ALE, ARO, exposure factor, ransomware guidance

[ErikPost]

Hi, 

does anyone know of average estimation of loss expectancy calculations in case of ransomware attacks?

Regards,

Erik

[denbesten]

Many organizations have reported on that, and have also observed the cost going up over time.  I suggest a search such as:

https://www.google.com/search?q=cost+of+a+ransomware+attack

[Caute_cautim]

@ErikPost   Its about time we got away from qualification of risks, and put arbitrary values on impacts, and threats.  I suggest we approach this with real data, using quantification for far better messages towards the C-Suite and using their own language.

I.e. Open Group - FAIR method or a commercial example:

https://www.opengroup.org/certifications/openfair

https://www.risklens.com/resource-center/blog/fbi-warns-on-high-impact-more-sophisticated-ransomware...

Lets get real and use real data.

Regards

Caute_cautim

[aaronrawcliffe]

Hi Erik,

Linking below an information sheet looking at the extent of ransomware attacks from the past year globally - it includes a heatmap of publicly disclosed attacks by country as well as pulling together information from various different sources to give a complete picture on what is happening.

It's growing all the time of course - 2020 the average cost of remediation was around $0.76m and this year it is $1.85m (according to Sophos).

https://ransomwareresilience-usa.com/events/ransomware-resilience-summit-usa#resources (click the 'extent of ransomware attacks globally here)

Aaron