What is the formula for calculating Aro?
|
In accounting, an asset retirement obligation (ARO) describes a legal obligation associated with the retirement of a tangible, long-lived asset, where a company will be responsible for removing equipment or cleaning up hazardous materials at some future date. AROs should be included in a company's financial statement to present a more accurate and holistic snapshot of the enterprise's overall value. Show
Key Takeaways
Understanding Asset Retirement ObligationsAsset retirement obligation accounting often applies to companies that create physical infrastructure which must be dismantled before a land lease expires, such as underground fuel storage tanks at gas stations. AROs also apply to the removal of hazardous elements and/or waste materials from the land, such as nuclear power plant decontamination. The asset is considered to be retired once the clean up/removal activity is complete, and the property is restored back to its original condition. An Example of an Asset Retirement ObligationConsider an oil-drilling company that acquires a 40-year lease on a parcel of land. Five years into the lease, the company finishes constructing a drilling rig. This item must be removed, and the land must be cleaned up once the lease expires in 35 years. Although the current cost for doing so is $15,000, an estimate for inflation for the removal and remediation work over the next 35 years is 2.5% per year. Consequently, for this ARO, the assumed future cost after inflation would be calculated as follows: 15,000 * (1 + 0.025) ^ 35 = 35,598.08. Asset Retirement Obligations OversightBecause calculating asset retirement obligations can be complex, businesses should seek guidance from Certified Public Accountants to ensure compliance with the Financial Accounting Standards Board's Rule No. 143: Accounting for Asset Retirement Obligations. Under this mandate, public companies must recognize the fair value of their AROs on their balance sheets in an effort to render them more accurate. This represents somewhat of a departure from the income-statement approach many businesses previously used. Asset Retirement Obligation: Calculating Expected Present ValueTo calculate the expected present value of an ARO, companies should observe the following iterative steps:
Asset Retirement Obligations do not apply to unplanned cleanup costs resulting from unplanned events, such as chemical spills and other accidents. While the SLE is a valuable starting point it only represents the single loss an organization would suffer. Since many organizations suffer the same loss multiple times a year, you have to take the ARO (annualized rate of occurrence) and include it in the formula. This is done by calculating the ALE: ALE=SLE×annualizedrateofoccurrence(ARO). The ALE is what you always use to determine the cost of the risk and the TCO (total cost of ownership) is what is used to calculate the cost of a solution. Read moreNavigate DownView chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597499491000048 Performing the Business Risk AssessmentLaura P. Taylor, in FISMA Compliance Handbook, 2013 Quantitative risk assessmentOnce you have determined which threats create the greatest risk exposure to the business, you can then use quantitative risk assessment methods to determine how much the agency should spend to mitigate the potential threat. Quantitative risk assessment associates loss with a financial value. The goal of understanding financial loss is to give you more information in making decisions about the procurement and implementation of safeguards. Quantitative risk assessment is essential if you want to perform cost-benefit analysis to figure out if implementing a particular safeguard is financially worth the cost. If the anticipated annual loss (also referred to as annual loss expectancy) is less than the annualized cost of the safeguard, then it is usually not worth it to implement the safeguard. For example, if a data center is in a city that is prone to electrical grid outages, then it might make sense to invest in more generators only if the annual loss is greater than the annualized cost of new generators (the safeguard). (The loss caused by the electrical grid, could mean loss of data, loss of customers, or some other loss.) Let’s look at a more detailed example related to natural disasters to figure out financial loss based on quantitative risk assessment methods. If you look at Figure 17.4, you will see that in Florida alone there are different probabilities throughout the state for hurricanes with wind speeds greater than 100 knots. To calculate the risk of a hurricane occurring in Miami, Florida, you need to understand the likelihood of one occurring each year. If a hurricane occurs once every 20 years (1 of 20), then it has a 5% chance of occurring yearly since 1/20 = 0.05, which equals 5%.  