Question

Risk analysis is one way to monitor security in an organization. Risk analysis can be a timeconsuming process; it involves a number of steps, some of which require "educated guessing." Nevertheless, the process alone raises awareness of security issues even if no immediate actions are taken as a result. The steps are: i. Identify assets (infrastructure, people, hardware, software, reputation, etc.). For the rest of this list, we'll concentrate on a single asset. ii. Determine vulnerability (what event or events might happen to the asset. For example, the building could catch fire, the website could be hacked, etc.).For the rest of this list, we'll concentrate on a single asset vulnerable to a single event. iii. Estimate the probability per year of this event (based on past data, expert estimates, etc.). Take current security measures into account. iv. Estimate the expected cost if this event occurs (cost to repair or replace, cost of lost business, etc.). v. Compute risk exposure \(=\) cost estimate \(X\) probability estimate. vi. Identify any additional security measure \(X\) that would help protect against this event, determine what it would cost, and do a calculation of the risk exposure with the additional security measure \(X\) in place. vii. Do a cost-benefit analysis: (Risk exposure without \(X\) - Risk exposure with \(X\) - Cost of \(X\) You have a small web-based business that uses a single server to manage your webpage and your customer information. Over the past four years, your website has been hacked and taken down twice. You estimate that the cost of this event is \(\$ 600\) to clean the server and reload the webpage and \(\$ 12,000\) in lost business while the server is down. a. You could purchase a backup server for a cost of \(\$ 3,000\), which you estimate would reduce the probability per year of losing your website to \(0.2\). Would this be a costeffective security measure? b. What if you reevaluate the probability per year with the backup server to be \(0.3\). Does this change your answer?

Short answer

a. Yes, it's cost-effective; b. No, it's not cost-effective.

Step-by-step solution

Identify the Asset and Vulnerability

The asset in question is the single server that manages the webpage and customer information. The vulnerability is the server being hacked and taken down.

Estimate Past Event Probability

Over four years, the website was hacked twice, giving an estimated yearly probability of \(0.5\) (2/4 = 0.5).

Estimate the Cost if Event Occurs

The cost includes \\(600 for server cleanup and reload, plus \\)12,000 for lost business. Total cost if event occurs = \$12,600.

Compute Risk Exposure Without Additional Security

Risk exposure is computed as the product of probability and cost: \[ Risk\ Exposure = 0.5 \times 12,600 = 6,300 \].

Calculate Reduced Probability With Backup Server (Case a)

With a backup server, the probability reduces to \(0.2\).

Compute New Risk Exposure With Backup Server (Case a)

New risk exposure = \(0.2 \times 12,600 = 2,520\).

Calculate Cost-Benefit for Backup Server (Case a)

Cost-Benefit = Risk exposure without backup - Risk exposure with backup - Cost of backup = \[6,300 - 2,520 - 3,000 = 780\]. Since the cost-benefit is positive, it is a cost-effective measure.

Reevaluate Probability With Backup Server (Case b)

For case (b), the probability with a backup server is \(0.3\).

Compute New Risk Exposure With Re-evaluated Probability (Case b)

New risk exposure = \(0.3 \times 12,600 = 3,780\).

Calculate Cost-Benefit for Backup Server (Case b)

Cost-Benefit = Risk exposure without backup - Risk exposure with backup - Cost of backup = \[6,300 - 3,780 - 3,000 = -480\]. Since the cost-benefit is negative, it is not a cost-effective measure.

Key concepts

Security Measures

Security measures are essential tools used to protect valuable assets in any organization or business. These measures aim to prevent potential security breaches from occurring or at least lessen their impact if they do occur. When managing a web-based business, such as the one described in the exercise, security measures must be put in place to safeguard the server that handles the company's webpage and customer data.
Some common security measures include the installation of firewalls, regular updates to software, and even having a backup server. A backup server can be particularly helpful as it provides a secondary line of defense by keeping the website running even if the primary server is attacked or fails. By taking these precautions, businesses can ensure that their operations remain secure and the likelihood of extensive damage is minimized.

Cost-Benefit Analysis

Cost-benefit analysis plays a crucial role in determining the most suitable security measures for a business. This process involves comparing the potential benefits of a security measure against its cost. In other words, you calculate whether the savings made from avoiding potential security breaches outweigh the expenses on new security measures.
In the context of the exercise, purchasing a backup server involves considering the initial cost (for example, $3,000) and evaluating how much it reduces the risk of a security breach. If the cost-benefit analysis yields a positive value, it implies that the benefits of adopting the security measure outweigh the costs, making it a worthwhile investment. On the other hand, if the analysis results in a negative outcome, it suggests that the gains might not justify the expenditure.
Cost-benefit analysis aids businesses in making informed decisions by quantifying perceived benefits and costs, ensuring that resources are allocated appropriately to enhance security.

Risk Exposure Calculation

Risk exposure calculation is a critical part of risk analysis, helping organizations understand the potential financial impact of a risk occurring. This calculation involves multiplying the probability of an event by the cost it causes.
For example, in the exercise, without a backup server, the risk exposure is calculated as follows: the probability of the server being hacked is 0.5, and the resulting cost is $12,600, leading to a risk exposure of $6,300 (calculated as 0.5 multiplied by $12,600).
Adding additional security measures like a backup server changes this calculation. If this measure reduces the probability of a hack to 0.2, the new risk exposure becomes $2,520 (0.2 multiplied by $12,600). Understanding risk exposure helps businesses identify the most vulnerable areas and prioritize resources to mitigate potential risks effectively.