Academic Integrity: tutoring, explanations, and feedback — we don’t complete graded work or submit on a student’s behalf.

1. If an organization has three information assets to evaluate for risk manageme

ID: 3769048 • Letter: 1

Question

1. If an organization has three information assets to evaluate for risk management as shown in the accompanying data, which vulnerability should be evaluated for additional controls first? Which one should be evaluated last?

Asset A: Switch L47 connects a network to the Internet. It has two vulnerabilities. It is susceptible to hardware failure at a likelihood of 0.2 and is subject to an SNMP buffer overflow attack at a likelihood of 0.1. The switch has an impact rating of 90 and no current controls in place. You are 75% certain of the assumptions and data

Asset B: Sever WebSrv6 hosts a company Web site and performs e-commerce transactions. It has a Web server version that can be attacked by sending it invalid Unicode values. The likelihood of that attack is estimated at 0.1. The server has been assigned an impact value of 100, and a control has been implanted that reduces the impact of the vulnerability by 75%. You are 80% certain of the assumptions and data.

Asset C: Operators use an MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 0.1. There are no controls in place on this asset; it has an impact rating of 5. You are 90% certain of the assumptions and data.

3. Suppose XYZ Software Company has a new application development project, with projected revenues of $1,200,000. Using the following table, calculate the ARO and ALE for each threat category that XYZ Software Company faces for this project:

Threat Category

Cost per Incident

(SLE)

Frequency of Occurrence

Programmer mistakes

$5,000

1 per week

Loss of intellectual property

$75,000

1 per year

Software piracy

$500

1 per week

Theft of information (hacker)

$2,500

1 per quarter

Theft of information (employee)

$5,000

1 per 6 months

Web defacement

$500

1 per month

Theft of equipment

$5,000

1 per year

Virus, worms, Trojan horses

$1,500

1 per week

Denial-of-service attacks

$2,500

1 per quarter

Earthquake

$250,000

1 per 20 years

Flood

$250,000

1 per 10 years

Fire

$500,000

1 per 10 years

Threat Category

Cost per Incident

(SLE)

Frequency of Occurrence

Programmer mistakes

$5,000

1 per week

Loss of intellectual property

$75,000

1 per year

Software piracy

$500

1 per week

Theft of information (hacker)

$2,500

1 per quarter

Theft of information (employee)

$5,000

1 per 6 months

Web defacement

$500

1 per month

Theft of equipment

$5,000

1 per year

Virus, worms, Trojan horses

$1,500

1 per week

Denial-of-service attacks

$2,500

1 per quarter

Earthquake

$250,000

1 per 20 years

Flood

$250,000

1 per 10 years

Fire

$500,000

1 per 10 years

Explanation / Answer

$20,000 Training
$15,000 Firewall/IDS
$30,000 Firewall/IDS
$15,000 Firewall/IDS
$15,000 Physical security
$10,000 Firewall
$15,000 Physical security
$15,000 Antivirus
$10,000 Firewall
$5,000 Insurance/Backups
$10,000 Insurance/Backups
$10,000 Insurance/Backups