Figure 17.4. Probabilities of hurricanes in Florida localities. Source: USGS.The frequency of Florida hurricanes with wind speeds greater than or equal to 100 knots is mapped in terms of the probability of occurrence during a 20-year exposure window. These probabilistic estimates, based on 1006 years of observations, illustrate that hurricanes with 100-knot winds occur more frequently in southern Florida and gradually decrease in frequency toward northern Florida [2]. The threat frequency (or likelihood) for natural disasters can be calculated by using an Annualized Rate of Occurrence (ARO). An ARO is a constant number that tells you how often a threat might occur each year. AROs can be broken down into subvalues known as Standard Annual Frequency Estimates (SAFE) and Local Annual Frequency Estimates (LAFE). The SAFE value is the number of times a specific threat is expected to occur annually in a large geographic region such as North America. The LAFE value is the number of times a specific threat can be expected to occur annually in a smaller, local geographic region such as Miami, Florida. For the purpose of FISMA compliance, it is more appropriate to use LAFE values. (If we were going to assess all the systems in North America in one Security Package, we might use SAFE values for that. Such a Security Package of course would be a Sisyphean exercise.) ARO values (SAFE and LAFE) typically are represented as rational numbers or as a decimal value as shown in Table 17.5. (A rational number is a number that can be expressed equivalently as a fraction.) Table 17.5. Threat Values for Annualized Rates of Occurrence ARO (LAFE) ValuesExpressed as a PercentageExpressed as a DecimalExpressed as a FractionFrequency of Occurrence10.011/100Once every 100 years20.021/50Once every 50 years50.051/20Once every 20 years100.101/10Once every 10 years200.21/5Once every 5 years10011/1Once a year10001010/110 times a year10,0002020/120 times a year The reduction in the value of an information system from one threat (or incident) is referred to as a Single Loss Expectancy (SLE). If one of the servers in your hardware and software inventory is valued at $100,000, and a hurricane destroys 90% of it, the value of the system has been reduced by $90,000, which is represented by the SLE equation: SLE=OriginalTotalCost–RemainingValue SLE$90,000=$100,000–$10,000 It is possible that instead of a hurricane, a hacker might destroy 90% of the server and the same SLE formula would apply. Once you know the SLE, you can determine an Annual Loss Expectancy (ALE). ALE is a risk exposure standard that is computed by multiplying the probability of a loss from a threat (or incident) by the reduction in value of the information system [1]. ALE is a metric that was developed by the National Bureau of Standards in 1979. In the mid-1980s, the National Bureau of Standards became part of the National Institute of Standards and Technology. ALE values are useful to perform cost-benefit analysis so that you can figure out if spending money on a particular safeguard is worth it or not. ALE values can be determined for any type of threat whether it is a threat launched by an adversary, or a natural disaster. To determine the ALE for this same $100,000 system, use the formula: ALE=LAFE×SLE RE=PL×SL The LAFE value is the probability of potential loss, or P(L). The SLE, or the loss from a one-time occurrence of the incident, is the severity of the loss, S(L). If the system is located in Miami, Florida, and hurricanes have a 5% chance of occurring yearly: ALE=$0.05×$90,000=4,500 Every year, the one-information system located in Miami, Florida, is being exposed to an annual loss expectancy of 4,500 from hurricanes alone. If there are 1000 systems at this facility in Miami, all with the same ALE, that would come to a whopping cumulative ALE of $4,500,000. Even if moving the facility to a different location costs $1,000,000, in this case it would be worth it since the safeguard (e.g., the move) would be far less expensive than the Annual Loss Expectancy. An additional resource that explains quantitative risk assessment is an article titled “Security Scanning is not Risk Analysis” in the Intranet Journal (http://www.web.archive.org/web/20030207102906/http://www.intranetjournal.com/articles/200207/se_07_14_02a.html). View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780124058712000178 Layer 8: The People LayerIn Hack the Stack, 2006 Quantitative AssessmentImagine all the scenarios in which your assets are threatened, and determine what portion of those asset would be lost if each threat became a reality. The percentage of the asset value that would be lost is the exposure factor (EF). The dollar (or other currency) amount that would be lost if the threat was realized is the single loss expectancy (SLE), and is computed using the following formula: SLE = asset value x exposure factor If only half of a $1,000,000 asset is lost in an incident, then the exposure factor is 50 percent and the SLE is $500,000. It is possible for a loss to exceed the asset’s value to the corporation, such as in the event of a massive product liability lawsuit; in this case, the EF would be greater than 100 percent. Of course, some threats are more likely to materialize than others. The term for the frequency of threats each year is the annualized rate of occurrence (ARO). If we expect a threat to occur three times per year on average, then the ARO equals 3. If another threat is expected to occur only once in ten years, the average would be one tenth of an occurrence each year, giving an ARO of 0.1 for that threat. An important factor in the ARO is how vulnerable you are to a particular threat. For our information systems, we can refer to vulnerability databases published on the Web, which tell us what known vulnerabilities exist for a particular version of a particular product. However, vulnerabilities in information systems don’t only come from programming errors. Improper installation and configuration of a product can also make it vulnerable. A vulnerability scanner program can automate much of the work of identifying vulnerabilities in these systems. Now we can combine the monetary loss of a single incident (SLE) with the likelihood of an incident (ARO) to get the annualized loss expectancy (ALE). The ALE represents the yearly average loss over many years for a given threat to a particular asset, and is computed as follows: ALE = SLE x ARO Some risk assessment professionals add another factor: uncertainty. If we have good historical data to support our quantification of asset value, exposure factor, and annualized rate of occurrence, then we are very certain of the risk. If we used a dart board to assign any of these component values, then we have considerable uncertainty of the risk. We can revise our last formula to account for this: ALE = SLE x ARO x uncertainty where uncertainty ranges from one for completely certain, to numbers greater than one for more uncertainty (e.g., an uncertainty of 1.5 means that the ALE might be 50 percent more than the estimate of SLE × ARO; an uncertainty of 2.25 means that the ALE might be more than double our estimate).Table 9.2 shows quantitative risk assessment calculations. Table 9.2. Quantitative Risk Assessment Calculations Asset NameAsset ValueExposure FactorSLEAROUncertaintyALEBuilding$6,000,00050 %$3,000,000.071$210,000Customer View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597491099500137 Domain 1Eric Conrad, ... Joshua Feldman, in Eleventh Hour CISSP® (Third Edition), 2017 Answers1. Correct answer and explanation: C. The ARO is the number of attacks in a year. Incorrect answers and explanations: Answers A, B, and D are incorrect. The AV is $20,000. The EV is 40% and the monthly cost of the DoS service (used to calculate TCO) is $10,000. 2.Correct answer and explanation: D. The ALE is derived by first calculating the SLE, which is the AV, $20,000, multiplied by the EF, 40%. The SLE is $8000, which is multiplied by the ARO of 7 for an ALE of $56,000. Incorrect answers and explanations: Answers A, B, and C are incorrect. $20,000 is the AV, while $8000 is the SLE. 3.Correct answer and explanation: C. The TCO of the DoS mitigation service is higher than ALE of lost sales due to DoS attacks. This means it is less expensive to accept the risk of DoS attacks or to find a less expensive mitigation strategy. Incorrect answers and explanations: Answers A, B, and D are incorrect. The annual TCO is higher, not lower. $10,000 is the monthly TCO; you must calculate yearly TCO to compare with the ALE. 4.Correct answer and explanation: A. The canons are applied in order and “To protect society, the commonwealth, and the infrastructure” is the first canon, and is thus the most important of the four canons of The (ISC)2® Code of Ethics. Incorrect answers and explanations: Answers B, C, and D are incorrect. The canons of The (ISC)2® Code of Ethics are presented in order of importance. The second canon requires the security professional to act honorably, honestly, justly, responsibly, and legally. The third mandates that professionals provide diligent and competent service to principals. The final and therefore least important canon wants professionals to advance and protect the profession. 5.Correct answer and explanation: Files, database tables, and tax forms are example of objects, so they should be dragged to the right (Fig. 1.6). Fig. 1.6. Drag and drop answer. Incorrect answers and explanations: A running process and a user are examples of subjects. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128112489000012 Domain 3: Information Security Governance and Risk ManagementEric Conrad, ... Joshua Feldman, in Eleventh Hour CISSP (Second Edition), 2014 Answers1. Correct answer and explanation: A. Answer A is correct; policy is high level and avoids technology specifics. Incorrect answers and explanations: B, C, and D. Answers B, C, and D are incorrect. B is a procedural statement. C is a guideline. D is a baseline. 2.Correct answer and explanation: C. Answer C is correct; the Annual Rate of Occurrence is the number of attacks in a year. Incorrect answers and explanations: A, B, and D. Answers A, B, and D are incorrect. $20,000 is the Asset Value (AV). Forty percent is the Exposure Factor (EF). $10,000 is the monthly cost of the DoS service (used to calculate TCO). 3.Correct answer and explanation: D. Answer D is correct; Annualized Loss Expectancy (ALE) is calculated by first calculating the Single Loss Expectancy (SLE), which is the Asset Value (AV, $20,000) times the Exposure Factor (EF, 40%). The SLE is $8000; multiply by the Annual Rate of Occurrence (ARO, 7) for an ALE of $56,000. Incorrect answers and explanations: A, B, and C. Answers A, B, and C are incorrect. $20,000 is the Asset Value. $8000 is the Single Loss Expectancy. 