Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

A hospital network evaluates the financial exposure associated with a potential ransomware incident targeting its central Picture Archiving and Communication System (PACS) database server cluster. The estimated Asset Value (AVAV) of the PACS cluster is $800,000\$800,000. Threat intelligence and risk assessment analysts determine that a ransomware outbreak would result in an Exposure Factor (EFEF) of 0.350.35 (35%35\%). Historical risk data indicates an Annualized Rate of Occurrence (AROARO) of 0.250.25 for this type of attack. What is the baseline Annualized Loss Expectancy (ALEALE), in US dollars, for the PACS database cluster prior to implementing any additional security controls?

Answer: 70000 USD

Answer

The baseline Annualized Loss Expectancy (ALE) for the PACS cluster is $70,000.
Quantitative risk calculations determine the expected annual financial loss (ALEALE) using two dependent steps: first computing the Single Loss Expectancy (SLE=AV×EF=$800,000×0.35=$280,000SLE = AV \times EF = \$800,000 \times 0.35 = \$280,000), and then scaling by the annual frequency (ALE=SLE×ARO=$280,000×0.25=$70,000ALE = SLE \times ARO = \$280,000 \times 0.25 = \$70,000).

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLE)
SLE=$280,000SLE = \$280,000
Single Loss Expectancy is calculated by multiplying the total Asset Value (AV=$800,000AV = \$800,000) by the Exposure Factor (EF=0.35EF = 0.35).
2
Calculate Annualized Loss Expectancy (ALE)
ALE=$70,000ALE = \$70,000
Annualized Loss Expectancy is calculated by multiplying the Single Loss Expectancy (SLE=$280,000SLE = \$280,000) by the Annualized Rate of Occurrence (ARO=0.25ARO = 0.25).

Key Concept

Quantitative Risk Assessment (ALE Calculation)
Rate this question