Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

An e-commerce enterprise hosts a customer transaction database valued at $500,000. Security metrics indicate that a successful SQL injection attack has an Exposure Factor (EF) of 0.15, and threat intelligence data estimates the Annualized Rate of Occurrence (ARO) for this threat vector to be 0.40. What is the Annualized Loss Expectancy (ALE) in dollars for this database asset?

Answer: 30000 $

Answer

The Annualized Loss Expectancy (ALE) for the database asset is $30,000.
The Annualized Loss Expectancy (ALE) is determined by first computing Single Loss Expectancy (SLE=AV×EF\text{SLE} = \text{AV} \times \text{EF}) and then scaling it by the occurrence rate (ALE=SLE×ARO\text{ALE} = \text{SLE} \times \text{ARO}). With an Asset Value of 500,000andanEFof0.15,theSLEis500,000 and an EF of 0.15, the SLE is 75,000. Multiplying 75,000byanAROof0.40yieldsanALEof75,000 by an ARO of 0.40 yields an ALE of 30,000.

Step-by-Step Solution

1
Calculate the Single Loss Expectancy (SLE)
SLE = $75,000
SLE measures the monetary loss expected each time a risk event occurs, calculated by multiplying the total Asset Value ($500,000) by the Exposure Factor (0.15).
2
Calculate the Annualized Loss Expectancy (ALE)
ALE = $30,000
ALE calculates the yearly financial impact of the threat by multiplying the Single Loss Expectancy ($75,000) by the Annualized Rate of Occurrence (0.40).

Key Concept

Quantitative Risk Analysis (ALE = AV * EF * ARO)
Estimated Time:1m 30s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic