CYBERSECURITY RISK MANAGEMENT AND ASSESSMENT
1 1. VULNERABILITY MANAGEMENT
Problem 1. ABC Corporation is conducting a vulnerability assessment on their network. They
have identified the following vulnerabilities with their associated CVSS (Common Vulnerability Scor-
ing System) scores:
Vulnerability 1: CVSS score = 7.8
Vulnerability 2: CVSS score = 6.2
Vulnerability 3: CVSS score = 9.3
The organization has a risk acceptance criteria of 8.0. Determine which vulnerabilities need
immediate remediation based on the CVSS scores.
Solution 1. To determine which vulnerabilities need immediate remediation based on the risk
acceptance criteria of 8.0, we compare the CVSS scores of each vulnerability:
a) Vulnerability 1: CVSS score = 7.8 < 8.0
Since the CVSS score of Vulnerability 1 is less than the risk acceptance criteria, it does not
need immediate remediation.
b) Vulnerability 2: CVSS score = 6.2 < 8.0
Similarly, the CVSS score of Vulnerability 2 is also less than the risk acceptance criteria, so it
does not need immediate remediation.
c) Vulnerability 3: CVSS score = 9.3 > 8.0
The CVSS score of Vulnerability 3 is greater than the risk acceptance criteria, so it needs im-
mediate remediation as it poses a higher risk to the organization’s security.
2 2. INSIDER THREATS
Problem 2. A company has identified that the average cost of an insider threat incident is
100,000.T heyalsoestimatethatthereisa10
Solution 2. Given that the average cost of an insider threat incident is 100,000andtheprobabilityof experiencinganincidentis10
Expected Cost =Average Cost ×Probability
Expected Cost =
100,000 ×0.10 =10,000
Therefore, the expected cost of insider threats for the company in the next year is 10,000.
3 3. SUPPLY CHAIN SECURITY
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)forthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
Problem 3. Company XYZ is evaluating the cybersecurity risks associated with their supply
chain. They have identified three suppliers - A, B, and C. The probability of a cybersecurity breach
from each supplier and the potential impact (in monetary terms) of such a breach are as follows:
Supplier A: Probability of breach = 0.3, Potential impact = $500,000
Supplier B: Probability of breach = 0.2, Potential impact = $700,000
Supplier C: Probability of breach = 0.1, Potential impact = $1,000,000
a) Calculate the expected loss from each supplier’s cybersecurity breach.
b) Determine which supplier poses the highest cybersecurity risk based on the expected loss.
c) If the company can only afford to invest in improving the cybersecurity of one supplier, which
supplier should they prioritize based on the cybersecurity risk?
Solution 3.
a) The expected loss from a cybersecurity breach for each supplier can be calculated as the
product of the probability of breach and the potential impact:
a) Expected loss from Supplier A: 0.3×$500,000 = $150,000
b) Expected loss from Supplier B: 0.2×$700,000 = $140,000
c) Expected loss from Supplier C: 0.1×$1,000,000 = $100,000
b) Comparing the expected losses:
Supplier A: $150,000
Supplier B: $140,000
Supplier C: $100,000
Therefore, Supplier A poses the highest cybersecurity risk based on the expected loss.
c) If the company can only invest in improving the cybersecurity of one supplier, they should
prioritize Supplier A as it poses the highest cybersecurity risk based on the calculated expected
loss.
4 4. THIRD-PARTY RISK
Problem 4. Company X relies on a third-party vendor for their online payment processing
system. The annual cost of the system is $100,000, and the vendor guarantees 99% uptime per
year. If downtime leads to an average loss of $500 per hour, calculate the expected annual loss
due to system downtime.
Solution 4. Given:
•Annual cost of the system = $100,000
•Guaranteed uptime = 99%
•Average loss per hour of downtime = $500
Firstly, let’s calculate the number of downtime hours allowed per year based on the guaranteed
uptime:
Allowed downtime hours per year = 0.01 ×365 ×24
= 87.6hours
Next, we calculate the annual expected loss due to downtime:
Expected downtime hours per year = 365 ×24 −87.6
= 8772.4hours
Therefore, the expected annual loss due to system downtime is:
Expected annual loss =Expected downtime hours ×Average loss per hour
= 8772.4×$500
= $4,386,200
So, the expected annual loss due to system downtime is $4,386,200.
