Scenario 4: Complex Problem Using ALE

Definition of vulnerability, threat and risk of problem #4

1. Vulnerability No backup
2. Threat A Laptop failure
3. Risk Data Loss

What is the asset in this problem?

Suppose the asset is worth $50,000. The Single Lost Expectancy (SLE) is computed by multiplying the Actual Value by the Exposure Factor

In our case, the SLE = Actual Value (AV) X Exposure Factor (EF). The Exposure Factor is the loss that can occur as a result of the threat. For problem #4, we are going to assume that the SLE is $10,000.

What is EF?

We are going to keep the ARO (the frequency of the threat every year) as .

5 assuming that the laptop crashes once every two years.

Compute the ALE. Remember

Generally, the equation below is used to decide whether to implement a particular mitigation strategy

Mitigation Investment (M1) = ALE1 (before the Mitigation Investment) ALE2 (after the Mitigation Investment) Total Cost of implementing the mitigation strategy (TC).

Suppose the cost of completing and maintaining a backup for a laptop is $400 and the ALE2 is $1000. What should be the allowable investment for this security risk? Use approximately 200 words to explain your answer.