In this lesson,
we're going to cover the concept
of quantitative risk analysis.
While qualitative risk analysis provides a subjective
and high level view of risk,
quantitative risk analysis offers a more objective
and numerical evaluation of risk.
So let's explore how a quantitative risk analysis
is performed using its key components
of single loss expectancy, or SLE,
annualized rate of occurrence, or ARO,
annualized loss expectancy, or ALE,
and the exposure factor, or EF.
So what is quantitative risk analysis?
Quantitative risk analysis is a method
of evaluating risk that uses numerical measurements.
It provides a probabilistic analysis
of potential future events and is typically used
for financial, safety and scheduling decisions.
This method allows for more precise understanding
of potential impacts
and the effectiveness of proposed solutions.
The aim here is to assign concrete values
to each of the risk factors we want to use in the analysis.
First, we have the exposure factor.
The exposure factor, or EF, is the proportion
of an asset that is lost in an event.
It is expressed as a percentage between zero, no loss,
and 100%, which is total loss.
So if we determine that in a catastrophic event
of a flooding hitting our HQ, we'll lose 70% of our assets,
that means our exposure factor is 70%.
Second, we have the single loss expectancy, or SLE.
Single loss expectancy is the monetary value
expected to be lost in a single event.
It's calculated by multiplying the value
of the asset by the exposure factor.
So if our assets are worth $100,000,
and the exposure factor is 70%,
that means we have a single loss expectancy of $70,000.
Third, we have the annualized rate of occurrence, or ARO.
Annualized rate of occurrence is the estimated frequency
with which a threat is expected to occur within a year.
Fourth, we have the annualized loss expectancy.
The annualized loss expectancy, or ALE,
is the expected annual loss from a risk.
It is calculated by multiplying the single loss expectancy
by the annualized rate of occurrence.
So now that we have an understanding
of the four components used in quantitative risk analysis,
let's now use them to calculate the exact risk
of a company that is facing a given situation.
Now, let's pretend that a company
has a server worth $10,000.
The exposure factor for the server crash
is estimated to be 50%,
and the server crashes once every two years.
So the single loss expectancy will be calculated as such.
SLE equals asset value times exposure factor,
which equals $10,000, that's the asset value,
times 50%, that's the exposure factor.
So therefore, the single loss expectancy is equal to $5,000.
Now, if we want to figure out
the annualized rate of occurrence, or ARO,
we know that that is 0.5,
since the server crashes once every two years,
or one divided by two, which is 0.5.
Now, to calculate the annualized loss expectancy, or ALE,
we use the following formula.
ALE equals SLE times ARO.
ALE, which equals $5,000, we calculated it earlier,
times 0.5, the ARO that we just calculated.
Now, this means that the ALE would be $2,500.
Therefore, the company can expect
to lose roughly $2,500 per year due to a server crash.
Now that we have this number,
we can calculate different mitigation options
to see if they're worth pursuing.
For example, maybe a vendor is trying
to sell us a new server with a higher redundancy rating
so that it only fails once every 10 years
instead of once every two years, like our current server.
Well, that will reduce our ALE from $2,500 to $500,
saving us $2,000 per year.
But if that new server costs us $50,000
instead of the $10,000 that we currently pay
and it only has a three-year useful life,
then it won't be worth spending the extra $40,000
to purchase this better server
just to save $2,000 per year for three years.
So remember, quantitative risk analysis
is a powerful tool in risk management,
providing a numerical and objective evaluation of risk.
The key components to remember are single loss expectancy
or SLE, which is the expected monetary loss
from a single event.
Exposure factor, or EF,
which is the proportion of the asset
that is lost in an event.
The annualized rate of occurrence, or ARO,
which is the estimated frequency
at which a threat is expected to occur within a year.
And finally, the annualized loss expectancy, or ALE,
which is the expected annual loss from a risk.
By understanding these components and how they interact,
organizations can make informed decisions
about risk mitigation strategies and resource allocation