Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

A security analyst at a maritime logistics firm is performing a quantitative risk assessment for an automated port crane control system with an estimated asset value of 400,000.Historicalthreatintelligenceindicatesanannualrateofoccurrence(ARO)of0.25fortargetedransomwareattacksagainstsimilaroperationalinfrastructure.Ifanattacksucceeds,thesinglelossexpectancy(SLE)isestimatedat400,000. Historical threat intelligence indicates an annual rate of occurrence (ARO) of 0.25 for targeted ransomware attacks against similar operational infrastructure. If an attack succeeds, the single loss expectancy (SLE) is estimated at 100,000. A proposed security control consisting of network isolation and endpoint protection costs $15,000 annually to maintain and would reduce the ARO to 0.05. What is the net annual financial benefit of implementing this security safeguard?

  1. $5,000Answer
  2. B
    $10,000
  3. C
    $20,000
  4. D
    $35,000

Answer

The net annual financial benefit of implementing the safeguard is $5,000.
The net annual benefit is derived by subtracting the post-mitigation ALE (5,000)andtheannualsafeguardcost(5,000) and the annual safeguard cost ( 15,000) from the initial ALE (25,000),yieldinganetgainof25,000), yielding a net gain of 5,000.

Step-by-Step Solution

1
Calculate the current Annual Loss Expectancy (ALE_initial)
ALEinitial=SLE×AROinitial=$100,000×0.25=$25,000\text{ALE}_{\text{initial}} = \text{SLE} \times \text{ARO}_{\text{initial}} = \$100,000 \times 0.25 = \$25,000
Determines the baseline expected financial loss per year before implementing any security control.
2
Calculate the post-mitigation Annual Loss Expectancy (ALE_mitigated)
ALEmitigated=SLE×AROnew=$100,000×0.05=$5,000\text{ALE}_{\text{mitigated}} = \text{SLE} \times \text{ARO}_{\text{new}} = \$100,000 \times 0.05 = \$5,000
Determines the residual financial risk remaining per year after implementing the control.
3
Calculate the gross annual loss reduction (ALE savings)
Gross Benefit=ALEinitial−ALEmitigated=$25,000−$5,000=$20,000\text{Gross Benefit} = \text{ALE}_{\text{initial}} - \text{ALE}_{\text{mitigated}} = \$25,000 - \$5,000 = \$20,000
Finds the total financial loss prevented annually by lowering the frequency of successful attacks.
4
Subtract the Annual Cost of Safeguard (ACS) to find Net Annual Benefit
Net Benefit=Gross Benefit−ACS=$20,000−$15,000=$5,000\text{Net Benefit} = \text{Gross Benefit} - \text{ACS} = \$20,000 - \$15,000 = \$5,000
Evaluates whether the safeguard is cost-effective by comparing annual loss savings against recurring annual implementation costs.

Key Concept

Quantitative Risk Assessment and Cost-Benefit Analysis of Controls
Estimated Time:1m 30s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic