SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisEasy
A security team is conducting a quantitative risk assessment for a critical database server. They determine that the Single Loss Expectancy (SLE) for a data breach event is $500,000. Based on historical data and threat intelligence, they estimate the Annualized Rate of Occurrence (ARO) for such an event is 0.2 (meaning, a breach is expected once every five years). What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$250,000
- B$100,000
- C$500,000
- D$2,500,000
Show answer & explanationAnswer & explanation
Correct answer: B. $100,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case, ALE = $500,000 * 0.2 = $100,000.
Why the other options are wrong
- A. This would be SLE * 0.5, which is not the given ARO.
- C. This is the SLE, not the ALE.
- D. This would be SLE * (1/ARO), which is incorrect.
Annualized Loss Expectancy (ALE)
The expected monetary loss from a risk over a one-year period.
- Calculated as SLE × ARO.
- Used in quantitative risk assessment to prioritize risks.
- Represents the long-term average loss.
Memory trick: SLE for one, ARO for annual frequency, ALE is their product.