4.Correct answer and explanation: C. Answer C is correct; the Total Cost of Ownership (TCO) of the DoS-mitigation service is higher than Annualized Loss Expectancy (ALE) of lost sales due to DoS attacks. This means it's less expensive to accept the risk of DoS attacks (or find a less expensive mitigation strategy). Incorrect answers and explanations: A, B, and D. Answers A, B, and D are incorrect. A is incorrect: the TCO is higher, not lower. $10,000 is the monthly TCO; you must calculate yearly TCO to compare with the ALE. D is wrong: the annual TCO is higher, not lower. 5.Correct answer and explanation: D. Answer D is correct; the data owner ensures that data has proper security labels. Incorrect answers and explanations: A, B, and C. Answers A, B, and C are incorrect. Custodians patch systems. Users should be aware and report suspicious activity. Ensuring files are backed up is a weaker answer for a data owner duty, used to confuse the data owner with “the owner of the file” on a discretionary access control system. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780124171428000030 Jargon, Principles, and ConceptsMark Osborne, in How to Cheat at Managing Information Security, 2006 Risk AnalysisThe details we have covered to now have one primary aim: to help us quantify and manage the risk to our information. The quantifying approach is known as risk analysis, and these days many of you will be very familiar with some semiformal techniques. These techniques appear in the system development methodologies, project management methodologies, heath and safety processes, and insurance evaluations. If I had written this chapter five years ago, the examples and explanations would have needed to be far more detailed. However, I am going to assume everybody needs a refresher. Types of Risk AnalysisThere are many types of risk analysis. Common security risk analysis methods and tools include: ■CRAMM ■SARAH ■IS1 and IS3 ■VISART ■Delphi Most texts suggest that these methods fall into one of two categories: either quantitative or qualitative. The former is based on math, the latter on expert feel. This is certainly the approach you have to take if you want to pass your CISSP. However, the realism of the situation is that all good methods use a mix of both techniques, so they tend to vary along a continuum of more qualitative versus more quantitative. I have read some articles that suggest a qualitative approach isn’t objective—complete tripe! Qualitative methods have been successful for years, and executives have been analytical since companies began. Make your own mind up; if you want to read more, I have been commended to the International Society for the Scientific Study of Subjectivity (www.qmethod.org). Quantitative AnalysisIn theory, quantitative analysis always has a mathematical basis for your grading. Take, for example, an assessment that tries to establish the risk of your main office (with a view to setting up alternative facilities). Your methodology would work through a series of threats. Sooner or later it would come to the threat of flooding: 1.As a first step in a quantitative analysis, you would access the environmental agencies’ flood data for a percentage. If it is less than 0.01 percent, you probably would not bother to analyze further. 2.DoE will give you a broad number. You might wish to contact your insurance company for a better number. On the last project I worked on, the number was 2 percent chance of a flood in a year. You now have a probability; this is known as the annual rate of occurrence, or ARO. 3.You use historic information from your insurer, building contractors, or the London fire brigade regarding how long it will take to clean up and get back in business after a disaster. In the example, we estimated a three-week period. 4.You contact your accounts department for the amount of revenue you would lose (at your busiest period) if you were unable to operate for this period of time. This is called single-loss expectancy (SLE). In this example, the SLE was $1 million. 5.You annualize your loss due to flooding. The annual loss expectancy (ALE) is the product of the SLE multiplied by the ARO—in our case, $lm * 1/100 = $100,000. Qualitative AnalysisQualitative analysis is portrayed as being very emotional. It should be very interview based, and you would seek to talk to all major department heads. You would brief them and they would probably allocate a senior member of their department to work with you. You would then run through, either in a series of workshops or on an individual basis, the probability of each threat and rate it as high, medium, or low. Table 3.1 is a typical table resulting from such an exercise. Table 3.1. Qualitative Analysis of Threats to a Business ThreatLikelihoodLoss of business due to floodingHIGHLoss of business due to fireMEDIUMLoss of business due to bombLOW Hence the term qualitative, since the use of terms such as HIGH, MEDIUM, and LOW are completely subjective and determined by factors outside the control of the researcher. You would then ask them to guess at a financial impact of such an event. How It Really Works: Strengths and WeaknessesNo one conducts these exercises in such a banal