Quantitative Risk Assessment: YieldMore IT Asset

Quantitative Risk Assessment: YieldMore IT Asset Introduction Information technology assets are vulnerable to various risks internally and externally.

Taking measure to identify and mitigate these risks is important for smooth operation. The purpose of this paper is to identify YieldMore IT assets that are vulnerable to risks as well as providing calculations that direct the organization in prioritizing its risk mitigation efforts. Some of its assets vulnerable to risk and threats from both internal and external environment include customer data, email server, domain controller, senior programming IT employee and ecommerce website.

Buy this excellently written paper or order a fresh one from acemyhomework.com

QUANTITATIVE RISK ASSESSMENT: YIELDMORE IT ASSET

2

1. Customer Database YieldMore has the data of all its customers globally stored in one of its servers. The company is still working on a better way to back-up this data to avoid its loss in case of a technical problem or employee error. The customer data enables the organization to process all business transaction including payment and marketing campaign. Currently, the data is valued at $200,000, and 85 percent of the data is vulnerable to loss due to lack of back up. There is a 45 percent likelihood of the data being lost. This will result in loss of business opportunity, the additional cost of collecting the information from clients, and weakened customer goodwill.

2. Email server YieldMore has also an e-mail server that connects 200 of its client computers to internet particularly for assessing the email. The email server is valued at $35,700 and was installed two weeks ago. The email server does not have software that protects it from antivirus and content filtering. Any attack by a virus may affect 89 percent of the data, and there is a 98 percent chance of the virus attacking.

3. Domain controller The domain controller of YieldMore is valued at $35,000. The main risk facing the domain controller is the disruption in power supply due to break-down of the standby generator that has not been repaired. If the risk occurs, it will have 40 percent effect on the activities of the domain. The likelihood of this risk occurring is 55 percent annually.

4. Senior Programming expert YieldMore relies on one employee to guide the programming of all its IT application.

The organization has invested a lot regarding training in this employee, and he is expected to stay with the organization for at least the next ten years to help it develop a bigger team of

QUANTITATIVE RISK ASSESSMENT: YIELDMORE IT ASSET

3

programming experts. Without the employee, YieldMore may have to spend 1-2 years training another employee. The programming expert is valued at $400,000; hence the cost of losing such an employee to a competitor is enormous. With the loss of the employee, nine-tenths of the programming activities will halt, and there is a 45 percent chance that the employee may voluntarily end the contract.

5. E-commerce Website YieldMore operates an e-commerce website that currently valued at $350,000. The website is exposed to the risk of being hacked by hackers for various reasons. This risk occurring will halt all the business transaction of the company on this website, which is its leading channels of sales. Loss of customer personal information may also adversely affect the reputation of the company. The hacking of the website will affect two-fourths of the company business activity, and there is a probability of 65 percent of this risk occurring.

Asset

Risk

Customer

Loss of

data

data due

Asset

Exposure

Single Loss

Annualized

Annual

Value

Factor

Expectancy

Rate of

loss

(EF)

(SLE)

Occurrence

Expectancy

(ARO)

(ALE)

$200,000

85%

$170,000

0.45

$76,500

$35,700

89%

$31,773

0.98

$31,137.54

failure to back-up.

Email sever

Attack by virus, as it not

QUANTITATIVE RISK ASSESSMENT: YIELDMORE IT ASSET

4

currently installed Domain

Power

$35,000

40%

$14, 000

0.55

$7,700

controller

supply

Turnover

$400,000

90%

$360,000

0.45

$162,000

Hacking

$350,000

50%

$175, 000

0.65

$113,750

disruption Senior programming expert E-commerce Website

QUANTITATIVE RISK ASSESSMENT: YIELDMORE IT ASSET

5

Notes 1. Exposure Factor is the subjectively determined percentage of loss to a particular asset if the identified risk occurs.

2. Single Loss Expectancy (SLE) is the financial loss the organization will suffer if the particular risk occurs to identified assets. Single Loss Expectancy is calculated by multiplying the asset value by the exposure factor as shown: Single Loss Expectancy = Asset Value x Exposure Factor 3. The Annualized Rate of Occurrence (ARO) refers to the frequency of the risks occurring in a year. This value is also assigned depending on the factors increasing the frequency of the risks occurring internally or externally.

4. Annualized Loss Expectancy (ALE) is the annual anticipated financial loss an organization will suffer on it information asset as a result of the risk occurring within the same year. It is this value that the management of YieldMore needs to monitor most to decide whether or not to take the necessary steps to mitigate the risk. One of the ways of justifying taking risk measures is to analyze the cost savings that will result from spending a certain amount of money on mitigating the risk. For instance, if it will cost the YieldMore $200 to install the antivirus to protect its email server from virus attack, then the cost savings will be the difference between the annualized loss expectancy and the cost of antivirus ($31,137.54- $ 200 = $30937.54). This is calculated by multiplying single loss expectancy by an annualized rate of occurrence as shown below: Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO)

QUANTITATIVE RISK ASSESSMENT: YIELDMORE IT ASSET References Harris, S. (2012). CISSP practice exams. New York, NY: McGraw-Hill Professional.

Speed, J. T. (2011). Asset protection through security awareness. London, UK: CRC Press

6