Question

Exercise 2: A company has a resource XYZ. If there is a single breach of security, the company may face a fine of $100,000 and pay another $20,000 to clean up the breach. Based on statistics gathered by the SANS Government agency, an attack targeting the company's assets is likely to be successful about once in five years. A proposed countermeasure should cut the frequency of occurrence in half. Question 1: Use your classic risk analysis skills to complete the template below based on the information provided in this case. Note: you need to calculate the numbers. Base Case With Countermeasure Single Loss Expectancy Annualized Rate of Occurrence Annualized Loss Expectancy ALE Reduction for Countermeasure Question 2: Based on the results of the risk analysis, what is the maximum that the company should be willing to pay for the countermeasure? Explain.

Answer 1

ANSWER :-

GIVEN DATA

A company has a resource is XYZ.

The company may face a fine = $100,000.

The company clean up breach to pay = $20,000.

Total amount cost by the company = $120,000 .

The company believes that an attack is likely to be successful about once in five years.

A proposed countermeasure should cut the frequency of occurrence in half.

1) Complete the template by using classic risk analysis skills

	Base Case	With Countermeasure
Single Loss Expectancy Pay Fine : $100,000 Pay for clean up breach : $20,000	$120,000	$120,000
Annualized Rate of Occurrence	Once in 5 years is 20%	Half of base frequency is 10%
Annualized Loss Expectancy	$120,000 / 5 = $24,000	$24,000 / 2 = $12,000
Annualized Loss Expectancy Reduction for Countermeasure		$12,000

2) what is the maximum that the company should be willing to pay for the countermeasure and explain by using above result.

Company willing to pay the maximum is $12,000 yearly.

Explanation :-

In the first question, if there is breech in the security then company need to pay the fine of $100,000 and in order to clean the breech the company needs to pay the fine of the $20,000.

So, total amount cost by the company is $120,000.

It is being given that attack comes once in a five year.

So, probability of occurrence of attack is 20% without countermeasures.

It is also being given that countermeasures will reduce the frequency to half.

So, probability of occurrence of attack is 10% with countermeasures.

So, in base case if annualized loss expectancy is considered then amount is $24,000 and with countermeasures, annualized loss expectancy is $12,000.

Countermeasure's annualized expected profit is $12,000. The organization ought to be ready to pay up to $12,000 yearly.