Formulas for Quantitative Risk Management Analysis

Question 1

How to calculate risk?

Answer 1

risk = threat * vulnerability

Question 2

How to calculate total risk?

Answer 2

total risk = threats * vulnerabilities

Question 3

What’s Exposure Factor (EF)?

Answer 3

• percentage of loss that an organization would experience if a specific asset were violated by a realized risk
• needs to be used as decimal value in formulas - percentage divided by 100%

Question 4

What’s Single Loss Expectancy (SLE)?

Answer 4

• cost associated with a single realized risk against a specific asset
• one-time loss figure

Question 5

How to calculate SLE?

Answer 5

SLE = Asset Value (AV) * Exposure Factor (EF)

Question 6

If Asset Value is $100000 and the exposure factor (EF) is 30%, what would be the Single Loss Expectancy? (SLE)?

Answer 6

• AV = $100000, EF = 30% (0.3)
• 100000 * 0.3 = $30000

Question 7

What is Annualized Rate of Occurrence (ARO)?

Answer 7

• expected frequency with which a specific threat or risk will occur within a single year
• watch for AROs longer than a year!

Question 8

What’s Annualized Loss Expectancy (ALE)?

Answer 8

possible yearly cost of all instances of a specific realized threat against a specific asset

Question 9

How is Annualized Loss Expectancy (ALE) calculated?

Answer 9

ALE = Single Loss Expectancy (SLE) * Annualized Rate of Occurrence (ARO)

Question 10

What’s the Annualized Loss Expectancy (ALE), if:
Office Building = $200000, Hurricane Damage Estimate: 50%, Hurricane Probability: 1x every 10 years

Answer 10

(200000 * 0.5) * 0.1 = $10000

Question 11

When the Annualized Loss Expectancy (ALE) is calculated, what does it say?

Answer 11

the calculation means that the business shouldn’t spend more than the calculated price annually on the building protection

Question 12

What’s Safeguard Evaluation (SE)?

Answer 12

• answers the question whether safeguards are cost effective

Question 13

How’s the Safeguard Evaluation (SE) calculated?

Answer 13

SE = (ALE before safeguard) - (ALE after safeguard) - (annual cost of safeguard)

Question 14

What’s the Controls Gap (CG)?

Answer 14

• the amount of risk reduced by implementing safeguards
• amount of money saved

Question 15

How’s residual risk calculated?

Answer 15

residual risk = (total risk) - (controls gap)

Question 16

What are the six major elements of quantitative risk analysis?

Answer 16

1. assign Asset Value (AV)
2. calculate Exposure Factor (EF)
3. calculate Single Loss Expectancy (SLE)
4. assess the Annualized Rate of Occurence (ARO)
5. derive the Annualized Loss Expectancy (ALE)
6. peform cost/benefit analysis of countermeasures

Question 17

What question does the safeguard evaluation answer?

Answer 17

whether the safeguard being implemented is cost effective

Question 18

What do you need to know to be able to calculate Annualized Loss Excpectancy?

Answer 18

Single Loss Expectancy and Annualized Rate of Occurence

Question 19

Is there a formula for calculating Annualized Rate of Occurence?

Answer 19

• no, but it should be converted to a decimal value
• if an event is supposed to happen:
  
  • twice a year = ARO is 2
  • once in 10 years = ARO 1/10 = 0.1
  • once in 5 years = ARO 1/5 = 0.2

Question 20

If an insurance company has a deductible of $75,000 in the contract, what does it mean?

Answer 20

means that the company will cover damages above $75,000

Question 21

How is EF calculated?

Answer 21

by dividing the amount of damage by the asset value

Question 22

What is the best metric to compare relative risks and why?

Answer 22

• annualized loss expectancy (ALE)
• because it incorporates both the likelihood and the impact of those risks

Question 23

A standard quantitative risk analysis on a specific threat/vulnerability/risk relation was performed and possible countermeasures were selected. When performing the calculations again, which of the factors will change?

Answer 23

• countermeasure primary affects the annualized rate of occurrence (ARO), because the countermeasure is designed to prevent (or mitigate or reduce) the occurrence of the risk, thus reducing its frequency per year
• also possible that a countermeasure will also reduce the exposure factor (EF) or the amount of loss per incident, but this is not as common as ARO reduction

Question 24

A building itself is valued at $15 million.
Average hurricane would destroy approximately 50 percent of the building. What’s the SLE?

Answer 24

$7.5 million

Question 25

What does ROI stand for?

Answer 25

Return Of Investment

Question 26

To calculate the return investment for cloud infrastructure versus prior on-premises design, what elements are needed for the ROI calculation?

Answer 26

• total cost of ownership for his on-premises design
• total cost of cloud services that will be required to replace the on-premises systems for their design lifecycle
• total cost of licensing and staffing required to make the move and operate the cloud environment