SSCP Systems Security Certified PractitionerRisk Identification, Monitoring, and AnalysisMedium
A company performs an annual quantitative risk assessment. They identify a critical server that, if compromised, would cost an estimated \$500,000 in damages. The likelihood of this compromise occurring is estimated to be once every 5 years. What is the Annualized Loss Expectancy (ALE) for this risk?
- A\$2,500,000
- B\$500,000
- C\$100,000
- D\$250,000
Show answer & explanationAnswer & explanation
Correct answer: C. \$100,000
ALE is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). SLE = \$500,000. ARO = 1/5 = 0.2. So, ALE = \$500,000 * 0.2 = \$100,000.
Why the other options are wrong
- A. Incorrect, this would be if the event occurred 5 times a year.
- B. Incorrect, this is the SLE, not the ALE.
- D. Incorrect, this would be if the event occurred 2.5 times a year.
Annualized Loss Expectancy (ALE)
The expected monetary loss for an asset or a particular risk over a one-year period.
- Calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO).
- Used in quantitative risk assessments to justify security investments.
- Expressed in monetary terms.
Memory trick: SLE is one loss, ARO is how often, ALE is total per year.