Calculate SLE, ARO and ALE
Work through quantitative risk for three scenarios in a spreadsheet, then choose a risk response by comparing a control's cost with the loss it prevents.
Environment
A spreadsheet.
Before you start
- Read Risk Identification and Assessment (p.396), Risk Management Strategies (p.398) and Risk Management Processes (p.400).
You will
- Compute SLE = AV × EF and ALE = SLE × ARO
- Compare ALE with the cost of a control
- Choose accept, avoid, transfer or mitigate
Steps
-
1
Make columns: Asset · Asset value (AV) · Exposure factor (EF) · SLE · ARO · ALE · Control · Control cost/year · New ALE · Decision.
-
2
Scenario 1: laptop theft. AV $1,500, EF 100%, ARO 0.5 (once every two years).
-
3
Scenario 2: web server outage from a power failure. AV $20,000 of lost sales per incident, EF 25%, ARO 2.
-
4
Scenario 3: ransomware on the file server. AV $200,000, EF 40%, ARO 0.1.
-
5
Calculate SLE and ALE for each with spreadsheet formulas.
-
6
For each, propose a control (e.g. full-disk encryption, a UPS, offline backups) and a new, lower ARO or EF. Calculate the new ALE.
-
7
Decide whether each control is worth it (ALE saved vs. cost), and name the response: mitigate, transfer (insurance), accept or avoid.
Check your understanding
- ?What's the ALE for scenario 3 before any control?
- ?When is accepting a risk a reasonable choice?
- ?How does cyber insurance change the picture, and which strategy is it?