Security Management Programs and Oversight: Risk Analysis

Question 1

What type of analysis you can use to assess Risk?

Answer 1

Qualitative risk analysis is a subjective process that uses expert judgements and models to complete the assessment. Risk values are often measured broadly with terms like low, medium, and high. Conversely, quantitative risk analysis is the process of objectively determining the risk analysis. This approach will often use metrics and models to complete the analysis.

Question 2

What is SLE?

Answer 2

SLE is the value of a loss expected from a single event. You calculate it using the formula SLE = Asset Value (AV) x Exposure Factor (EF). EF is a measure of the magnitude of an asset’s loss.

Question 3

What is ALE?

Answer 3

ALE is the SLE multiplied by the number of times the event is expected to occur in a year.

Annualized loss Expectancy

Question 4

What is ARO?

Answer 4

ARO is a way to represent the frequency of an event. For example, if an event is expected to occur once in 20 years, the ARO is 1/20.

Annualized Rate of Occurrence

Question 5

What is probability?

Answer 5

Probability is a measure of the likelihood that an event transpires. This typically is measured as a percentage.

Question 6

What is likelihood?

Answer 6

Likelihood is similar to probability, but typically expected to be more qualitative. Therefore, this often is measured using terms like low, medium, and high.

Question 7

What is EF?

Answer 7

EF is a measure of the magnitude of an asset’s loss. For example, a company might determine that the loss of a remote call center would result in a loss of $2 million per year. This would be the EF.

Question 8

What is Impact?

Answer 8

Impact is a more qualitative measure that’s very similar to EF. It might take into account more factors than a financial loss to a company.