Examkin

Question

Difficulty: HardRisk Identification, Assessment, and Response Strategies

A Chief Information Security Officer (CISO) is conducting a quantitative risk assessment for a legacy customer database server with an estimated Asset Value (AVAV) of $600,000\$600,000. Threat metrics indicate an Annual Rate of Occurrence (AROARO) of 0.250.25 for unauthorized data extraction attacks. Without additional security controls, the Exposure Factor (EFEF) for a successful compromise is 0.400.40.

To mitigate this risk, the organization evaluates deploying an Endpoint Detection and Response (EDR) solution combined with network microsegmentation. This countermeasure costs $12,000\$12,000 annually to license and manage, and it reduces the Exposure Factor (EFEF) to 0.050.05 while leaving the AROARO unchanged.

What is the net annual cost benefit of implementing this countermeasure?

  1. $40,500\$40,500Answer
  2. B
    $52,500\$52,500
  3. C
    $138,000\$138,000
  4. D
    $210,000\$210,000

Answer

The net annual cost benefit of implementing the safeguard is $40,500\$40,500.
To calculate net annual cost benefit, compare the baseline annualized risk (ALEpreALE_{pre}) with post-mitigation annualized risk (ALEpostALE_{post}) and control operational expenditure:

1. SLEpre=$600,000×0.40=$240,000SLE_{pre} = \$600,000 \times 0.40 = \$240,000
2. ALEpre=$240,000×0.25=$60,000ALE_{pre} = \$240,000 \times 0.25 = \$60,000
3. SLEpost=$600,000×0.05=$30,000SLE_{post} = \$600,000 \times 0.05 = \$30,000
4. ALEpost=$30,000×0.25=$7,500ALE_{post} = \$30,000 \times 0.25 = \$7,500
5. Net Benefit = ALEpre−ALEpost−Safeguard Cost=$60,000−$7,500−$12,000=$40,500ALE_{pre} - ALE_{post} - \text{Safeguard Cost} = \$60,000 - \$7,500 - \$12,000 = \$40,500.

Thus, implementing the countermeasure yields a net annual financial benefit of $40,500\$40,500.

Step-by-Step Solution

1
Calculate the pre-control Single Loss Expectancy (SLEpreSLE_{pre}) and Annual Loss Expectancy (ALEpreALE_{pre}).
SLEpre=$600,000×0.40=$240,000SLE_{pre} = \$600,000 \times 0.40 = \$240,000; ALEpre=$240,000×0.25=$60,000ALE_{pre} = \$240,000 \times 0.25 = \$60,000.
Determines the baseline expected financial loss per year before implementing controls.
2
Calculate the post-control Single Loss Expectancy (SLEpostSLE_{post}) and Annual Loss Expectancy (ALEpostALE_{post}).
SLEpost=$600,000×0.05=$30,000SLE_{post} = \$600,000 \times 0.05 = \$30,000; ALEpost=$30,000×0.25=$7,500ALE_{post} = \$30,000 \times 0.25 = \$7,500.
Determines the remaining annualized financial risk after applying the countermeasure.
3
Determine the gross risk reduction (ALE savings).
Gross ALE Savings = ALEpre−ALEpost=$60,000−$7,500=$52,500ALE_{pre} - ALE_{post} = \$60,000 - \$7,500 = \$52,500.
Calculates the total financial loss avoided annually by reducing the exposure factor.
4
Subtract the annual cost of the safeguard from the gross ALE savings.
Net Benefit = $52,500−$12,000=$40,500\$52,500 - \$12,000 = \$40,500.
Evaluates the net economic value added by the security control.

Key Concept

Quantitative Risk Assessment and Cost-Benefit Analysis (ALE=AV×EF×AROALE = AV \times EF \times ARO)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic