topic ALE, ARO, exposure factor, ransomware guidance in Governance, Risk, Compliance

ALE, ARO, exposure factor, ransomware guidance

ErikPost — Thu, 07 Oct 2021 20:31:25 GMT

Hi,

does anyone know of average estimation of loss expectancy calculations in case of ransomware attacks?

Regards,

Erik

Re: ALE, ARO, exposure factor, ransomware guidance

denbesten — Thu, 07 Oct 2021 21:33:02 GMT

Many organizations have reported on that, and have also observed the cost going up over time. I suggest a search such as:

https://www.google.com/search?q=cost+of+a+ransomware+attack

Re: ALE, ARO, exposure factor, ransomware guidance

Caute_cautim — Fri, 08 Oct 2021 04:59:47 GMT

@ErikPost Its about time we got away from qualification of risks, and put arbitrary values on impacts, and threats. I suggest we approach this with real data, using quantification for far better messages towards the C-Suite and using their own language.

I.e. Open Group - FAIR method or a commercial example:

https://www.opengroup.org/certifications/openfair

https://www.risklens.com/resource-center/blog/fbi-warns-on-high-impact-more-sophisticated-ransomware-mount-a-sophisticated-defense-with-fair

Lets get real and use real data.

Regards

Caute_cautim

Re: ALE, ARO, exposure factor, ransomware guidance

aaronrawcliffe — Wed, 03 Nov 2021 16:36:53 GMT

Hi Erik,

Linking below an information sheet looking at the extent of ransomware attacks from the past year globally - it includes a heatmap of publicly disclosed attacks by country as well as pulling together information from various different sources to give a complete picture on what is happening.

It's growing all the time of course - 2020 the average cost of remediation was around $0.76m and this year it is $1.85m (according to Sophos).

https://ransomwareresilience-usa.com/events/ransomware-resilience-summit-usa#resources (click the 'extent of ransomware attacks globally here)

Aaron