- [Instructor] In this segment, we're going to do
a simple quantitative risk analysis.
and then follow it up with a cost-benefit analysis.
Now, just as a refresher, there are two key formulas
you absolutely must know:
SLE, which is single loss expectancy,
equals asset value times exposure factor,
and annualized loss expectancy, ALE,
equals SLE, single loss expectancy,
times annual rate of occurrence.
Again, you wanna commit both of those to memory.
So let's walk through
a quantitative risk assessment.
Our target is our workstation,
and the risk that we're evaluating is malware.
So malware on the workstation,
we wanna know what the quantitative impact
is going to be.
So first thing we have to do
is determine our asset value.
So in this scenario, we decided
that the asset value is based on loss
of workstation productivity per hour.
And we've decided that for every hour
we don't have a workstation operational,
it's going to cost us $15.
So our AV is 15.
Our second determination is the exposure factor.
We're saying if we have malware on a system,
it will absolutely not be usable
during that whole time.
So we're determining that the exposure factor
or the impact is going to be 100%.
We're gonna just not let that system
be operational at all
while it's infected with malware, so 100%.
Now that we have our AV and EF,
we can do our SLE,
our single loss expectancy, calculation.
So asset value times exposure factor
is single loss expectancy.
So $15 times 100% is $15.
That was a pretty easy calculation.
So on a per-hour basis,
our single loss expectancy is $15.
Next, we're gonna calculate
our annual rate of occurrence.
Perhaps in talking with our IT folks
or doing some research, we've determined
that a workstation could potentially end up
with four hours of downtime per year,
or four hours of time that it's infected
with malware per year.
So we're saying our annual rate of occurrence
per year is going to be four hours.
So now we have our ARO.
So SLE times ARO is our annualized loss expectancy.
So $15 times 4 hours
is going to give us $60.
So we've determined
that our annualized loss expectancy
due to malware on a per-workstation basis
is going to be $60.
So before we go into our cost-benefit analysis,
let's do a quick recap of what we've done.
We determined the asset value,
determined the exposure factor,
calculated the single loss expectancy,
determined the annual rate of occurrence
and calculated the annualized loss expectancy.
If we're good with the number, at that point, we're done.
But if we're not,
we may wanna evaluate mitigation controls.
So we're going to identify and evaluate
some additional mitigation controls.
And once we have determined what those controls
are gonna be, we have to go through this process again.
We need to recalculate the SLE
and the ALE, taking into account
the mitigating controls.
And the output of that is going
to be referred to as ALE2.
And then when we do our cost-benefit analysis,
what we're gonna do is we're gonna compare ALE1
and ALE2, taking into account
the cost of the new control.
So let's look at that.
In this example, we've determined
that implementing AV protection control
does not change the exposure factor,
we're still saying the exposure factor is 100%,
but it does change the annual rate of occurrence.
That the AV protection control,
we've determined, is going to reduce the ARO
from four hours per year to two hours per year.
So we didn't need to recalculate the SLE
because the asset value didn't change
and the exposure factor didn't change,
but we do need to recalculate the ALE
because the ARO has changed.
So our new ALE is 15,
which is the SLE times 2,
2 hours per year, is $30.
So our new ALE is $30.
So ALE1 was $60.
ALE2 is 30.
Well, that looks great.
It's like 1/2 of it.
Well, yeah, except that we have
to also take into account
the cost of the control,
and perhaps the cost of the control
on a per-workstation basis was $39 a year.
So our cost-benefit analysis is really ALE1,
which was 60, versus ALE2,
which is actually $69,
because it was ALE2
plus the cost of the control,
30 plus 39.
So now we have a new determination to make, right?
ALE2, right, plus the cost of control
is really more expensive than ALE1.
Well, if all we were doing was taking this
into account, we might say, "No,
we're not gonna invest in that control.
We wanna look at other controls."
Well, that still might be an option,
but we also then need to broaden our scope
and think about, are there any other costs
that also should be considered or included,
like reputation cost, perhaps?
So this isn't necessarily just stand-alone.
We have to really take into account
sort of a lot of big-picture considerations
when we're doing our risk assessments.
And that, my friends, is a closer look
at quantitative risk analysis and a cost-benefit analysis.