Quantitative Risk Analysis

- Quantitative VALUES!! - SLE (single Loss Expectancy) = Asset Value * Exposure factor (% loss of asset) - ALE (Annual loss expectancy) = SLE * ARO (Annualized Rate of occurrence) Accept, mitigate(reduce by implementing controls calculate costs-), Assign (insure the risk to transfer it), Avoid (stop business activity) Loss= probability * cost Residual risk - where cost of applying extra countermeasures is more than the estimated loss resulting from a threat or vulnerability (C > L). Legally the remaining residual risk is not counted when deciding whether a company is liable. Controls gap - is the amount of risk that is reduced by implementing safeguards. A formula for residual risk is as follows: total risk - controls gap = residual risk RTO - how quickly you need to have that application's information available after downtime has occurred RPO -Recovery Point Objective: Point in time that application data must be recovered to resume business functions; AMOUNT OF DATA YOUR WILLING TO LOSE MTD -Maximum Tolerable Downtime: Maximum delay a business can be down and still remain viable - MTD minutes to hours: critical - MTD 24 hours: urgent - MTD 72 hours: important MTD 7 days: normal - MTD 30 days non-essential PLAN Accept Build Risk Team Review Once in 100 years = ARO of 0.01 SLE is the dollar value lost when an asset is successfully attacked Exposure Factor ranges from 0 to 1 NO - ALE is the annual % of the asset lost when attacked - NOT