A security analyst has been asked to develop a quantitative risk analysis and risk assessment for the company’s online shopping application. Based on heuristic information from the Security Operations Center (SOC), a Denial of Service Attack (DoS) has been successfully executed 5 times a year. The Business Operations department has determined the loss associated to each attack is $40,000. After implementing application caching, the number of DoS attacks was reduced to one time a year. The cost of the countermeasures was $100,000. Which of the following is the monetary value earned during the first year of operation?

A security analyst has been asked to develop a quantitative risk analysis and risk assessment for the company’s online shopping application. Based on heuristic information from the Security Operations Center (SOC), a Denial of Service Attack (DoS) has been successfully executed 5 times a year. The Business Operations department has determined the loss associated to each attack is $40,000. After implementing application caching, the number of DoS attacks was reduced to one time a year. The cost of the countermeasures was $100,000. Which of the following is the monetary value earned during the first year of operation?
A . $60,000
B . $100,000
C . $140,000
D . $200,000

View Answer

Answer: A

Explanation:

ALE before implementing application caching:

ALE = ARO x SLE

ALE = 5 x $40,000

ALE = $200,000

ALE after implementing application caching:

ALE = ARO x SLE

ALE = 1 x $40,000

ALE = $40,000

The monetary value earned would be the sum of subtracting the ALE calculated after implementing application caching and the cost of the countermeasures, from the ALE calculated before implementing application caching.

Monetary value earned= $200,000 – $40,000 – $100,000

Monetary value earned= $60,000

Incorrect Answers:

B: $100,000 would be the answer ifthe ARO after implementing application caching was 0.

C: $140,000 is the expected loss in the first year. The ALE after implementing application caching + the cost of the countermeasures.

D: The answer cannot be $200,000 because in the first year of operation the ALE after implementing application caching is $40,000 and the cost of the countermeasures is $100,000.

References:

http://www.pearsonitcertification.com/artic1es/artic1e.aspx?p=418007&seqNum=4