I need help with the following :
Imagine you are a cybersecurity analyst for a retail company. The company has assessed that the Single Loss Expectancy (SLE) for a data breach is $500,000. The exposure factor (EF) for such an event is estimated at 0.85, and the Annualized Rate of Occurrence (ARO) is 0.60. Additionally, the residual risk is calculated to be $200,000. Based on these metrics, what would be the resulting Annualized Loss Expectancy (ALE) for a data breach?
A. $255,000
B. $510,000
C. $300,000
D. $425,000
I have got the answer as C ( ALE = SLE × ARO) = (500,000 x 0.60)
But the sugggested answer is D
Answer: D. $425,000.
Explanation: The Annualized Loss Expectancy (ALE) is calculated by first determining the Single Loss Expectancy (SLE), which is the product of the asset value and the exposure factor (EF). In this case, the SLE would be $500,000 multiplied by 0.85, resulting in $425,000. The ALE is then calculated by multiplying the SLE by the Annualized Rate of Occurrence (ARO), which is 0.60. However, since the ALE is essentially an annualized version of the SLE in this specific scenario, the ALE would also be $425,000. The residual risk of $200,000 is a separate metric that indicates the remaining risk after security measures have been applied and does not directly factor into the ALE calculation for this question.
Can anyone please enlighten me on this ?
