Certified Information Security Manager (CISM)Information Security Risk ManagementMedium
A company is experiencing a significant increase in phishing attacks targeting its employees. The information security manager has implemented email filtering, security awareness training, and multi-factor authentication (MFA). However, the attacks persist. To determine the MOST effective additional control, the manager decides to calculate the Annualized Loss Expectancy (ALE) for phishing attacks. Given the following data: Single Loss Expectancy (SLE) = $50,000, Annualized Rate of Occurrence (ARO) = 0.5. What is the ALE?
- A$50,000
- B$25,000
- C$100,000
- D$75,000
Show answer & explanationAnswer & explanation
Correct answer: B. $25,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case, ALE = $50,000 * 0.5 = $25,000.
Why the other options are wrong
- A. This would be the ALE if ARO was 1 (one occurrence per year).
- C. This would be the ALE if ARO was 2 (two occurrences per year).
- D. This value does not result from the given formula.
Annualized Loss Expectancy (ALE)
A quantitative risk assessment metric that represents the expected monetary loss from a risk event over a one-year period.
- Calculated as SLE x ARO.
- Used to justify security investments.
- Helps prioritize risk mitigation efforts.
Memory trick: ALE: Annual Loss = Single Loss times Annual Rate.