5 5. INCIDENT RESPONSE
Problem 5. When an organization experiences a security incident, the incident response team
must classify the severity of the incident to prioritize their response actions. Consider an organi-
zation that has encountered a data breach, and the incident response team has determined the
following impact levels:
•Impact on confidentiality: High
•Impact on integrity: Medium
•Impact on availability: Low
Based on the impact levels, calculate the overall severity level of this data breach using the
Common Vulnerability Scoring System (CVSS) version 3.0. Assume the following base scores for
each impact level:
•Confidentiality impact: 0.6
•Integrity impact: 0.4
•Availability impact: 0.2
a) Calculate the impact score for this data breach.
b) Determine the exploitability score for this data breach.
c) Calculate the overall CVSS score for this data breach.
Solution 5.
a) The impact score is calculated by multiplying the base score of each impact level by its
respective impact level and taking the highest value. In this case:
Impact score = max(0.6 * High, 0.4 * Medium, 0.2 * Low) Impact score = max(0.6, 0.4, 0.2)
Impact score = 0.6
b) The exploitability score is constant and equal to 0.35 for all incidents.
c) The overall CVSS score is calculated using the formula:
Overall CVSS score = ((0.6 + 0.4 + 0.2) + (0.35 * (1 - (1 - 0.6) * (1 - 0.4) * (1 - 0.2))) * 10) / 2
Overall CVSS score = (1.2 + (0.35 * (1 - 0.24)) * 10) / 2 Overall CVSS score = (1.2 + (0.35 * 0.76)
* 10) / 2 Overall CVSS score = (1.2 + 2.66) / 2 Overall CVSS score = 1.93
Therefore, the overall CVSS score for this data breach is 1.93.
6 6. DATA LOSS PREVENTION
Problem 6. A company is implementing a data loss prevention (DLP) solution to protect sensi-
tive customer information. The DLP solution detects and blocks unauthorized transfer of sensitive
data through emails, file transfers, and uploads to cloud storage. The company estimates the
following costs for implementing the DLP solution:
- Initial setup cost: 10,000 −Annualsubscriptioncost :5,000 - Cost per incident detected and
prevented: 1,000
Assume that the company expects an average of 10 incidents per year without the DLP solution,
each incident resulting in potential loss of 20,000.
a) Calculate the total cost of using the DLP solution for one year.
b) Calculate the potential cost savings if the company implements the DLP solution.
Solution 6.
a) The total cost of using the DLP solution for one year can be calculated as follows:
Total cost = Initial setup cost + Annual subscription cost + (Number of incidents * Cost per inci-
dent detected and prevented) Total cost = 10,000+5,000 + (10 incidents * 1,000)T otalcost =10,000
+5,000+10,000 Total cost = 25,000
Therefore, the total cost of using the DLP solution for one year is 25,000.
b) The potential cost savings if the company implements the DLP solution can be calculated as
follows:
Potential cost savings = (Number of incidents * Loss per incident without DLP) - Total cost
Potential cost savings = (10 incidents * 20,000)−25,000 Potential cost savings = 200,000−25,000
Potential cost savings = 175,000
Therefore, the potential cost savings if the company implements the DLP solution is 175,000.
7 7. IDENTITY AND ACCESS MANAGEMENT
Problem 7. Company XYZ has implemented multi-factor authentication (MFA) as part of their
identity and access management strategy. The MFA system requires users to enter a password
and a one-time passcode generated by an authenticator app. The password complexity policy
requires a minimum of 8 characters, including at least one uppercase letter, one lowercase letter,
one digit, and one special character. The one-time passcode is generated using a time-based
algorithm and expires after 30 seconds.
a) If an attacker is able to obtain a user’s password but cannot access their authenticator app,
what is the probability they can successfully authenticate within a 30-second window?
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, what is the probability they can successfully
authenticate within a 30-second window?
Solution 7.
a) To calculate the probability of successfully authenticating within a 30-second window with
only the password, we need to consider the complexity of the password and the time limit.
Let’s assume the attacker knows the user’s password and now needs to generate a valid one-
time passcode within 30 seconds. Since the passcode expires after 30 seconds, the attacker has
a 1 in 30 chance of guessing the passcode correctly in the first attempt. Therefore, the probability
of successfully guessing the passcode within the time limit is:
P(success) = 1
30
b) Assuming the attacker also has access to the user’s authenticator app and knows the exact
algorithm used to generate the one-time passcode, the probability of successfully authenticating
within a 30-second window depends on the strength of the algorithm and the randomness of the
passcode generated.
If the passcode is generated using a secure algorithm with enough entropy and the attacker
knows the exact algorithm, the probability of successfully guessing the passcode within 30 seconds
would depend on the entropy of the passcode and the attacker’s computational power.
Without specific details about the algorithm and entropy of the passcode, it is difficult to provide
a precise probability in this scenario. It is crucial for organizations to use secure and unpredictable
algorithms for generating one-time passcodes to minimize the risk of unauthorized access.
8 8. SECURITY AWARENESS TRAINING
Problem 8. Suppose a cybersecurity training program has been implemented in a company,
and after the training, the company’s employees have successfully reduced the rate of falling for
phishing emails from 12% to 5%. If the company has 500 employees, how many fewer employees
are expected to fall for phishing emails after the training?
Additional context: - The phishing email fall rate was measured before and after the security
awareness training. - The training was effective in reducing the rate of falling for phishing emails.
Solution 8. Given: - Initial falling rate for phishing emails: 12% - Falling rate after training: 5%
- Total number of employees: 500
a) Calculate the number of employees expected to fall for phishing emails before the training:
Number of employees falling for phishing before =Falling rate ×Total number of employees
= 0.12 ×500 = 60
b) Calculate the number of employees expected to fall for phishing emails after the training:
Number of employees falling for phishing after =Falling rate ×Total number of employees
= 0.05 ×500 = 25
c) Find how many fewer employees are expected to fall for phishing emails after the training:
Reduction in falling employees =Number of employees falling before −Number of employees falling after
= 60 −25 = 35
Therefore, after the security awareness training, 35 fewer employees are expected to fall for
phishing emails.
9 9. NETWORK SECURITY
Problem 9. Consider a company that has implemented a network security system to protect its
data. The system logs show that on average, there are 500 security incidents detected per month.
The company estimates that each security incident costs $1,000 to investigate and resolve. Addi-
tionally, the company has calculated that there is a 10% probability of a security incident causing
a data breach, and the average cost of a data breach is $100,000.
a) Calculate the monthly cost of investigating and resolving security incidents.
b) Determine the expected monthly cost of data breaches.
c) Calculate the total monthly cost of network security incidents for the company.
Solution 9. a) To calculate the monthly cost of investigating and resolving security incidents,
we multiply the average number of incidents per month (500) by the cost per incident ($1,000):
Monthly cost =Number of incidents ×Cost per incident
= 500 ×$1,000
= $500,000
Therefore, the monthly cost of investigating and resolving security incidents is $500,000.
b) To determine the expected monthly cost of data breaches, we multiply the probability of a
data breach (10% or 0.1) by the average cost of a data breach ($100,000):
Expected monthly cost of data breaches =Probability of data breach ×Cost of data breach
= 0.1×$100,000
= $10,000
Therefore, the expected monthly cost of data breaches is $10,000.
c) The total monthly cost of network security incidents for the company is the sum of the
monthly cost of investigating and resolving security incidents and the expected monthly cost of
data breaches:
Total monthly cost =Monthly cost of investigating and resolving incidents +Expected monthly cost of data breaches
= $500,000 + $10,000
= $510,000
Therefore, the total monthly cost of network security incidents for the company is $510,000.
10 10. CLOUD SECURITY
Problem 10. A company is considering moving its data storage to a cloud service provider. The
company currently spends $20,000 per month on maintaining its own servers. The cloud service
provider offers a plan that costs $25,000 per month. However, the cloud service provider guaran-
tees 99.9% uptime compared to the company’s current uptime of 98%. Calculate the potential cost
savings per year if the company decides to migrate to the cloud service provider.
Solution 10.
