Run the ALE calculation in both directions
Task
Compute an annualised loss expectancy for one risk, then compute what a control would reduce it to, and produce the cost-benefit figure that turns a security preference into a funding case.
Steps
- Create
lab/ale.csvwith headerrisk,asset_value,exposure_factor,sle,aro,ale. - Fill three risks from
lab/risk-register.csv, computing SLE and ALE rather than estimating them. - Add columns
control,control_cost_annual,aro_after,ale_after,benefitand computebenefitasale - ale_after - control_cost_annual. - Include one risk where the benefit is NEGATIVE -- a control that costs more than it saves -- and leave it in.
- Write
lab/ale-note.mdstating, in two sentences, why the output precision is false and what the numbers are honestly worth, and name one risk in your register whose ALE is comfortable but whose tail is not.
Verify
awk -F, 'NR>1 && NF>=11 {n++} END {print n" risk(s) costed"}' lab/ale.csv
awk -F, 'NR>1 && $NF+0<0 {n++} END {print n+0" with negative benefit"}' lab/ale.csv
grep -Eci 'estimate|precision|tail' lab/ale-note.md
Three risks fully costed, at least one negative benefit retained, and the note addressing both precision and the tail. A sheet where every control pays for itself has been written backwards from the conclusion.
This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.