Do the arithmetic until the units stop catching you out

short · 30 min · Objective 5.2

Task

Work SLE, ARO and ALE for six scenarios with deliberately awkward wording, then use the results to make a control decision. Most marks lost here are unit slips on the annualised rate rather than conceptual errors.

Steps

  1. Write /tmp/scenarios.csv with six rows: id,asset_value,exposure_factor,frequency_text, where the frequency is phrased differently each time: 'once every four years', 'twice annually', 'roughly every eighteen months', 'once a decade', 'three times a year', 'once every six months'.
  2. Convert each frequency phrase to an ARO as a decimal, by hand, and add it as a column named aro. Write exposure_factor as a fraction between 0 and 1 (0.3, not 30%): the Verify multiplies it directly, and a percentage gives an SLE a hundred times too large that still reconciles with a hand figure made the same mistake.
  3. Compute SLE and ALE for each, by hand, and add them as columns named sle and ale. Keep the ARO you used to at least two decimal places: 'roughly every eighteen months' is 0.67, and the Verify recomputes from your aro column to the cent.
  4. Now write /tmp/ale.py to compute the same three columns from the asset value, exposure factor and your ARO, and compare against your hand figures. Any disagreement is an arithmetic slip, and finding it is the point.
  5. For two of the scenarios, propose a control with an annual cost and an expected reduction in ARO or exposure factor. Compute the new ALE and decide whether the control is worth buying: compare the drop in ALE with the control's annual cost.
  6. For one scenario, state why the ALE is the WRONG basis for the decision: a low-frequency event with an impact the organisation could not survive. Save these notes as /tmp/scenarios-notes.md, covering which losses the organisation could survive and why the average hides the single catastrophic event.

Verify

python3 /tmp/ale.py /tmp/scenarios.csv
python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/scenarios.csv')))
assert len(rows)>=6, 'fewer than six scenarios'
bad=[]
for r in rows:
    av=float(r['asset_value']); ef=float(r['exposure_factor']); aro=float(r['aro'])
    sle=av*ef; ale=sle*aro
    if abs(sle-float(r['sle']))>0.01: bad.append(r['id']+' SLE')
    if abs(ale-float(r['ale']))>0.01: bad.append(r['id']+' ALE')
assert not bad, 'arithmetic disagrees for: '+', '.join(bad)
aros=sorted(float(r['aro']) for r in rows)
print('ARO values:',aros)
assert aros[0]<1 and aros[-1]>1, 'no scenario below 1 or none above - the awkward phrasings were not used'
print('all six scenarios reconcile')
PY
grep -ciE "survive|catastroph|average|single event" /tmp/scenarios-notes.md

The reconciliation assertion catches the slips this lab exists to find. The ARO range assertion checks you used the awkward phrasings: 'once every four years' is 0.25 and 'three times a year' is 3, and mixing those up changes the answer by a factor of twelve.

Notes

The scenario where ALE is the wrong basis is the one worth remembering. An annualised loss expectancy is an average, and an average is a sound basis for deciding about events you will experience many times. For an event that happens once and ends the organisation, the mean is not the number that should decide anything.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.