-: In the last lesson, we discussed qualitative risk analysis
and the lack of numbers that it used.
Now, we're going to look at the other side of the equation:
quantitative risk analysis, which heavily relies
on numbers and monetary values
for all parts of the risk analysis.
This includes numerically assigning values
to the value of the assets, the threat frequency,
the severity of the vulnerabilities,
and the impact of the realization of a given threat.
Now, with quantitative risk analysis,
this is going to remove much of the estimation
and guesswork from a risk assessment,
because it's going to turn this
into a large math problem instead.
Equations are used to determine the total
and residual risk, as well as provide you
with a cost directly associated with those risks.
This is going to allow us to have a numerical method
to represent the magnitude of the impact of a risk.
The magnitude of impact is an estimation
of the amount of damage that a negative risk might achieve.
This is also known as a risk impact,
and it can be measured financially using:
quantitative methods or qualitative methods.
Now, when rating risk, it's usually done on a scale
with negligible losses being classified
as a low-level, and significant losses,
being classified as a high level.
Most often, though, managers prefer
to have these risks represented by a quantitative method,
resulting in a financial number.
These fiscal values allow personnel in the organization
to better understand the cost associated
with a given risk and its impact.
The three most common calculations used
in determining the magnitude of an impact
in a quantitative risk analysis is:
the Single Loss Expectancy, or SLE,
the Annualized Rate of Occurrence, or ARO,
and the Annualized Loss Expectancy or ALE.
Let's start with Single Loss Expectancy.
Single Loss Expectancy is the cost,
associated with the realization
of each individualized threat that occurs.
It's calculated by multiplying the asset's value
times an exposure factor.
Now, the exposure factor is simply the amount of the asset
that's going to be lost if the threat is realized.
Let's look at an example of this.
If I have a file server that has an asset value
of $10,000, and a given threat against it
of a power failure that would reduce the functionality
of the file server down to 20%,
this means my exposure factor is 20%.
Then, the single loss expectancy
for a given realization of this power loss would be $2000.
That would be the 20% times 10,000.
Now, the next concept we have is,
an Annualized Rate of Occurrence or ARO.
ARO is calculated simply by determining
how many times per year is a threat going to be realized.
Now, the Annual Loss Expectancy, on the other hand,
is the expected cost of a realized threat over a given year.
This is calculated by multiplying the Single Loss Expectancy
times the Annual Rate of Occurrence,
so going back to our file server example,
we have a single loss expectancy of $2000.
Now, if the power loss occurs three times
in a given year, that would be $2000
times three times a year, which gives us $6000
for our annualized loss expectancy or ALE.
Now, on the other hand, if we expect
to lose power only once every two years,
that means we're going to multiply the $2000 single loss
times 50% or once every two years, one-half.
Now, this gives us an annualized loss expectancy
of only a thousand dollars.
Now, it's great that we learned how
to calculate these three values, but why is this important?
Well, the ALE is really important to us
because we use it in our decision-making.
If we're afraid of losing power to our servers,
well, there's some controls that we can put
in place to prevent this from occurring.
If we decide we wanted
to build a really redundant power supply
that serves the entire server room,
and it's going to make it really, really secure,
we can add up all the construction costs
and the equipment costs and compare that to the ALE
and determine if it's a good investment,
so in our example, let's say that it cost us $200,000
to build out a really great server room
that's going to make sure we never, ever lose power.
We've got battery backups, we've got generators;
all that kind of stuff. Now, how long would it take
for us to make back that initial investment of $200,000
by offsetting the risk that that ALE represents?
Well, if we take our annualized loss expectancy,
and it was $6000
because we lost power three times every year,
it's going to take us over 33 years
for us to make up that capital expenditure
of $200,000, so I'm no mathematician,
but I think we probably shouldn't do it.
Based on that magnitude of impact,
it just doesn't make sense for us to move forward
with building a $200,000 server room to address a threat
that we wouldn't even lose $6000 a year on.
This is why managers love quantitative risk analysis,
because it makes decision-making really easy,
because you can just start comparing numbers
to make up your mind, instead of having
to rely on your expertise and your experience.
It's also easier to justify to upper management
if they make a bad decision based on numbers,
because if the decision turns out wrong,
but the numbers supported it,
that's really a risk mitigation in their own career.
Now, with all that being said, it's important
to realize that in reality, a good IT director isn't going
to rely solely on quantitative analysis,
but instead we use hybrid approaches.
This is often because there's not enough data
to accurately, only use a quantitative method,
so we're going to bring in our experience
and that qualitative means also
and factor that into the analysis.
There's always some level of subjectivity to the data,
making most analysis a combination
of quantitative and qualitative approaches.
This is why IT directors tend to be people
with years of experience in the world of IT and security,
because they need that prior experience to rely on
when they're making decisions, because you can't factor
in just those quantitative assessments,
and you have to bring in that knowledge and experience
to get a more accurate picture.