1. If an organization has three information assets to evaluate for risk manageme
ID: 3769048 • Letter: 1
Question
1. If an organization has three information assets to evaluate for risk management as shown in the accompanying data, which vulnerability should be evaluated for additional controls first? Which one should be evaluated last?
Asset A: Switch L47 connects a network to the Internet. It has two vulnerabilities. It is susceptible to hardware failure at a likelihood of 0.2 and is subject to an SNMP buffer overflow attack at a likelihood of 0.1. The switch has an impact rating of 90 and no current controls in place. You are 75% certain of the assumptions and data
Asset B: Sever WebSrv6 hosts a company Web site and performs e-commerce transactions. It has a Web server version that can be attacked by sending it invalid Unicode values. The likelihood of that attack is estimated at 0.1. The server has been assigned an impact value of 100, and a control has been implanted that reduces the impact of the vulnerability by 75%. You are 80% certain of the assumptions and data.
Asset C: Operators use an MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 0.1. There are no controls in place on this asset; it has an impact rating of 5. You are 90% certain of the assumptions and data.
3. Suppose XYZ Software Company has a new application development project, with projected revenues of $1,200,000. Using the following table, calculate the ARO and ALE for each threat category that XYZ Software Company faces for this project:
Threat Category
Cost per Incident
(SLE)
Frequency of Occurrence
Programmer mistakes
$5,000
1 per week
Loss of intellectual property
$75,000
1 per year
Software piracy
$500
1 per week
Theft of information (hacker)
$2,500
1 per quarter
Theft of information (employee)
$5,000
1 per 6 months
Web defacement
$500
1 per month
Theft of equipment
$5,000
1 per year
Virus, worms, Trojan horses
$1,500
1 per week
Denial-of-service attacks
$2,500
1 per quarter
Earthquake
$250,000
1 per 20 years
Flood
$250,000
1 per 10 years
Fire
$500,000
1 per 10 years
Threat Category
Cost per Incident
(SLE)
Frequency of Occurrence
Programmer mistakes
$5,000
1 per week
Loss of intellectual property
$75,000
1 per year
Software piracy
$500
1 per week
Theft of information (hacker)
$2,500
1 per quarter
Theft of information (employee)
$5,000
1 per 6 months
Web defacement
$500
1 per month
Theft of equipment
$5,000
1 per year
Virus, worms, Trojan horses
$1,500
1 per week
Denial-of-service attacks
$2,500
1 per quarter
Earthquake
$250,000
1 per 20 years
Flood
$250,000
1 per 10 years
Fire
$500,000
1 per 10 years
Explanation / Answer
$20,000 Training
$15,000 Firewall/IDS
$30,000 Firewall/IDS
$15,000 Firewall/IDS
$15,000 Physical security
$10,000 Firewall
$15,000 Physical security
$15,000 Antivirus
$10,000 Firewall
$5,000 Insurance/Backups
$10,000 Insurance/Backups
$10,000 Insurance/Backups
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.