Given: - Current monthly cost of maintaining own servers = $20,000 - Cloud service provider
monthly cost = $25,000 - Uptime of current servers = 98% - Uptime guaranteed by cloud service
provider = 99.9%
a) Calculate the annual cost of maintaining own servers: Annual cost = $20,000 x 12 = $240,000
b) Calculate the annual cost of the cloud service provider: Annual cost = $25,000 x 12 =
$300,000
c) Calculate the potential cost savings per year with the cloud service provider: Potential savings
= Annual cost of own servers - Annual cost of cloud service provider Potential savings = $240,000
- $300,000 = -$60,000
Therefore, if the company decides to migrate to the cloud service provider, they would incur an
additional cost of $60,000 per year compared to maintaining their own servers.
11 11. RISK ASSESSMENT METHODOLOGIES
Problem 11. An organization is using the quantitative risk assessment methodology to evaluate
the cybersecurity risks associated with a potential data breach. The following data is provided:
- Annual loss expectancy (ALE): $500,000 - Annual rate of occurrence (ARO): 0.1 - Single loss
expectancy (SLE): $5,000
a) Calculate the annual exposure factor (AEF).
b) Determine the overall risk exposure of the organization if the safeguard costs to mitigate the
risk are estimated at $100,000.
c) Calculate the cost-benefit ratio for implementing the safeguard.
Solution 11.
a) To calculate the annual exposure factor (AEF), we use the formula:
AEF =ARO ×SLE
Given that ARO = 0.1 and SLE = $5,000:
AEF = 0.1×5000 = $500
Therefore, the annual exposure factor (AEF) is $500.
b) The overall risk exposure of the organization after implementing the safeguard is calculated
as:
ALEnew =AEF ×ARO
Given that AEF = $500 and ARO = 0.1:
ALEnew = 500 ×0.1 = $50,000
Therefore, the overall risk exposure of the organization after implementing the safeguard is
$50,000.
c) The cost-benefit ratio is calculated as the ratio of the annual risk reduction to the cost of
safeguard implementation:
Cost −Benef itRatio =ALEold −ALEnew
Saf eguardCost
Given that ALE (old) = $500,000, ALE (new) = $50,000, and Safeguard Cost = $100,000:
Cost −Benef itRatio =500,000 −50,000
100,000 =450,000
100,000 = 4.5
Therefore, the cost-benefit ratio for implementing the safeguard is 4.5.
12 12. MOBILE DEVICE SECURITY
Problem 12. Consider a company that allows its employees to bring their own mobile devices
(laptops, smartphones, tablets) to work. The IT security team wants to implement a mobile device
security policy to reduce the risk of data breaches and unauthorized access. They have identified
three key measures to enhance mobile device security:
1. Implementing strong password policies for all mobile devices. 2. Enforcing encryption on all
mobile devices to protect data at rest. 3. Implementing remote wipe capabilities in case a device
is lost or stolen.
If the company estimates that the likelihood of a data breach due to weak mobile device security
is 10% without any of these measures in place, and the implementation of each measure reduces
the risk by 40%, 30%, and 20%, respectively, calculate the overall risk reduction percentage after
implementing all three measures.
Solution 12. Let’s denote the risk reduction percentages for each measure as p1= 40%,
p2= 30%, and p3= 20%. The overall risk reduction percentage Pafter implementing all three
measures can be calculated using the formula for combined risk reduction probabilities:
P= 1 −(1 −p1)(1 −p2)(1 −p3)
= 1 −(1 −0.4)(1 −0.3)(1 −0.2)
= 1 −0.6×0.7×0.8
= 1 −0.336
= 0.664.
Therefore, the overall risk reduction percentage after implementing all three measures is 66.4%.
13 13. ENDPOINT SECURITY
Problem 13. A company has 100 endpoint devices in its network. The average cost incurred
due to a security breach on one endpoint device is 500.T hecompanyestimatesthelikelihoodofasecuritybreachonanyonedeviceinagivenyeartobe0.05.Calculatetheannualizedlossexpectancy(ALE)f orthecompany.
Solution 13.
Given: Number of endpoint devices (n) = 100, Average cost per breach (SLE) = 500, Likelihoodof asecuritybreachononedeviceinayear(ARO) =
0.05.
The Annualized Loss Expectancy (ALE) is calculated using the formula:
ALE =ARO ×SLE
First, calculate the Single Loss Expectancy (SLE):
SLE =
500
Now, calculate the Annualized Rate of Occurrence (ARO):
ARO = 0.05
Then, use these values to find the Annualized Loss Expectancy (ALE):
ALE = 0.05×
500 = 25
Therefore, the Annualized Loss Expectancy for the company is 25.
14 14. THREAT INTELLIGENCE
Problem 14. Consider a cybersecurity threat intelligence system that collects data from various
sources and uses indicators of compromise (IoCs) to identify potential security threats. The system
has detected the following IoCs:
Indicator 1: 5 malicious IP addresses Indicator 2: 3 suspicious email domains Indicator 3: 10
malware file hashes
If each indicator has a weighting factor associated with it for risk assessment purposes, where
Indicator 1 has a weight of 0.2, Indicator 2 has a weight of 0.3, and Indicator 3 has a weight of 0.5,
calculate the overall risk score based on these indicators.
Solution 14. Let’s calculate the risk score for each indicator first:
a) Risk score for Indicator 1:
Risk score Indicator 1 =Number of indicators ×Weight factor = 5 ×0.2 = 1
b) Risk score for Indicator 2:
Risk score Indicator 2 = 3 ×0.3=0.9
c) Risk score for Indicator 3:
Risk score Indicator 3 = 10 ×0.5=5
Now, we calculate the overall risk score by summing up the individual risk scores:
Overall risk score =Risk score Indicator 1 +Risk score Indicator 2 +Risk score Indicator 3
Overall risk score = 1 + 0.9 + 5 = 6.9
Therefore, the overall risk score based on these indicators is 6.9.
15 15. REGULATORY COMPLIANCE
Problem 15. Company XYZ must comply with the General Data Protection Regulation (GDPR)
requirements. The company processes personal data of European Union citizens and needs to
ensure its cybersecurity measures are in line with the regulation. The GDPR mandates that any
personal data breaches must be reported to the relevant supervisory authority within 72 hours of
becoming aware of the breach. Company XYZ recently experienced a data breach, and they need
to calculate the deadline for reporting the breach.
Given that the breach was detected on Monday at 10:00 AM and the company became fully
aware of the breach two hours later, calculate the exact deadline for reporting the breach to the
supervisory authority.
Solution 15. Company XYZ detected the breach on Monday at 10:00 AM and became fully
aware at 12:00 PM. Therefore, the countdown to the 72-hour reporting deadline begins at 12:00
PM on Monday.
72 hours from 12:00 PM on Monday lands at 12:00 PM on Thursday. Therefore, the exact
deadline for reporting the breach to the supervisory authority is on Thursday at 12:00 PM.
16 16. SECURITY AUTOMATION
Problem 16. A company is implementing a security automation tool that can detect and respond
to potential cyber threats in real-time. The tool has a false positive rate of 5% and a false negative
rate of 10%. If the tool detects 100 potential threats, what is the expected number of false positives
and false negatives?
Solution 16. Given: - False positive rate = 5% = 0.05 - False negative rate = 10% = 0.10 - Total
number of potential threats detected = 100
a) The expected number of false positives: False positive rate = Probability of a false positive
Let Xbe the random variable representing the number of false positives. The expected value of
Xis given by:
E(X) = n×p
Where: - nis the total number of potential threats detected - pis the probability of a false positive
Substitute the given values:
E(X) = 100 ×0.05 = 5
Therefore, the expected number of false positives is 5.
b) The expected number of false negatives: False negative rate = Probability of a false negative
Let Ybe the random variable representing the number of false negatives. The expected value of
Yis given by:
E(Y) = n×q
Where: - nis the total number of potential threats detected - qis the probability of a false negative
Substitute the given values:
E(Y) = 100 ×0.10 = 10
Therefore, the expected number of false negatives is 10.
17 17. SECURE SOFTWARE DEVELOPMENT
Problem 17. A software development team is implementing a secure coding process for a new
application. They have identified three vulnerabilities and estimated the likelihood of exploitation
and the potential impact of each vulnerability as follows:
•Vulnerability 1: Likelihood = 0.3, Impact = 8.5
•Vulnerability 2: Likelihood = 0.2, Impact = 7.0
•Vulnerability 3: Likelihood = 0.5, Impact = 9.0
Calculate the risk score for each vulnerability using the formula:
Risk =Likelihood ×Impact
a) Calculate the risk score for Vulnerability 1.
b) Calculate the risk score for Vulnerability 2.
c) Calculate the risk score for Vulnerability 3.
Solution 17.
a) For Vulnerability 1:
Risk1= 0.3×8.5=2.55
So, the risk score for Vulnerability 1 is 2.55.
b) For Vulnerability 2:
Risk2= 0.2×7.0=1.4
So, the risk score for Vulnerability 2 is 1.4.
c) For Vulnerability 3:
Risk3= 0.5×9.0=4.5
So, the risk score for Vulnerability 3 is 4.5.
18 18. PHYSICAL SECURITY CONTROLS
Problem 18. A data center implements a multi-factor authentication system to enhance physical
security. The system requires users to provide a unique fingerprint scan and a PIN code to gain
access to the server room. The fingerprint authentication has a false acceptance rate of 0.1% and
a false rejection rate of 1.5%. The PIN code has a probability of being guessed correctly of 0.01%.
a) What is the overall probability of an unauthorized user gaining access to the server room if
they attempt to bypass both the fingerprint and PIN authentication systems?
b) If there are 100 attempts made by unauthorized users to gain access to the server room,
what is the probability of at least one successful attempt?
c) What is the probability that a legitimate user is denied access to the server room due to false
rejection of their fingerprint?
Solution 18. a) To calculate the overall probability of an unauthorized user gaining access, we
need to consider the scenarios where the user successfully bypasses both the fingerprint and PIN
authentication systems.
Let PF A be the false acceptance rate of the fingerprint authentication (0.001), PF R be the false
rejection rate of the fingerprint authentication (0.015), and PP IN be the probability of guessing the
PIN correctly (0.01).
The probability of an unauthorized user successfully bypassing both systems is given by:
P(Unauthorized user gains access) = PF A ×PP IN = 0.001 ×0.01 = 0.00001
b) The probability of at least one successful attempt out of 100 attempts can be calculated using
the complement rule. The probability of no successful attempts in one attempt is 1−0.00001 =
0.99999. Therefore, the probability of no successful attempts in 100 attempts is 0.99999100 ≈
0.99004. So, the probability of at least one successful attempt is:
P(At least one successful attempt)=1−0.99999100 ≈0.01
c) The probability that a legitimate user is denied access due to false rejection of their fingerprint
can be calculated as:
P(False rejection of legitimate user) = PF R = 0.015
19 19. BUSINESS CONTINUITY PLANNING
Problem 19. Company XYZ is assessing the potential financial impact of a cyber attack. They
estimate that the probability of a successful cyber attack in a given year is 0.05. If a cyber attack
occurs, the estimated financial impact on the company is $500,000. What is the annual expected
loss due to cyber attacks for Company XYZ?
Solution 19. Given: Probability of a successful cyber attack, P(attack) = 0.05 Financial impact
of a cyber attack, = $500,000
The annual expected loss due to cyber attacks can be calculated using the formula:
Expected loss =P(attack)×Financial impact
Expected loss = 0.05 ×$500,000 = $25,000
Therefore, the annual expected loss due to cyber attacks for Company XYZ is $25,000.
20 20. CONNECTED DEVICES SECURITY
Problem 20. An organization has implemented 500 IoT devices in its network. The average
number of vulnerabilities found in each IoT device is 5. If the organization decides to patch 80% of
these vulnerabilities, how many vulnerabilities will remain unpatched?
Solution 20. a) The total number of vulnerabilities in all IoT devices is given by:
T otal vulnerabilities =Number of devices ×Average vulnerabilities per device
T otal vulnerabilities = 500 ×5 = 2500
b) The number of vulnerabilities that will be patched is:
P atched vulnerabilities = 80% ×T otal vulnerabilities
P atched vulnerabilities = 0.80 ×2500 = 2000
c) The number of vulnerabilities that will remain unpatched is:
Unpatched vulnerabilities =T otal vulnerabilities −P atched vulnerabilities
Unpatched vulnerabilities = 2500 −2000 = 500
Therefore, there will be 500 vulnerabilities remaining unpatched in the IoT devices after 80% of
the vulnerabilities have been patched.
