Do the arithmetic until the units stop catching you out

short · 30 min · Objective 5.2

Task

Work SLE, ARO and ALE for six scenarios with deliberately awkward wording, then use the results to make a control decision. Most marks lost here are unit slips on the annualised rate rather than conceptual errors.

Steps

  1. Write /tmp/scenarios.csv with six rows: id,asset_value,exposure_factor,frequency_text, where the frequency is phrased differently each time — 'once every four years', 'twice annually', 'roughly every eighteen months', 'once a decade', 'three times a year', 'once every six months'.
  2. Convert each frequency phrase to an ARO as a decimal, by hand, and add the column.
  3. Compute SLE and ALE for each, by hand, and add those columns.
  4. Now write /tmp/ale.py to compute the same three columns from the asset value, exposure factor and your ARO — and compare against your hand figures. Any disagreement is an arithmetic slip, and finding it is the point.
  5. For two of the scenarios, propose a control with an annual cost and an expected reduction in ARO or exposure factor. Compute the new ALE and decide whether the control is worth buying.
  6. For one scenario, state why the ALE is the WRONG basis for the decision — a low-frequency event with an impact the organisation could not survive.

Verify

python3 /tmp/ale.py /tmp/scenarios.csv
python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/scenarios.csv')))
assert len(rows)>=6, 'fewer than six scenarios'
bad=[]
for r in rows:
    av=float(r['asset_value']); ef=float(r['exposure_factor']); aro=float(r['aro'])
    sle=av*ef; ale=sle*aro
    if abs(sle-float(r['sle']))>0.01: bad.append(r['id']+' SLE')
    if abs(ale-float(r['ale']))>0.01: bad.append(r['id']+' ALE')
assert not bad, 'arithmetic disagrees for: '+', '.join(bad)
aros=sorted(float(r['aro']) for r in rows)
print('ARO values:',aros)
assert aros[0]<1 and aros[-1]>1, 'no scenario below 1 or none above - the awkward phrasings were not used'
print('all six scenarios reconcile')
PY
grep -ciE "survive|catastroph|average|single event" /tmp/scenarios-notes.md

The reconciliation assertion catches the slips this lab exists to find. The ARO range assertion checks you used the awkward phrasings: 'once every four years' is 0.25 and 'three times a year' is 3, and mixing those up changes the answer by a factor of twelve.

Notes

The scenario where ALE is the wrong basis is the one worth remembering. An annualised loss expectancy is an average, and an average is a sound basis for deciding about events you will experience many times. For an event that happens once and ends the organisation, the mean is not the number that should decide anything.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.