ISC2 CISSP (Certified Information Systems Security Professional)Security and Risk ManagementMedium
A healthcare organization is conducting a risk assessment for its new patient portal. During the assessment, they identify that a successful phishing attack could lead to unauthorized access to electronic protected health information (ePHI). The potential financial impact of a data breach is estimated at $1,000,000, and the likelihood of such an attack occurring in a year is estimated at 0.05. What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$500,000
- B$5,000
- C$100,000
- D$50,000
Show answer & explanationAnswer & explanation
Correct answer: D. $50,000
The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). In this scenario, SLE = $1,000,000 and ARO = 0.05. Therefore, ALE = $1,000,000 * 0.05 = $50,000.
Why the other options are wrong
- A. Incorrect calculation; this would be SLE * 0.50.
- B. Incorrect calculation; this would be SLE * 0.005.
- C. Incorrect calculation; this would be SLE * 0.10.
Annualized Loss Expectancy (ALE)
The expected monetary loss from a risk over a one-year period.
- Calculated as SLE x ARO.
- Helps prioritize risks based on financial impact.
- A quantitative risk assessment metric.
Memory trick: Quantify losses, annualize occurrence, expect the total.