A logistics organization is performing a quantitative risk assessment for its automated wa… — CompTIA Security+

A logistics organization is performing a quantitative risk assessment for its automated warehouse management system, which has an Asset Value ( $AV$ ) of $\$1,500,000$ . Without additional security controls, a critical cyber attack is estimated to occur once every 2 years ( $ARO = 0.50$ ) with an Exposure Factor ( $EF$ ) of $0.30$ . The cybersecurity team plans to deploy an endpoint detection and response (EDR) platform alongside network microsegmentation controls, which is expected to reduce the $EF$ to $0.05$ and the $ARO$ to $0.10$ . The total annual cost for subscription licensing and maintenance of these controls is $\$45,000$ .

What is the net annual financial value (net benefit in USD) of implementing these security controls?

Answer: 172500 USD

Answer

The net annual financial value of implementing the controls is $172,500 USD.

The net financial value (cost-benefit) of a security control is determined by evaluating the monetary risk reduction achieved minus the annual cost to maintain the control:

(ALE_{\text{prior}} - ALE_{\text{post}}) - \text{Safeguard Cost}

. Baseline

ALE

is calculated as

AV \times EF \times ARO = \$1,500,000 \times 0.30 \times 0.50 = \$225,000

. Residual

ALE

after control implementation is

AV \times EF_{\text{post}} \times ARO_{\text{post}} = \$1,500,000 \times 0.05 \times 0.10 = \$7,500

. The gross risk reduction is

\$225,000 - \$7,500 = \$217,500

. Subtracting the annual safeguard maintenance and subscription cost of

\$45,000

yields a net annual financial benefit of

\$172,500

Step-by-Step Solution

Calculate initial Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) without controls.

SLE_{\text{prior}} = \$1,500,000 \times 0.30 = \$450,000

;

ALE_{\text{prior}} = \$450,000 \times 0.50 = \$225,000

Establishes the organization's initial baseline risk exposure in monetary terms.

Calculate post-control Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE).

SLE_{\text{post}} = \$1,500,000 \times 0.05 = \$75,000

;

ALE_{\text{post}} = \$75,000 \times 0.10 = \$7,500

Determines the expected residual financial risk following mitigation.

Deduct residual ALE and annual safeguard expenses from the baseline ALE to determine net financial benefit.

Net Safeguard Value

= (\$225,000 - \$7,500) - \$45,000 = \$172,500

Evaluates whether the safeguard is cost-effective and quantifies the net savings provided.

Key Concept

Quantitative Risk Analysis and Net Safeguard Cost-Benefit Calculation

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic