ISC2 Certified in Cybersecurity (CC)Security PrinciplesHard
A critical infrastructure organization manages a Supervisory Control and Data Acquisition (SCADA) system. A recent risk assessment identified a potential cyberattack that could disrupt operations for 24 hours. The cost of this disruption is estimated to be $500,000 per day. If the likelihood of this event occurring is estimated at once every 5 years, what is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$100,000
- B$500,000
- C$250,000
- D$2,500,000
Show answer & explanationAnswer & explanation
Correct answer: A. $100,000
First, calculate the Single Loss Expectancy (SLE): 24 hours of disruption at $500,000/day = $500,000. Next, calculate the Annualized Rate of Occurrence (ARO). If it occurs once every 5 years, ARO = 1/5 = 0.2. Finally, ALE = SLE * ARO = $500,000 * 0.2 = $100,000.
Why the other options are wrong
- B. This is the SLE, not the ALE.
- C. This represents an incorrect calculation, possibly dividing SLE by 2.
- D. This would be SLE multiplied by 5, which is incorrect.
Annualized Loss Expectancy (ALE)
The expected monetary loss for a given risk over a one-year period. It is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO).
- ALE = SLE * ARO
- Used in quantitative risk analysis
- Helps prioritize risk mitigation efforts
Memory trick: ALE = SLE x ARO: Your 'A'nnual 'L'oss 'E'xpectancy is your 'S'ingle 'L'oss 'E'xpectancy times how 'A'nnually 'R'egularly it 'O'ccurs.