manner. A good exercise will draw the best from both types of analysis: ■It is very important to get a ballpark figure from DoE to show the local propensity to flooding. But you as a security expert need to use your expertise to modify this information. For example, your area might not be generally at risk of flooding, but if you built your business in a bomb-proof bunker 20 feet below ground at the foot of a hill, you as an expert could decide that the risk is greater than for other standard buildings in the same locale. Especially if last Thursday, you ruined your best shoes in a puddle the size of Loch Ness getting to your car. ■The length of the outage is specific to your trade. If you use custom-built machines that take a year to build, you can’t replace them in three weeks. ■You need to consult both the accounts team and the individual departments to get a balanced scorecard value to represent loss. It is unlikely that department managers will know the true accounting revenue of a department at a given period. They will nearly always “big it up.” It is also true that the accounts department might not be aware of interdepartmental dependencies. For example, the IT department might not be a revenue center, but how many businesses these days can survive without it? Relying on accounting and reporting revenue alone is a big mistake. It certainly will not account for the following important aspects: ■Customer churn In many businesses, the loss of a few customers’ revenue is not as important as keeping the customers. ■Third-party consequential loss Will you be liable for unlimited loss? ■Loss of reputation How much do you spend on telling customers that you are sinkable—that money is now wasted? ■Legal or regulatory infraction ■But doing the ALE = SLE * ARO calculation is essential. Risk or impact should always be expressed as a monetary value. This type of analysis works very well for physical disasters but can be very hard to apply to other areas. This is because it requires general statistics on external threats and their likelihood but then requires you to modify them for your own local conditions. I have heard many complaints about this, particularly relating to analysis of hacks and virus exposures. I recommend you take a look at FIRST’s (www.first.org) Common Vulnerability Scoring System (CVSS). This system takes into account global factors about a threat, such as how a vulnerability compromises an operating system and how that vulnerability affects the classic CIA principles; these are provided by a manufacturer or a CERT. It then allows each individual site to consider the placement of the potential vulnerable system and the importance of that computer to the organization. It’s a nice technique that combines technical and local factors. In practice, to do this kind of job right for an enterprisewide threat will involve external statistical references and facts modified by local subjective threat modifiers. Take a look at FIRST’s CVSS. This takes global facts, such as how a vulnerability compromises an operating system, accounts for classic CIA principles, and then allows each site to consider the placement and importance of that computer to the organization. It’s both quantitative and qualitative. So What Now?You now know which risks affect you the most. This is your risk profile. Now you have to prioritize the risks based on the potential loss and deal with them in turn (see Table 3.2). Table 3.2. Prioritizing Business Risks ThreatAnnual Expected Loss ($)PriorityLoss of business due to flooding10,000,0001Loss of business due to fire500,0002Loss of business due to DDoS attack400,0003 For each threat, you have the following choices: ■Accept the risk Make sure that the directors of the company formally document that it is a gamble that they are prepared to take. A member of the senior management team waving his hand saying “It’ll never happen” isn’t quite the same. ■Transfer the risk Typically, this means insurance, but it can mean outsourcing—for example, outsourcing the plant to a bigger organization that can provide alternative processing facilities as part of the deal. ■Counter, reduce, or manage the risk This means fixing the problem. Obviously the fix needs to cost less than the financial impact. The one thing you can’t let happen is for management to ignore the risk. This process is known as your risk treatment. View chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597491105500105 Information Governance and Risk ManagementTimothy Virtue, Justin Rainey, in HCISPP Study Guide, 2015 1. A structure consisting of policies, processes, procedures, behaviors, and technologies designed to assist with managing information throughout its life cycle is defined as: a.Administrative safeguards b.Privacy and security governance c.Physical safeguards d.Information governance 2.Actions, policies, and procedures involved in the selection, development, implementation, and maintenance of security measures are defined as: a.Administrative safeguards b.Privacy and security governance c.Physical safeguards d.Information governance 3.The Chief Information Officer is: a.The highest-level official within an organization with overall responsibility for providing information