1
00:00:06,570 --> 00:00:08,040
- [Instructor] In this
segment, we're going to do

2
00:00:08,040 --> 00:00:10,620
a simple quantitative risk analysis.

3
00:00:10,620 --> 00:00:13,920
and then follow it up with
a cost-benefit analysis.

4
00:00:13,920 --> 00:00:16,320
Now, just as a refresher,
there are two key formulas

5
00:00:16,320 --> 00:00:18,390
you absolutely must know:

6
00:00:18,390 --> 00:00:20,490
SLE, which is single loss expectancy,

7
00:00:20,490 --> 00:00:23,550
equals asset value times exposure factor,

8
00:00:23,550 --> 00:00:26,370
and annualized loss expectancy, ALE,

9
00:00:26,370 --> 00:00:28,710
equals SLE, single loss expectancy,

10
00:00:28,710 --> 00:00:31,170
times annual rate of occurrence.

11
00:00:31,170 --> 00:00:33,723
Again, you wanna commit
both of those to memory.

12
00:00:34,680 --> 00:00:35,580
So let's walk through

13
00:00:35,580 --> 00:00:37,323
a quantitative risk assessment.

14
00:00:38,250 --> 00:00:40,710
Our target is our workstation,

15
00:00:40,710 --> 00:00:43,170
and the risk that we're
evaluating is malware.

16
00:00:43,170 --> 00:00:44,850
So malware on the workstation,

17
00:00:44,850 --> 00:00:47,490
we wanna know what the quantitative impact

18
00:00:47,490 --> 00:00:48,750
is going to be.

19
00:00:48,750 --> 00:00:49,860
So first thing we have to do

20
00:00:49,860 --> 00:00:51,690
is determine our asset value.

21
00:00:51,690 --> 00:00:53,400
So in this scenario, we decided

22
00:00:53,400 --> 00:00:55,830
that the asset value is based on loss

23
00:00:55,830 --> 00:00:57,990
of workstation productivity per hour.

24
00:00:57,990 --> 00:00:59,490
And we've decided that for every hour

25
00:00:59,490 --> 00:01:01,560
we don't have a workstation operational,

26
00:01:01,560 --> 00:01:03,570
it's going to cost us $15.

27
00:01:03,570 --> 00:01:05,823
So our AV is 15.

28
00:01:07,830 --> 00:01:10,620
Our second determination
is the exposure factor.

29
00:01:10,620 --> 00:01:12,570
We're saying if we have
malware on a system,

30
00:01:12,570 --> 00:01:14,400
it will absolutely not be usable

31
00:01:14,400 --> 00:01:15,780
during that whole time.

32
00:01:15,780 --> 00:01:18,150
So we're determining
that the exposure factor

33
00:01:18,150 --> 00:01:21,570
or the impact is going to be 100%.

34
00:01:21,570 --> 00:01:23,310
We're gonna just not let that system

35
00:01:23,310 --> 00:01:24,690
be operational at all

36
00:01:24,690 --> 00:01:27,780
while it's infected with malware, so 100%.

37
00:01:27,780 --> 00:01:29,550
Now that we have our AV and EF,

38
00:01:29,550 --> 00:01:30,690
we can do our SLE,

39
00:01:30,690 --> 00:01:33,210
our single loss expectancy, calculation.

40
00:01:33,210 --> 00:01:35,430
So asset value times exposure factor

41
00:01:35,430 --> 00:01:37,320
is single loss expectancy.

42
00:01:37,320 --> 00:01:41,550
So $15 times 100% is $15.

43
00:01:41,550 --> 00:01:43,200
That was a pretty easy calculation.

44
00:01:43,200 --> 00:01:45,000
So on a per-hour basis,

45
00:01:45,000 --> 00:01:48,183
our single loss expectancy is $15.

46
00:01:49,800 --> 00:01:50,760
Next, we're gonna calculate

47
00:01:50,760 --> 00:01:52,680
our annual rate of occurrence.

48
00:01:52,680 --> 00:01:54,330
Perhaps in talking with our IT folks

49
00:01:54,330 --> 00:01:56,147
or doing some research, we've determined

50
00:01:56,147 --> 00:01:59,400
that a workstation
could potentially end up

51
00:01:59,400 --> 00:02:02,820
with four hours of downtime per year,

52
00:02:02,820 --> 00:02:05,490
or four hours of time that it's infected

53
00:02:05,490 --> 00:02:07,080
with malware per year.

54
00:02:07,080 --> 00:02:09,240
So we're saying our
annual rate of occurrence

55
00:02:09,240 --> 00:02:11,550
per year is going to be four hours.

56
00:02:11,550 --> 00:02:13,203
So now we have our ARO.

57
00:02:14,670 --> 00:02:18,630
So SLE times ARO is our
annualized loss expectancy.

58
00:02:18,630 --> 00:02:22,380
So $15 times 4 hours

59
00:02:22,380 --> 00:02:24,180
is going to give us $60.

60
00:02:24,180 --> 00:02:25,500
So we've determined

61
00:02:25,500 --> 00:02:27,360
that our annualized loss expectancy

62
00:02:27,360 --> 00:02:30,060
due to malware on a per-workstation basis

63
00:02:30,060 --> 00:02:31,773
is going to be $60.

64
00:02:33,720 --> 00:02:35,760
So before we go into our
cost-benefit analysis,

65
00:02:35,760 --> 00:02:37,980
let's do a quick recap of what we've done.

66
00:02:37,980 --> 00:02:39,630
We determined the asset value,

67
00:02:39,630 --> 00:02:41,610
determined the exposure factor,

68
00:02:41,610 --> 00:02:44,130
calculated the single loss expectancy,

69
00:02:44,130 --> 00:02:46,080
determined the annual rate of occurrence

70
00:02:46,080 --> 00:02:49,260
and calculated the
annualized loss expectancy.

