Examkin

Soru

Zorluk: OrtaRisk Identification, Assessment, and Response Strategies

A municipal water authority operates a SCADA telemetry gateway with an Asset Value (AVAV) of $400,000\$400,000. A quantitative risk assessment identifies that an unmitigated malware attack carries an Exposure Factor (EFEF) of 0.500.50 with an estimated Annual Rate of Occurrence (AROARO) of 0.250.25. The CISO is evaluating an industrial endpoint monitoring control that costs $15,000\$15,000 annually to deploy, which would reduce the Exposure Factor (EFEF) to 0.100.10. What is the net annual financial benefit of implementing this security control?

  1. $25,000\$25,000Cevap
  2. B
    $35,000\$35,000
  3. C
    $40,000\$40,000
  4. D
    $10,000\$10,000

Cevap

The net annual financial benefit of implementing the security control is $25,000\$25,000.
The net annual financial benefit of a security control is determined by calculating the reduction in Annual Loss Expectancy (ΔALE\Delta ALE) and subtracting the annual cost of the countermeasure. Baseline ALE=$400,000×0.50×0.25=$50,000ALE = \$400,000 \times 0.50 \times 0.25 = \$50,000. Post-mitigation ALE=$400,000×0.10×0.25=$10,000ALE = \$400,000 \times 0.10 \times 0.25 = \$10,000. The annual reduction in expected loss is $40,000\$40,000. Subtracting the control's $15,000\$15,000 annual fee yields a net benefit of $25,000\$25,000.

Adım Adım Çözüm

1
Calculate the initial Single Loss Expectancy (SLEinitialSLE_{initial}) and initial Annual Loss Expectancy (ALEinitialALE_{initial})
SLEinitial=$400,000×0.50=$200,000SLE_{initial} = \$400,000 \times 0.50 = \$200,000; ALEinitial=$200,000×0.25=$50,000ALE_{initial} = \$200,000 \times 0.25 = \$50,000
Determines the baseline expected financial loss per year without any security control.
2
Calculate the mitigated Single Loss Expectancy (SLEmitigatedSLE_{mitigated}) and mitigated Annual Loss Expectancy (ALEmitigatedALE_{mitigated})
SLEmitigated=$400,000×0.10=$40,000SLE_{mitigated} = \$400,000 \times 0.10 = \$40,000; ALEmitigated=$40,000×0.25=$10,000ALE_{mitigated} = \$40,000 \times 0.25 = \$10,000
Determines the expected annual loss after deploying the threat monitoring solution.
3
Calculate the net benefit of the control
Net Benefit=(ALEinitial−ALEmitigated)−Annual Cost=($50,000−$10,000)−$15,000=$25,000\text{Net Benefit} = (ALE_{initial} - ALE_{mitigated}) - \text{Annual Cost} = (\$50,000 - \$10,000) - \$15,000 = \$25,000
Subtracts the residual loss and annual safeguard cost from the baseline expected loss to measure financial return.

Anahtar Kavram

Quantitative Risk Assessment (ALE and Safeguard Cost-Benefit Analysis)
Bu soruyu puanla

Konular

Risk Identification, Assessment, and Response Strategies

Bu konudan daha fazla soru