English
Menu

Cyber Attacks and Defense in Practice

For ransomware damage, the loss per incident (SLE) is estimated at 40 million yen and the annual number of occurrences (ARO) at 0.5. Control A costs 6 million yen a year and reduces occurrences to 0.2 per year. Control B costs 3 million yen a year and does not change the number of occurrences but speeds up recovery, reducing the loss per incident to 24 million yen. With the annualized loss expectancy ALE = SLE × ARO and ROSI = (reduction in ALE − annual cost of the control) ÷ annual cost of the control, which of the following correctly gives the control with the larger ROSI and its value?

  1. AControl B, about 167%
  2. BControl A, 100%
  3. CControl B, about 267%
Show answer and explanation

Answer: A. Control B, about 167%

The ALE before the controls is 40 million yen × 0.5 = 20 million yen. After control A it is 40 million yen × 0.2 = 8 million yen, a reduction of 12 million yen, and the ROSI is (12 − 6) ÷ 6 = 1.0, or 100%. After control B it is 24 million yen × 0.5 = 12 million yen, a reduction of 8 million yen, and the ROSI is (8 − 3) ÷ 3 ≈ 1.67, or about 167%, so B gives more effect per unit of cost. However, the net benefit (reduction − cost) is 6 million yen for A and 5 million yen for B, larger for A, so the decision considers both the ratio and the amount according to budget constraints.

  • A. Correct. (8 − 3) ÷ 3 ≈ 1.67, which is larger than control A's 1.0.
  • B. This is the ROSI of control A. A has the larger reduction in ALE (12 million yen), but its ROSI is smaller than B's.
  • C. This value divides the reduction in ALE by the cost without subtracting the cost (8 ÷ 3 ≈ 2.67).
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. An IDS examines 1 million connections a day, of which 100 are actual attacks. The IDS detects 99% of attacks and wrongly judges 0.1% of non-attack connections to be attacks. Which of the following is closest to the proportion of the alerts raised by the IDS that are actual attacks?
  2. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?
  3. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?
  4. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?
  5. Which of the following is an "initial access" method, by which an attacker first gets into an organization's network?

Comparisons in this topic