ISC2 CISSP (Certified Information Systems Security Professional)Security and Risk ManagementMedium
A healthcare organization is conducting a risk assessment for its new patient portal. During the analysis, they identify a potential vulnerability that could allow an attacker to gain unauthorized access to patient records. The likelihood of this vulnerability being exploited is estimated at 0.2 per year, and the potential financial impact of a single successful breach is estimated at $500,000. What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$50,000
- B$250,000
- C$1,000,000
- D$100,000
Show answer & explanationAnswer & explanation
Correct answer: D. $100,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Annualized Rate of Occurrence (ARO) by the Single Loss Expectancy (SLE). In this case, ARO = 0.2 and SLE = $500,000. So, ALE = 0.2 * $500,000 = $100,000.
Why the other options are wrong
- A. Incorrect calculation; this would be SLE / 10.
- B. Incorrect calculation; this would be SLE / (ARO * 2).
- C. Incorrect calculation; this would be ARO * 2 * SLE.
Annualized Loss Expectancy (ALE)
The expected monetary loss for an asset or a specific risk over a one-year period. It is a quantitative risk assessment metric used to determine the cost-effectiveness of countermeasures.
- Calculated as ALE = SLE × ARO.
- SLE (Single Loss Expectancy) is the financial loss from a single security incident.
- ARO (Annualized Rate of Occurrence) is the probability of an incident occurring in a year.
Memory trick: ALE is 'Annual Loss Expected' – how much money you might lose yearly.