ISC2 Certified in Cybersecurity (CC)Security PrinciplesHard
A critical infrastructure organization operates a Supervisory Control and Data Acquisition (SCADA) system that manages power distribution. A recent risk assessment identified a severe vulnerability in an outdated component of the SCADA system, which, if exploited, could lead to widespread power outages. The organization has calculated the Single Loss Expectancy (SLE) for a successful attack at $5,000,000 and the Annualized Rate of Occurrence (ARO) as 0.2 (meaning an attack is expected once every five years). What is the Annualized Loss Expectancy (ALE) for this risk?
- A$2,500,000
- B$5,000,000
- C$1,000,000
- D$100,000
Show answer & explanationAnswer & explanation
Correct answer: C. $1,000,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case, ALE = $5,000,000 * 0.2 = $1,000,000. This represents the expected financial loss from a specific risk over a year.
Why the other options are wrong
- A. This is SLE divided by 2, not multiplied by ARO.
- B. This is the SLE, not the ALE.
- D. This would be if ARO was 0.02, not 0.2.
Annualized Loss Expectancy (ALE)
The expected financial loss from a specific risk over a one-year period. It is a quantitative measure used in risk management.
- Calculated as SLE x ARO.
- Helps prioritize security investments.
- Expressed in monetary value.
Memory trick: ALE is the annual cost, SLE is a single hit, ARO is how often it happens.