CRISC Certified in Risk and Information Systems ControlIT Risk AssessmentEasy
A financial institution is evaluating the risk of a denial-of-service (DoS) attack on its online banking platform. The risk team estimates the likelihood of such an attack occurring in a given year is 20%, and the potential financial loss from a successful attack is $500,000. What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$100,000
- B$500,000
- C$10,000
- D$250,000
Show answer & explanationAnswer & explanation
Correct answer: A. $100,000
Annualized Loss Expectancy (ALE) is calculated by multiplying the Annualized Rate of Occurrence (ARO) by the Single Loss Expectancy (SLE). In this case, ARO is 0.20 (20%) and SLE is $500,000, resulting in an ALE of $100,000.
Why the other options are wrong
- B. This is incorrect. This represents the Single Loss Expectancy (SLE), not the Annualized Loss Expectancy (ALE).
- C. This is incorrect. It appears to be a miscalculation, perhaps dividing SLE by ARO or an incorrect decimal placement.
- D. This is incorrect. This would be half of the SLE, not related to the ARO.
Annualized Loss Expectancy (ALE)
The expected financial loss from a specific risk over a one-year period.
- Calculated as ARO x SLE.
- Used in quantitative risk analysis.
- Helps prioritize risks based on financial impact.
Memory trick: ALE is Always Lost Expectancy, a product of how often and how much.