An organization determines that the probability of unauthorized access to a data

Question

An organization determines that the probability of unauthorized access to a database that contains personally identifiable information (PII) about its clients and employees is 5% in a year. The total estimate of the loss due to this exposure is estimated to be 5 million dollars. This includes losses resulting from loss of reputation, business operations, fines imposed by FCC, legal fees. After consulting with a security firm, a product was identified that could implement stronger access control and that could allow security administrator to track such an unauthorized access. The total cost of the product is $500,000, plus $10,000/year for maintenance. The product should work well for next five years. It is estimated that, if implemented, it will protect from 90% of all such attacks. We want to know whether the organization should purchase this product.

1. What is the Single Loss Expectancy (SLE)? $ (Please enter digits only)

2. What is the Annualized Rate of Occurrence (ARO)?   %

3. What is the calculated Annualized Loss Expectancy (ALE)? $  (Please enter digits only)

4. What would be the ARO if the countermeasure is implemented?  %

5. What would be the corresponding ALE? $  (Please enter digits only)

6. What is the countermeasure cost for a year? $  (Please enter digits only)

7. Should the organization purchase this product?  (Please enter Yes or No)

Explanation / Answer

Here is the data as per the given criteria, please go through it.

1) Single-Loss Expectancy(SLE) is the monetry value expected from the occurence of a risk on an asset.
Mathematically it expressed as:-
Single-Loss Expectancy(SLE) = Assest Value(AV) X Exposure Factor (EF)

Here Assest value = $5,000,000
Exposure factor = 5%
so,
SLE = AV x EF
   = 5,000,000 x 0.05
   = $250,000

2) Annualized rate of occurrence (ARO)—The ARO represents the estimated frequency at which a given threat is expected to occur. Simply stated, how many times is this expected to happen in one year?
As per the given criteria,the product should work well for next five years.
i.e, ARO = 1/5
   = 0.2

3) Annualized Loss Expectancy (ALE): It is your annual cost of an every 5 year event?
If we use the equation ALE = SLE x ARO ,we get $250,000 x .2 for an ALE of $50,000.

4) ARO if the countermeasure is implemented, 10% chances to get affected.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.