Run the ALE calculation in both directions

short · 40 min · Objective 1.7

Task

Compute an annualised loss expectancy for one risk, then compute what a control would reduce it to, and produce the cost-benefit figure that turns a security preference into a funding case.

Steps

  1. Create lab/ale.csv with header risk,asset_value,exposure_factor,sle,aro,ale.
  2. Fill three risks from lab/risk-register.csv, computing SLE and ALE rather than estimating them.
  3. Add columns control,control_cost_annual,aro_after,ale_after,benefit and compute benefit as ale - ale_after - control_cost_annual.
  4. Include one risk where the benefit is NEGATIVE -- a control that costs more than it saves -- and leave it in.
  5. Write lab/ale-note.md stating, in two sentences, why the output precision is false and what the numbers are honestly worth, and name one risk in your register whose ALE is comfortable but whose tail is not.

Verify

awk -F, 'NR>1 && NF>=11 {n++} END {print n" risk(s) costed"}' lab/ale.csv
awk -F, 'NR>1 && $NF+0<0 {n++} END {print n+0" with negative benefit"}' lab/ale.csv
grep -Eci 'estimate|precision|tail' lab/ale-note.md

Three risks fully costed, at least one negative benefit retained, and the note addressing both precision and the tail. A sheet where every control pays for itself has been written backwards from the conclusion.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.