An organization is conducting a quantitative risk assessment for an operational technology… — CompTIA Security+

An organization is conducting a quantitative risk assessment for an operational technology (OT) historian database with an Asset Value ( $AV$ ) of $\$600,000$ . Historical telemetry indicates an Annual Rate of Occurrence ( $ARO$ ) of $0.5$ for ransomware incidents targeting this segment, with an estimated Exposure Factor ( $EF$ ) of $60\%$ . The security team proposes installing an air-gapped data diode and automated offline snapshot vault, which carries an annual maintenance and licensing cost of $\$18,000$ . This safeguard is expected to reduce the $EF$ to $10\%$ , though heightened network scanning associated with the diode's monitoring system increases the overall $ARO$ slightly to $0.6$ . What is the net annual monetary benefit (safeguard value) of implementing this countermeasure?

A net annual financial savings of $126,000Cevap
B
A net annual financial savings of $144,000
C
A net annual financial savings of $132,000
D
A net annual loss of $18,000, indicating the safeguard is cost-ineffective

Cevap

Implementing the safeguard provides a net annual monetary benefit of $126,000.

The baseline

ALE

is calculated as

AV \times EF \times ARO = \$600,000 \times 0.60 \times 0.5 = \$180,000

. Following safeguard deployment, the modified

ALE

becomes

\$600,000 \times 0.10 \times 0.6 = \$36,000

. The resulting annual loss reduction is

\$180,000 - \$36,000 = \$144,000

. Subtracting the annual safeguard maintenance fee of

\$18,000

leaves a positive net annual benefit of

\$126,000

Adım Adım Çözüm

Calculate initial Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)

SLE_{initial} = \$600,000 \times 0.60 = \$360,000

;

ALE_{initial} = \$360,000 \times 0.5 = \$180,000

Establishing baseline quantitative loss metrics before safeguard deployment.

Calculate modified Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE) post-safeguard

SLE_{modified} = \$600,000 \times 0.10 = \$60,000

;

ALE_{modified} = \$60,000 \times 0.6 = \$36,000

Determining residual financial risk given the updated exposure factor and annual rate of occurrence.

Calculate gross annual loss reduction (ALE savings)

\Delta ALE = \$180,000 - \$36,000 = \$144,000

Quantifying the financial risk avoided per year by applying the control.

Calculate net safeguard value (Cost-Benefit Analysis)

Net\ Safeguard\ Value = \$144,000 - \$18,000 = \$126,000

Deducting annual countermeasure maintenance costs from gross risk reduction.

Anahtar Kavram

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru