Information Security

Single loss expectancy (SLE): Total loss expected from a single incident

Annual rate of occurrence (ARO): Number of times an incident is expected to occur in a year

Annual loss expectancy (ALE): Expected loss for a year

ALE = SLE X ARO

Safeguard value: Cost of a safeguard or control

Scenario: Richman Investments provides high-end smartphones to several employees. The value of each smartphone is $500, and approximately 1,000 employees have these company-owned devices. In the past year, employees have lost or damaged 75 smartphones.

With this information, calculate the following:

· SLE = ____________

· ARO = ___________

· ALE = ____________

Richman is considering buying insurance for each smartphone. Use the ALE to determine the usefulness of this safeguard. For example, Richman could purchase insurance for each device for $25 per year. The safeguard value is $25 X 1,000 devices, or $25,000. It is estimated that if the insurance is purchased, the ARO will decrease to 5. Should the company purchase the insurance?

Determine the effectiveness of the safeguard:

· Current ALE = ______________

· ARO with control = 5

· ALE with control = _____________

· Savings with control = ___________ (Current ALE - ALE with control)

· Safeguard value (cost of control) = $25,000

· Realized savings = _____________ (Savings with control - safeguard value)

Should Richman buy the insurance? Explain your answer.

________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

Qualitative Risk Assessment:

Risk is a combination of two factors: the probability that a threat will exploit a vulnerability and the impact that it will have on the organization if it does materialize. In the quantitative risk assessment process, you calculated the probability (the annual rate of occurrence) and the impact (the single loss expectancy) and then combined them to determine the annualized loss expectancy.

In qualitative risk assessment, you use subjective values, such as “low,” “medium” and “high” to describe the probability and impact of each risk. In many cases, this is the only alternative, as it can be quite difficult to quantify risk values.

Scenario: Richman Investments is concerned about the security of its customer data. Management has identified the primary risks the company faces in protecting the data. After surveying key individuals in the company, Richman calculated the probability and impact of each risk, as shown in the following table.

Plot these risks into the risk matrix below:

What risk should Richman address first? Explain your answer.

________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________