Question

Perform a cost benefit analysis for the following scenario. the email server in your company has an estimated value of $5000000. s sabotage or vandalism scenario indicated that 17 percent of the web site would be damaged or destroyeed oin such an attack. an attack of this type can occure twice a year . the comapny had invested in a risk control solution and managed to bring the attack frequency to once every two year, the annual cost of control is $500000. suppose the company identifies another control option at the same cost, which did not reduce the attack frequency but reduced the SLE value to 50%. which control option do you choose?

Answer 1

Answer: I will choose the first control option where I pay 500000$ for a year and 1000000$ for two year and there will be just one attack in two years which will cost around 17% of the total website.

and whereas in second option I pay around 1000000$ for two years and there will be 4 attacks in two years which will cost 17% loss everytime resulting 68% in 2 years but since the SLE(single loss expectancy) will be reduced by 50% i,e instead of 68% we will bear 34% of the loss, which will cost us more as compared to scenario 1. Hence first control option is better.