000.
The net annual financial benefit of a safeguard is determined by calculating the difference between baseline Annual Loss Expectancy (ALEbaseline=$800,000×0.25×0.5=$100,000ALE_{baseline} = \$800,000 \times 0.25 \times 0.5 = \$100,000) and modified Annual Loss Expectancy (ALEmodified=$800,000×0.05×0.5=$20,000ALE_{modified} = \$800,000 \times 0.05 \times 0.5 = \$20,000), then subtracting the annual cost of the control ($80,000−$30,000=$50,000\$80,000 - \$30,000 = \$50,000).

Step-by-Step Solution

1
Calculate baseline Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE) without the safeguard.
Baseline SLE=AV×EF=$800,000×0.25=$200,000\text{Baseline SLE} = AV \times EF = \$800,000 \times 0.25 = \$200,000; Baseline ALE=SLE×ARO=$200,000×0.5=$100,000\text{Baseline ALE} = \text{SLE} \times ARO = \$200,000 \times 0.5 = \$100,000.
Establishing baseline annual risk cost is necessary before measuring safeguard value.
2
Calculate modified SLE and ALE with the safeguard in place.
Modified SLE=$800,000×0.05=$40,000\text{Modified SLE} = \$800,000 \times 0.05 = \$40,000; Modified ALE=$40,000×0.5=$20,000\text{Modified ALE} = \$40,000 \times 0.5 = \$20,000.
Determines the projected annual risk cost after applying control mitigations.
3
Calculate the gross annual risk reduction and net benefit.
ALE Reduction=$100,000−$20,000=$80,000\text{ALE Reduction} = \$100,000 - \$20,000 = \$80,000; Net Benefit=ALE Reduction−Safeguard Cost=$80,000−$30,000=$50,000\text{Net Benefit} = \text{ALE Reduction} - \text{Safeguard Cost} = \$80,000 - \$30,000 = \$50,000.
The true value of a safeguard subtracts its ongoing annual expense from the gross annual loss reduction.

Key Concept

Quantitative Risk Analysis & Net Value of Safeguards (ALE = SLE * ARO)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic