Examkin

Question

Difficulty: HardRisk Identification, Assessment, and Response Strategies

A logistics enterprise operates an automated fleet dispatch server with an Asset Value (AVAV) of $300,000\$300,000. Historical security data indicates that severe malware incidents impact this server once every four years (ARO=0.25ARO = 0.25), resulting in an Exposure Factor (EFEF) of 60%60\%. To mitigate this risk, the organization plans to deploy an Endpoint Detection and Response (EDR) control that will reduce the Exposure Factor (EFEF) to 10%10\%, while the AROARO remains unchanged. The total annual cost to license and maintain the EDR solution is $12,000\$12,000. What is the net annual financial benefit (in USD) of implementing the EDR safeguard?

Answer: 25500 USD

Answer

The net annual financial benefit of implementing the EDR safeguard is $25,500 USD.
Quantitative risk analysis uses standard formulas: Single Loss Expectancy (SLE=AV×EFSLE = AV \times EF) and Annualized Loss Expectancy (ALE=SLE×AROALE = SLE \times ARO). Prior to implementing the EDR safeguard, baseline SLE=$300,000×0.60=$180,000SLE = \$300,000 \times 0.60 = \$180,000, yielding a baseline ALE=$180,000×0.25=$45,000ALE = \$180,000 \times 0.25 = \$45,000. With EDR deployed, the modified EFEF of 10%10\% results in a modified SLE=$300,000×0.10=$30,000SLE = \$300,000 \times 0.10 = \$30,000 and a modified ALE=$30,000×0.25=$7,500ALE = \$30,000 \times 0.25 = \$7,500. The annual loss reduction achieved by the safeguard is $45,000−$7,500=$37,500\$45,000 - \$7,500 = \$37,500. Subtracting the annual safeguard maintenance and license fee of $12,000\$12,000 yields a net annual financial benefit of $25,500\$25,500.

Step-by-Step Solution

1
Compute baseline Single Loss Expectancy (SLE)
SLEbaseline=$300,000×0.60=$180,000SLE_{baseline} = \$300,000 \times 0.60 = \$180,000
Determines the financial loss incurred from a single unmitigated malware incident.
2
Compute baseline Annualized Loss Expectancy (ALE)
ALEbaseline=$180,000×0.25=$45,000ALE_{baseline} = \$180,000 \times 0.25 = \$45,000
Calculates expected annual losses prior to control deployment.
3
Compute modified Single Loss Expectancy (SLE)
SLEmodified=$300,000×0.10=$30,000SLE_{modified} = \$300,000 \times 0.10 = \$30,000
Determines loss severity per incident after EDR control installation.
4
Compute modified Annualized Loss Expectancy (ALE)
ALEmodified=$30,000×0.25=$7,500ALE_{modified} = \$30,000 \times 0.25 = \$7,500
Calculates expected annual losses with the control active.
5
Compute annual risk mitigation savings
Gross Savings = $45,000−$7,500=$37,500\$45,000 - \$7,500 = \$37,500
Measures total financial exposure avoided annually.
6
Compute net annual financial benefit
Net Benefit = $37,500−$12,000=$25,500\$37,500 - \$12,000 = \$25,500
Subtracts recurring safeguard maintenance cost from gross annual savings.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis (ALE & Net Benefit)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic