1. Introduction

The goal of risk management is to deliver optimal security at a reasonable cost. This article introduces quantitative risk analysis. It also describes cost/benefit analysis, risk handling, and types of countermeasures.

2. CIA Triad

Risk is related with vulnerabilities, which threaten confidentiality (C), integrity (I), and availability (A) of the assets. This is described as the CIA Triad.

  1. Confidentiality is about not disclosing sensitive information to other people.
  2. Integrity is about preserving the state of the system—we don’t want attackers to change our data.
  3. We do want our systems to be up and running. Hence availability is considered.

3. Quantitative Analysis

Quantitative analysis is about assigning monetary values to risk components. Let’s analyze the example of hard drive failure to better understand how it works.

Let’s first describe the threat, vulnerability, and risk.

  1. Threat—hard drive failure
  2. Vulnerability—backups done rarely
  3. Risk—loss of data

The asset is data. The value of the asset (AV) is assessed first—$100,000, for example.

Let’s discuss the single loss expectancy (SLE). It contains information about the potential loss when a threat occurs (expressed in monetary values). It is calculated as follows: SLE = AV x EF, where EF is exposure factor. Exposure factor describes the loss that will happen to the asset as a result of the threat (expressed as percentage value). SLE is $30,000 in our example, when EF is estimated to be 0.3.

Let’s continue this case. Annualized rate of occurrence (ARO) is described as an estimated frequency of the threat occurring in one year. ARO is used to calculate ALE (annualized loss expectancy). ALE is calculated as follows: ALE = SLE x ARO. ALE is $15,000 ($30,000 x 0.5), when ARO is estimated to be 0.5 (once in two years).

As we can see, the risk is about the impact of the vulnerability on the business and the probability of the vulnerability to be exploited.

4. Cost/Benefit Analysis

Let’s continue the example from the previous section. Annualized loss expectancy (ALE) is $15,000. This means that the potential loss is $15,000 in one year, when the data is lost as a result of the hard drive failure. A countermeasure can be used to reduce the potential loss. It happens when the management decides to reduce the risk. This countermeasure should not cost more than $15,000 per year. Otherwise it wouldn’t be logical from a business point of view (we don’t want to spend more money than we can potentially lose). This is basically how cost/benefit analysis works.

Let’s see how the annual value of the countermeasure to the company (COUNTERMEASURE_VALUE) can be calculated:

Want to learn more?? The InfoSec Institute CISSP Training course trains and prepares you to pass the premier security certification, the CISSP. Professionals that hold the CISSP have demonstrated that they have deep knowledge of all 10 Common Body of Knowledge Domains, and have the necessary skills to provide leadership in the creation and operational duties of enterprise wide information security programs.

InfoSec Institute's proprietary CISSP certification courseware materials are always up to date and synchronized with the latest ISC2 exam objectives. Our industry leading course curriculum combined with our award-winning CISSP training provided by expert instructors delivers the platform you need in order to pass the CISSP exam with flying colors. You will leave the InfoSec Institute CISSP Boot Camp with the knowledge and domain expertise to successfully pass the CISSP exam the first time you take it. Some benefits of the CISSP Boot Camp are:

  • Dual Certification - CISSP and ISSEP/ISSMP/ISSAP
  • We have cultivated a strong reputation for getting at the secrets of the CISSP certification exam
  • Our materials are always updated with the latest information on the exam objectives: This is NOT a Common Body of Knowledge review-it is intense, successful preparation for CISSP certification.
  • We focus on preparing you for the CISSP certification exam through drill sessions, review of the entire Common Body of Knowledge, and practical question and answer scenarios, all following a high-energy seminar approach.


ALE_PREVIOUS: ALE before implementing the countermeasure

ALE_NOW: ALE after implementing the countermeasure

COUTERMEASURE_COST: annualized cost of countermeasure (please note that it’s not only purchasing cost—maintenance cost is included).

5. Risk Handling

Risk can be handled in the following ways:

  1. Risk reduction—risk is reduced to an acceptable level (countermeasures implemented; types of countermeasures are described in the next section).
  2. Risk avoidance—stopping the activity, which leads to the risk
  3. Risk transference—the risk is transferred to the insurance company
  4. Risk acceptance—accepting the cost of potential loss (no countermeasures)

6. Countermeasures

Let’s discuss the types of countermeasures (also called controls) that are implemented in the case of risk reduction. There are three types of countermeasures:

  1. Administrative (e.g., security awareness training should not be forgotten, because people are the weakest point in the security chain)
  2. Technical (e.g., firewall)
  3. Physical (e.g., locks)

Countermeasures are implemented to reduce the risk. We talk about total risk when no countermeasure is implemented. Let’s assume now that the countermeasure is implemented. Perfect security doesn’t exist and there is some risk left. This is a residual risk.

7. Summary

This article introduced quantitative risk analysis. Single loss expectancy (SLE), exposure factor (EF), annualized rate of occurrence (ARO) and annualized loss expectancy (ALE) were described. It was also shown how cost/benefit analysis works. Finally, risk handling and types of countermeasures were discussed.