Risk Calculations:

You are implementing a new server that will connect 10 client computers to the Internet to access a company application. None of these clients have anti-virus software installed. You know that there is a 90% chance that 50% these systems will become infected with a virus after they connect to the Internet, and this virus will bring your network down for an entire 8-hour day. Anti-virus software would cost $500 a year for the organization. Assume that the impacted employees are paid $12 an hour.

1. What is the Exposure Factor (EF) for this risk?

90%

2. What is the Annualized Rate of Occurrence (ARO) for this risk?

50%

3. What is the Single Loss Expectancy (SLE) for this risk?

$96

4. What is the Annualized Loss Expectancy (ALE) for this risk?

5. Make a recommendation for handling the risk, given the cost of the control. Justify your answer.

6. Describe the difference between a quantitative risk assessment and a qualitative risk assessment.