security protections b.Responsible for designating a senior information security officer c.Responsible for carrying out chief information security responsibilities d.An organizational official with statutory, management, or operational authority for specified information and the responsibility for establishing the policies and procedures governing its generation, collection, processing, dissemination, and disposal 4.The organizational official responsible for the procurement, development, integration, modification, operation, maintenance, and disposal of an information system is: a.Authorizing official b.Information owner/steward c.Information system owner d.Chief Information Officer 5.NIST SP 800-39 outlines approaches to information security governance that include all of the following except: a.Centralized b.Hybrid c.Decentralized d.Uniform 6.The International Organization for Standardization: a.Has published an information governance toolkit designed to enable organizations and partners to assess compliance with the various laws, policies, and standards associated with information governance b.Is responsible for the SP 800 series (computer security) and SP 500 series (information technology) publications relating to computer security c.Is responsible for publication of the 27002:2005 and 27799:2008 standards d.a and c 7.Framing involves: a.Understanding the environment in which the organization operates b.Understanding risk tolerance to ensure risk is appropriately framed c.Assessing risk to identify threats, vulnerabilities, potential impact, and likelihood of harm d.Evaluating risk over time for the purpose of evaluating control effectiveness, identifying system and environment changes that create risk, and ensuring risk responses are implemented in alignment with business objectives, regulatory requirements, and security and privacy policies, standards, and guidelines 8.Qualitative assessments: a.Involve non-numerical categories or levels (e.g., low, moderate, high) and can be more effective when communicating with stakeholders b.Involve an analysis largely involving numbers (e.g., $10,000, $50,000, $100,000), visible properties, and statistics and a set of methods, principles, or rules for assessing risk c.a and b d.None of the above Annual loss expectancy (ALE) is: a.The anticipated frequency that a single loss expectancy (SLE) event is projected to occur in a 12-month period b.The expected loss over a 12-month period based on the SLE of an event and the annual rate of occurrence (ARO) c.ALE = SLE × ARO d.b and c 10.A vulnerability is: a.Any event with the potential to adversely impact the confidentiality, integrity, or availability of information systems through unauthorized access, destruction, disclosure, or modification of information, or denial of service b.Any weakness in an information system such as servers, networks, and infrastructure that could be intentionally or unintentionally exploited by a threat c.A measure of the extent to which an organization is threatened by a particular event d.a and c 11.A risk is: a.Any event with the potential to adversely impact the confidentiality, integrity, or availability of information systems through unauthorized access, destruction, disclosure, or modification of information, or denial of service b.Any weakness in an information system such as servers, networks, and infrastructure that could be intentionally or unintentionally exploited by a threat c.A measure of the extent to which an organization is threatened by a particular event d.a and c 12.Risk treatment generally involves the following options: a.Transfer, acceptance, mitigate, eliminate b.Acceptance, transmit, mitigate, deflect c.Avoid, transfer, eliminate, manage d.Mitigate, transfer, acceptance, avoid 13.Which one of the following formulas is incorrect? a.Managed risk = residual risk − inherent risk b.SLE = asset value × exposure c.ALE = SLE − ARO d.a and c 14.Controls are: a.Any weakness in an information system such as servers, networks, and infrastructure that could be intentionally or unintentionally exploited by a threat b.Techniques, methods, policies, standards, processes, procedures, guidelines, and physical devices designed to increase the vulnerability of an information asset c.Techniques, methods, policies, standards, processes, procedures, guidelines, and physical devices designed to decrease the vulnerability of an information asset d.Techniques, methods, policies, standards, processes, procedures, guidelines, and physical devices designed to maintain the vulnerability of an information asset 15.Likelihood is: a.The expected harm or damage to an organization resulting from the successful exploitation of a vulnerability b.The probability a vulnerability will be motivated and capable of exploiting a threat c.A measure of the extent to which an organization is threatened by a particular event d.None of the above 16.The categorization of information systems, selection, implementation, and assessment of security controls, authorization of information systems, and monitoring of security controls are steps included in the: a.Information governance process b.System development life cycle c.IT governance process d.Information risk management life