Examkin

Question

Difficulty: Very hardRisk Identification, Assessment, and Response Strategies

An organization relies on an Operational Technology (OT) supervisory control and data acquisition (SCADA) system valued at $2,500,000\$2,500,000. Historical threat assessments indicate that an unmitigated industrial ransomware attack has an Exposure Factor (EF) of 60%60\% (0.600.60) and an Annualized Rate of Occurrence (ARO) of 0.200.20 (11 event every 55 years).

To mitigate this risk, the security team proposes deploying an immutable network air-gap and anomaly monitoring safeguard with an annual operating cost of $65,000\$65,000. With this safeguard active, the EF is reduced to 10%10\% (0.100.10) and the ARO is reduced to 0.050.05 (11 event every 2020 years).

What is the net annual cost savings (in USD) achieved by implementing this safeguard?

Answer: 222500 USD

Answer

The net annual cost savings realized by implementing the safeguard is $222,500 USD.
Quantitative risk management evaluates security controls by comparing the annual loss expectancy (ALE) reduction against the control's total annual cost. Pre-mitigation ALE is calculated as AV×EF1×ARO1=$2,500,000×0.60×0.20=$300,000\text{AV} \times \text{EF}_{1} \times \text{ARO}_{1} = \$2,500,000 \times 0.60 \times 0.20 = \$300,000. Post-mitigation ALE is AV×EF2×ARO2=$2,500,000×0.10×0.05=$12,500\text{AV} \times \text{EF}_{2} \times \text{ARO}_{2} = \$2,500,000 \times 0.10 \times 0.05 = \$12,500. The risk reduction benefit is $300,000−$12,500=$287,500\$300,000 - \$12,500 = \$287,500. Subtracting the annual safeguard maintenance fee of $65,000\$65,000 yields a net annual value of $222,500\$222,500.

Step-by-Step Solution

1
Calculate pre-mitigation ALE
Initial ALE = $300,000
Determines the baseline expected financial loss per year before control implementation using ALE = AV * EF * ARO.
2
Calculate post-mitigation ALE
Mitigated ALE = $12,500
Calculates the residual annual expected loss after applying the reduced EF (10%) and reduced ARO (0.05).
3
Calculate gross risk reduction benefit
Gross ALE reduction = $287,500
Subtracts post-mitigation ALE from pre-mitigation ALE to measure total annual loss prevented.
4
Calculate net financial benefit of safeguard
Net annual savings = $222,500
Subtracts the recurring annual cost of the safeguard ($65,000) from the gross ALE reduction.

Key Concept

Quantitative Risk Analysis (ALE calculation and Safeguard Cost-Benefit Evaluation)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic