Single loss expectancy: The expected monetary loss every time a risk occurs is called the Single Loss Expectancy. The Single Loss Expectancy (SLE), Exposure Factor (EF) and Asset Value (AV) are related by the formula: SLE = EF * AV Introducing this conceptual breakdown of Single Loss Expectancy into Exposure Factor and Asset Value allows us to adjust the two terms independently and is related to risk management and risk assessment. Asset Value may vary with market changes, inflation while Exposure Factor can be reduced by enabling preventive measures. Annualized loss expectancy: The product of the single loss expectancy (SLE) and the annual rate of occurrence (ARO) give annualized loss expectancy (ALE). It is mathematically expressed as: ALE = SLE * ARO The important feature of Annualized Loss Expectancy is that it can be used directly in a cost- benefit analysis.

Question

Assume a year has passed and XYZ has improved its security. Using the following table, calculate the SLE, ARO, and ALE for each threat category listed. YXZ Software Company (Asset Value: $1,200,000 Threat Category Cost per Incident Frequency of Occurrence Cost of Controls Type of Control Programmer mistakes $5,000 1 per month $20,000 Training Loss of intellectual property $75,000 1 per 2 years $15,000 Firewall/IDS Software piracy $500 1 per month $30,000 Firewall/IDS Theft of information (hacker) $2,500 1 per 6 months $15,000 Firewall/IDS Threat of information (employees) $5,00 1 per year $15,000 Physical security Web defacement $500 1 per quarter $10,000 Firewall Theft of equipment $5,000 1 per 2 years $15,000 Physical security Viruses, worms, Trojan horses $1,500 1 per month $15,000 Antivirus Denial-of-service attack $2,500 1 per 6 months $10,000 Firewall…

Answer 1

Question

Chapter 7, Problem 4E

Program Plan Intro

Single loss expectancy:

The expected monetary loss every time a risk occurs is called the Single Loss Expectancy.

The Single Loss Expectancy (SLE), Exposure Factor (EF) and Asset Value (AV) are related by the formula:

SLE = EF * AV

Introducing this conceptual breakdown of Single Loss Expectancy into Exposure Factor and Asset Value allows us to adjust the two terms independently and is related to risk management and risk assessment.

Asset Value may vary with market changes, inflation while Exposure Factor can be reduced by enabling preventive measures.

Annualized loss expectancy:

The product of the single loss expectancy (SLE) and the annual rate of occurrence (ARO) give annualized loss expectancy (ALE).

It is mathematically expressed as:

ALE = SLE * ARO

The important feature of Annualized Loss Expectancy is that it can be used directly in a cost- benefit analysis.

Expert Solution & Answer

Trending nowThis is a popular solution!

See solution

Check out sample textbook solution

Students have asked these similar questions

Assume a year has passed and XYZ has improved its security. Using the following table, calculate the SLE, ARO, and ALE for each threat category listed. YXZ Software Company (Asset Value: $1,200,000 Threat Category Cost per Incident Frequency of Occurrence Cost of Controls Type of Control Programmer mistakes $5,000 1 per month $20,000 Training Loss of intellectual property $75,000 1 per 2 years $15,000 Firewall/IDS Software piracy $500 1 per month $30,000 Firewall/IDS Theft of information (hacker) $2,500 1 per 6 months $15,000 Firewall/IDS Threat of information (employees) $5,00 1 per year $15,000 Physical security Web defacement $500 1 per quarter $10,000 Firewall Theft of equipment $5,000 1 per 2 years $15,000 Physical security Viruses, worms, Trojan horses $1,500 1 per month $15,000 Antivirus Denial-of-service attack $2,500 1 per 6 months $10,000 Firewall…

How do you decide which vulnerabilities are most critical?

In this section, you will prepare a risk mitigation plan using SimpleRisk. Before using SimpleRisk, you will create a paper-based plan. You will need to create three security controls in your risk mitigation plan: one control that reduces the asset value, one that reduces the vulnerability severity, and one that reduces the threat impact. Your security controls should also include examples of both strategic and tactical controls. You can refer to the following table for a clearer picture of the requirements. Security Control Reduces Level (strategic/tactical) Asset value Vulnerability severity Threat Impact Define three security controls designed to mitigate the risk associated with a recent leak of sensitive information that was stored in cleartext files. Once you have identified your security controls, use SimpleRisk to create a Risk Mitigation plan. You do not need to perform a management review in this section.