71
00:02:49,260 --> 00:02:51,600
If we're good with the number,
at that point, we're done.

72
00:02:51,600 --> 00:02:52,740
But if we're not,

73
00:02:52,740 --> 00:02:55,770
we may wanna evaluate mitigation controls.

74
00:02:55,770 --> 00:02:57,990
So we're going to identify and evaluate

75
00:02:57,990 --> 00:03:00,810
some additional mitigation controls.

76
00:03:00,810 --> 00:03:03,570
And once we have determined
what those controls

77
00:03:03,570 --> 00:03:06,090
are gonna be, we have to go
through this process again.

78
00:03:06,090 --> 00:03:08,310
We need to recalculate the SLE

79
00:03:08,310 --> 00:03:10,620
and the ALE, taking into account

80
00:03:10,620 --> 00:03:12,030
the mitigating controls.

81
00:03:12,030 --> 00:03:13,650
And the output of that is going

82
00:03:13,650 --> 00:03:15,630
to be referred to as ALE2.

83
00:03:15,630 --> 00:03:18,180
And then when we do our
cost-benefit analysis,

84
00:03:18,180 --> 00:03:21,150
what we're gonna do is
we're gonna compare ALE1

85
00:03:21,150 --> 00:03:24,090
and ALE2, taking into account

86
00:03:24,090 --> 00:03:25,890
the cost of the new control.

87
00:03:25,890 --> 00:03:27,780
So let's look at that.

88
00:03:27,780 --> 00:03:29,490
In this example, we've determined

89
00:03:29,490 --> 00:03:31,920
that implementing AV protection control

90
00:03:31,920 --> 00:03:33,750
does not change the exposure factor,

91
00:03:33,750 --> 00:03:36,510
we're still saying the
exposure factor is 100%,

92
00:03:36,510 --> 00:03:39,030
but it does change the
annual rate of occurrence.

93
00:03:39,030 --> 00:03:40,650
That the AV protection control,

94
00:03:40,650 --> 00:03:43,350
we've determined, is
going to reduce the ARO

95
00:03:43,350 --> 00:03:46,410
from four hours per year
to two hours per year.

96
00:03:46,410 --> 00:03:48,690
So we didn't need to recalculate the SLE

97
00:03:48,690 --> 00:03:50,280
because the asset value didn't change

98
00:03:50,280 --> 00:03:52,290
and the exposure factor didn't change,

99
00:03:52,290 --> 00:03:54,690
but we do need to recalculate the ALE

100
00:03:54,690 --> 00:03:56,850
because the ARO has changed.

101
00:03:56,850 --> 00:03:59,190
So our new ALE is 15,

102
00:03:59,190 --> 00:04:00,930
which is the SLE times 2,

103
00:04:00,930 --> 00:04:03,180
2 hours per year, is $30.

104
00:04:03,180 --> 00:04:06,420
So our new ALE is $30.

105
00:04:06,420 --> 00:04:09,390
So ALE1 was $60.

106
00:04:09,390 --> 00:04:11,220
ALE2 is 30.

107
00:04:11,220 --> 00:04:12,330
Well, that looks great.

108
00:04:12,330 --> 00:04:14,040
It's like 1/2 of it.

109
00:04:14,040 --> 00:04:15,510
Well, yeah, except that we have

110
00:04:15,510 --> 00:04:17,190
to also take into account

111
00:04:17,190 --> 00:04:18,900
the cost of the control,

112
00:04:18,900 --> 00:04:20,640
and perhaps the cost of the control

113
00:04:20,640 --> 00:04:24,240
on a per-workstation basis was $39 a year.

114
00:04:24,240 --> 00:04:27,960
So our cost-benefit
analysis is really ALE1,

115
00:04:27,960 --> 00:04:30,780
which was 60, versus ALE2,

116
00:04:30,780 --> 00:04:32,970
which is actually $69,

117
00:04:32,970 --> 00:04:35,310
because it was ALE2

118
00:04:35,310 --> 00:04:37,860
plus the cost of the control,

119
00:04:37,860 --> 00:04:39,810
30 plus 39.

120
00:04:39,810 --> 00:04:43,320
So now we have a new
determination to make, right?

121
00:04:43,320 --> 00:04:46,080
ALE2, right, plus the cost of control

122
00:04:46,080 --> 00:04:48,303
is really more expensive than ALE1.

123
00:04:49,260 --> 00:04:51,450
Well, if all we were doing was taking this

124
00:04:51,450 --> 00:04:52,710
into account, we might say, "No,

125
00:04:52,710 --> 00:04:54,210
we're not gonna invest in that control.

126
00:04:54,210 --> 00:04:56,400
We wanna look at other controls."

127
00:04:56,400 --> 00:04:58,080
Well, that still might be an option,

128
00:04:58,080 --> 00:05:00,420
but we also then need to broaden our scope

129
00:05:00,420 --> 00:05:03,330
and think about, are there any other costs

130
00:05:03,330 --> 00:05:06,330
that also should be
considered or included,

131
00:05:06,330 --> 00:05:08,790
like reputation cost, perhaps?

132
00:05:08,790 --> 00:05:11,370
So this isn't necessarily
just stand-alone.

133
00:05:11,370 --> 00:05:13,440
We have to really take into account

134
00:05:13,440 --> 00:05:16,710
sort of a lot of
big-picture considerations

135
00:05:16,710 --> 00:05:19,080
when we're doing our risk assessments.

136
00:05:19,080 --> 00:05:20,850
And that, my friends, is a closer look

137
00:05:20,850 --> 00:05:24,993
at quantitative risk analysis
and a cost-benefit analysis.