Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

An enterprise risk manager is performing a quantitative risk assessment on a database cluster hosting proprietary research data with an Asset Value (AVAV) of 500,000500,000. Initial threat modeling indicates an Exposure Factor (EFEF) of 0.300.30 per ransomware event, with an estimated Annual Rate of Occurrence (AROARO) of 0.500.50. The Chief Information Security Officer (CISO) is evaluating an automated endpoint containment safeguard costing 20,00020,000 annually, which would reduce the EFEF to 0.100.10 while leaving the AROARO unchanged. What is the net annual cost-benefit (annual loss reduction minus safeguard cost) of deploying this security control?

  1. 30,00030,000 net annual savingsAnswer
  2. B
    50,00050,000 net annual savings
  3. C
    100,000100,000 net annual savings
  4. D
    5,0005,000 net annual savings

Answer

The net annual cost-benefit of implementing the security control is 30,00030,000 in net savings.
The baseline Annual Loss Expectancy (ALEALE) is 75,00075,000 (500,000 Asset Value×0.30 Exposure Factor×0.50 ARO500,000 \text{ Asset Value} \times 0.30 \text{ Exposure Factor} \times 0.50 \text{ ARO}). Deploying the safeguard reduces the EFEF to 0.100.10, yielding a modified ALEALE of 25,00025,000 (500,000×0.10×0.50500,000 \times 0.10 \times 0.50). The annual risk reduction (gross savings) is 50,00050,000 (75,000−25,00075,000 - 25,000). Subtracting the 20,00020,000 annual safeguard deployment cost provides a net annual financial benefit of 30,00030,000.

Step-by-Step Solution

1
Calculate initial Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
SLEinitial=500,000×0.30=150,000SLE_{initial} = 500,000 \times 0.30 = 150,000; ALEinitial=150,000×0.50=75,000ALE_{initial} = 150,000 \times 0.50 = 75,000
Quantifies baseline financial risk exposure prior to applying the control.
2
Calculate post-control SLE and ALE with reduced Exposure Factor
SLEmodified=500,000×0.10=50,000SLE_{modified} = 500,000 \times 0.10 = 50,000; ALEmodified=50,000×0.50=25,000ALE_{modified} = 50,000 \times 0.50 = 25,000
Determines residual risk exposure after implementing the endpoint containment safeguard.
3
Calculate Annual Loss Avoided and Net Cost-Benefit
Loss Avoided = 75,000−25,000=50,00075,000 - 25,000 = 50,000; Net Benefit = 50,000−20,000=30,00050,000 - 20,000 = 30,000
Subtracts the annual safeguard cost from the annualized financial loss reduction to determine net value.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic