1
00:00:00,120 --> 00:00:00,953
In this lesson,

2
00:00:00,953 --> 00:00:02,640
we're going to cover the concept

3
00:00:02,640 --> 00:00:04,980
of quantitative risk analysis.

4
00:00:04,980 --> 00:00:07,980
While qualitative risk analysis provides a subjective

5
00:00:07,980 --> 00:00:10,020
and high level view of risk,

6
00:00:10,020 --> 00:00:12,750
quantitative risk analysis offers a more objective

7
00:00:12,750 --> 00:00:14,970
and numerical evaluation of risk.

8
00:00:14,970 --> 00:00:18,210
So let's explore how a quantitative risk analysis

9
00:00:18,210 --> 00:00:20,670
is performed using its key components

10
00:00:20,670 --> 00:00:24,120
of single loss expectancy, or SLE,

11
00:00:24,120 --> 00:00:27,210
annualized rate of occurrence, or ARO,

12
00:00:27,210 --> 00:00:30,300
annualized loss expectancy, or ALE,

13
00:00:30,300 --> 00:00:33,810
and the exposure factor, or EF.

14
00:00:33,810 --> 00:00:37,140
So what is quantitative risk analysis?

15
00:00:37,140 --> 00:00:39,060
Quantitative risk analysis is a method

16
00:00:39,060 --> 00:00:42,510
of evaluating risk that uses numerical measurements.

17
00:00:42,510 --> 00:00:45,150
It provides a probabilistic analysis

18
00:00:45,150 --> 00:00:48,300
of potential future events and is typically used

19
00:00:48,300 --> 00:00:51,420
for financial, safety and scheduling decisions.

20
00:00:51,420 --> 00:00:54,510
This method allows for more precise understanding

21
00:00:54,510 --> 00:00:55,620
of potential impacts

22
00:00:55,620 --> 00:00:58,260
and the effectiveness of proposed solutions.

23
00:00:58,260 --> 00:01:01,020
The aim here is to assign concrete values

24
00:01:01,020 --> 00:01:05,099
to each of the risk factors we want to use in the analysis.

25
00:01:05,099 --> 00:01:07,260
First, we have the exposure factor.

26
00:01:07,260 --> 00:01:10,650
The exposure factor, or EF, is the proportion

27
00:01:10,650 --> 00:01:13,410
of an asset that is lost in an event.

28
00:01:13,410 --> 00:01:16,920
It is expressed as a percentage between zero, no loss,

29
00:01:16,920 --> 00:01:19,380
and 100%, which is total loss.

30
00:01:19,380 --> 00:01:22,830
So if we determine that in a catastrophic event

31
00:01:22,830 --> 00:01:27,060
of a flooding hitting our HQ, we'll lose 70% of our assets,

32
00:01:27,060 --> 00:01:30,720
that means our exposure factor is 70%.

33
00:01:30,720 --> 00:01:35,040
Second, we have the single loss expectancy, or SLE.

34
00:01:35,040 --> 00:01:38,310
Single loss expectancy is the monetary value

35
00:01:38,310 --> 00:01:40,710
expected to be lost in a single event.

36
00:01:40,710 --> 00:01:43,050
It's calculated by multiplying the value

37
00:01:43,050 --> 00:01:45,210
of the asset by the exposure factor.

38
00:01:45,210 --> 00:01:48,177
So if our assets are worth $100,000,

39
00:01:48,177 --> 00:01:50,910
and the exposure factor is 70%,

40
00:01:50,910 --> 00:01:55,910
that means we have a single loss expectancy of $70,000.

41
00:01:56,040 --> 00:02:00,240
Third, we have the annualized rate of occurrence, or ARO.

42
00:02:00,240 --> 00:02:03,240
Annualized rate of occurrence is the estimated frequency

43
00:02:03,240 --> 00:02:06,690
with which a threat is expected to occur within a year.

44
00:02:06,690 --> 00:02:09,660
Fourth, we have the annualized loss expectancy.

45
00:02:09,660 --> 00:02:12,630
The annualized loss expectancy, or ALE,

46
00:02:12,630 --> 00:02:15,510
is the expected annual loss from a risk.

47
00:02:15,510 --> 00:02:18,720
It is calculated by multiplying the single loss expectancy

48
00:02:18,720 --> 00:02:21,360
by the annualized rate of occurrence.

49
00:02:21,360 --> 00:02:23,400
So now that we have an understanding

50
00:02:23,400 --> 00:02:26,910
of the four components used in quantitative risk analysis,

51
00:02:26,910 --> 00:02:29,430
let's now use them to calculate the exact risk

52
00:02:29,430 --> 00:02:32,460
of a company that is facing a given situation.

53
00:02:32,460 --> 00:02:34,140
Now, let's pretend that a company

54
00:02:34,140 --> 00:02:36,540
has a server worth $10,000.

55
00:02:36,540 --> 00:02:38,100
The exposure factor for the server crash

56
00:02:38,100 --> 00:02:39,900
is estimated to be 50%,

57
00:02:39,900 --> 00:02:43,140
and the server crashes once every two years.

58
00:02:43,140 --> 00:02:47,340
So the single loss expectancy will be calculated as such.

59
00:02:47,340 --> 00:02:51,960
SLE equals asset value times exposure factor,

60
00:02:51,960 --> 00:02:55,410
which equals $10,000, that's the asset value,

61
00:02:55,410 --> 00:02:58,050
times 50%, that's the exposure factor.

62
00:02:58,050 --> 00:03:02,580
So therefore, the single loss expectancy is equal to $5,000.

63
00:03:02,580 --> 00:03:04,170
Now, if we want to figure out

64
00:03:04,170 --> 00:03:07,650
the annualized rate of occurrence, or ARO,

65
00:03:07,650 --> 00:03:09,450
we know that that is 0.5,

66
00:03:09,450 --> 00:03:12,330
since the server crashes once every two years,

67
00:03:12,330 --> 00:03:15,093
or one divided by two, which is 0.5.

68
00:03:16,140 --> 00:03:20,340
Now, to calculate the annualized loss expectancy, or ALE,

69
00:03:20,340 --> 00:03:22,380
we use the following formula.

70
00:03:22,380 --> 00:03:26,700
ALE equals SLE times ARO.

71
00:03:26,700 --> 00:03:30,930
ALE, which equals $5,000, we calculated it earlier,

72
00:03:30,930 --> 00:03:35,100
times 0.5, the ARO that we just calculated.

73
00:03:35,100 --> 00:03:39,270
Now, this means that the ALE would be $2,500.

74
00:03:39,270 --> 00:03:41,250
Therefore, the company can expect

75
00:03:41,250 --> 00:03:46,170
to lose roughly $2,500 per year due to a server crash.

76
00:03:46,170 --> 00:03:47,700
Now that we have this number,

77
00:03:47,700 --> 00:03:50,010
we can calculate different mitigation options

78
00:03:50,010 --> 00:03:51,810
to see if they're worth pursuing.

79
00:03:51,810 --> 00:03:53,910
For example, maybe a vendor is trying

80
00:03:53,910 --> 00:03:57,450
to sell us a new server with a higher redundancy rating

81
00:03:57,450 --> 00:03:59,820
so that it only fails once every 10 years

82
00:03:59,820 --> 00:04:02,340
instead of once every two years, like our current server.

83
00:04:02,340 --> 00:04:06,270
Well, that will reduce our ALE from $2,500 to $500,

84
00:04:06,270 --> 00:04:07,950
saving us $2,000 per year.

85
00:04:07,950 --> 00:04:10,470
But if that new server costs us $50,000

86
00:04:10,470 --> 00:04:12,720
instead of the $10,000 that we currently pay

87
00:04:12,720 --> 00:04:15,720
and it only has a three-year useful life,

88
00:04:15,720 --> 00:04:18,630
then it won't be worth spending the extra $40,000

89
00:04:18,630 --> 00:04:20,220
to purchase this better server

90
00:04:20,220 --> 00:04:23,520
just to save $2,000 per year for three years.

91
00:04:23,520 --> 00:04:26,280
So remember, quantitative risk analysis

92
00:04:26,280 --> 00:04:28,650
is a powerful tool in risk management,

93
00:04:28,650 --> 00:04:32,280
providing a numerical and objective evaluation of risk.

94
00:04:32,280 --> 00:04:35,340
The key components to remember are single loss expectancy

95
00:04:35,340 --> 00:04:38,580
or SLE, which is the expected monetary loss

96
00:04:38,580 --> 00:04:40,200
from a single event.

97
00:04:40,200 --> 00:04:42,270
Exposure factor, or EF,

98
00:04:42,270 --> 00:04:44,580
which is the proportion of the asset

99
00:04:44,580 --> 00:04:46,560
that is lost in an event.

100
00:04:46,560 --> 00:04:48,990
The annualized rate of occurrence, or ARO,

101
00:04:48,990 --> 00:04:50,550
which is the estimated frequency

102
00:04:50,550 --> 00:04:53,640
at which a threat is expected to occur within a year.

103
00:04:53,640 --> 00:04:57,030
And finally, the annualized loss expectancy, or ALE,

104
00:04:57,030 --> 00:05:00,150
which is the expected annual loss from a risk.

105
00:05:00,150 --> 00:05:03,150
By understanding these components and how they interact,

106
00:05:03,150 --> 00:05:04,830
organizations can make informed decisions

107
00:05:04,830 --> 00:05:07,960
about risk mitigation strategies and resource allocation