cycle 17.Intangible loss involves: a.Direct (real) value of physical assets including revenue and server or facility costs b.Indirect value such as brand, reputation, and loss of prospective customers and intellectual property c.Indirect value such as revenue and server or facility costs d.None of the above 18.The information system development life cycle includes the following phases: a.Initiation, development/acquisition, monitoring, disposal b.Disposal, initiation, operational/maintenance, development/acquisition c.Categorization, selection, implementation, authorization, monitoring d.Selection, implementation, monitoring, disposal 19.Centralized governance is defined as: a.Authority, responsibility, and decision-making powers that are distributed between a central body and individual subordinate organizations b.Structure (or framework) consisting of policies, processes, procedures, behaviors, and technologies designed to assist with managing information throughout its life cycle in a manner consistent with stakeholder expectations c.Authority, responsibility, and decision-making powers that are vested solely within central bodies d.Authority, responsibility, and decision-making powers that are vested in and delegated to individual subordinate organizations within the parent organization 20.Risk transfer involves: a.A decision to avoid taking actions or activities that would create new risk for the organization b.Decision to accept a particular risk and its associated losses assuming it falls within an organization’s risk tolerance c.Decision to reduce vulnerabilities through implementation of additional administrative, physical, and/or technical safeguards d.None of the above Read moreNavigate DownView chapterPurchase book Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128020432000057 Information Security Risk AssessmentsMark Talabis, Jason Martin, in Information Security Risk Assessment Toolkit, 2013 Determine ImpactIn all risk assessment frameworks that you will encounter, there will be in some form or another, a measurement of impact. As previously mentioned, impact is the outcome, typically harmful, of a threat applied to an asset. This is also one of the primary components for computing a risk rating. The objective of this activity is to produce a measurement for impact. This will be part of an impact and likelihood matrix, which will ultimately produce your risk ratings. There are many different ways to determine impact and contrary to what you may read in some literature there is no single correct method for determining impact. Quantitative risk assessments, deal with estimating loss based on a financial perspective by using calculations like Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE). As an example, a HIPAA violation not due to willful neglect carries a penalty of $100 for each violation, with the total amount not to exceed $250,000; therefore, we know that if a database with several thousand patient records was compromised, the impact to your organization will be $25,000. But if this was due to willful neglect, the impact could be as much as $1.5 million. This may be the most objective way to determine impact, but in reality, this is highly dependent on information that may not always be readily available. Qualitative determination of impact differs from quantitative in that qualitative risk assessments do not try to put a financial value to the asset and the subsequent monetary losses stemming from the threat. In this approach one measures relative values. For example, if we have a health information system that handles all enterprise wide information processing, a business owner might say that losing the system will affect virtually all operations of the hospital. In this scenario, one might not be able to assign an accurate monetary value without going through hospital financials and working closely with the accounting department, which for all intents and purposes, though helpful, is not the primary objective of an information security risk assessment. In qualitative analysis you would typically assign a relative value. This would be a statement such as “Loss of system availability for the target system will have a HIGH impact in terms of availability of information processing across the organization and could cause significant financial losses.” What is the formula for Aro?ARO = Incidents / Year
Annualized Rate of Occurrence is number of incidents per year.
How is SLE and ARO calculated?Calculating Risk
SLE = asset value × exposure factor . While the SLE is a valuable starting point it only represents the single loss an organization would suffer. Since many organizations suffer the same loss multiple times a year, you have to take the ARO (annualized rate of occurrence) and include it in the formula.
What is the formula for annual loss expectancy?The annualized loss expectancy (ALE) is computed as the product of the asset value (AV) times the exposure factor (EF) times the annualized rate of occurrence (ARO). This is the longer form of the formula ALE = SLE x ARO.
What is ARO in risk management?Annualized Rate of Occurrence, also known as ARO, refers to the expected frequency with which a risk or a threat is expected to occur.
|
