A manufacturing enterprise is conducting a quantitative risk analysis on a critical indust… — CompTIA Security+

A manufacturing enterprise is conducting a quantitative risk analysis on a critical industrial control system (ICS) server. The server has an estimated Asset Value ( $AV$ ) of $\$120,000$ . A specific malware outbreak is projected to result in an Exposure Factor ( $EF$ ) of $40\%$ . Historical threat intelligence indicates that the Annualized Rate of Occurrence ( $ARO$ ) for this type of attack is $0.5$ . What is the baseline Annualized Loss Expectancy ( $ALE$ ) in dollars for this asset prior to implementing additional countermeasures?

Answer: 24000 USD

Answer

The baseline Annualized Loss Expectancy (ALE) for the industrial control system server is $24,000.

The baseline Annualized Loss Expectancy (ALE) is derived through standard quantitative risk modeling: first, Single Loss Expectancy (SLE) is calculated by multiplying Asset Value (

AV = \$120,000

) by Exposure Factor (

EF = 0.40

), yielding

\$48,000

. Second, ALE is calculated by multiplying SLE (

\$48,000

) by Annualized Rate of Occurrence (

ARO = 0.5

), resulting in an annual loss expectancy of

\$24,000

Step-by-Step Solution

Calculate the Single Loss Expectancy (SLE)

SLE = $48,000

Single Loss Expectancy represents the monetary loss expected each time a threat materializes and is calculated as Asset Value (AV) multiplied by Exposure Factor (EF):

120,000 * 0.40 =

48,000.

Calculate the Annualized Loss Expectancy (ALE)

ALE = $24,000

Annualized Loss Expectancy represents the expected annual financial loss from a specific risk and is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO):

48,000 * 0.5 =

24,000.

Key Concept

Quantitative Risk Assessment - Annualized Loss Expectancy (ALE) Calculation

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic