Chapter 7 — Probability and statistics
Lesson map
Lesson 07 published. Map, example, EX019.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Frequency and impact"]
N2["7.2 Ranking the risks"]
N3["Lab — Expected annual loss for five Ardwell risks"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX019"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Frequency and impact"]
N2["7.2 Ranking the risks"]
N3["Lab — Expected annual loss for five Ardwell risks"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX019"]
[Learning outcomes]
|
v
[7.1 Frequency and impact]
|
v
[7.2 Ranking the risks]
|
v
[Lab — Expected annual loss for five Ardwell risks]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX019]
Learning outcomes
You will (1) compute expected annual loss from frequency and impact; (2) rank risks by expected loss; (3) recognise the limits of single-number estimates.
7.1 Frequency and impact
Nadia learns the classic annualised loss expectancy: the annual rate of occurrence times the single loss expectancy. For Ardwell she estimates five risks with workshop input: a billing outage expected every two years costing one hundred and twenty thousand; ransomware once a decade at nine hundred thousand; four lost laptops a year at six thousand each; a card breach once in twenty years at one and a half million; and misuse of vendor control-system access once in five years at four hundred thousand.
7.2 Ranking the risks
The lab multiplies each pair and sorts the results. Ransomware ranks first at ninety thousand a year, followed by vendor access misuse at eighty thousand, card breach at seventy-five thousand, billing outage at sixty thousand and lost laptops at twenty-four thousand. The total is three hundred and twenty-nine thousand. Nadia notices that the top four are close, so small changes in estimates could reorder them. She concludes that the ranking supports attention to all four rather than a single top priority.
Lab — Expected annual loss for five Ardwell risks
"""Annualised loss expectancy (ALE = ARO x SLE) for synthetic Ardwell risks."""
risks = [("billing outage", 0.5, 120_000), ("ransomware", 0.1, 900_000),
("lost laptop", 4.0, 6_000), ("payment card breach", 0.05, 1_500_000),
("SCADA vendor access misuse", 0.2, 400_000)]
tot = 0
for name, aro, sle in sorted(risks, key=lambda r: -r[1]*r[2]):
ale = aro*sle; tot += ale
print(f"{name}: ARO {aro} x SLE {sle:,} = ALE {ale:,.0f}")
print(f"total ALE {tot:,.0f}")
Run with python3 lab_ale.py. Verified output:
ransomware: ARO 0.1 x SLE 900,000 = ALE 90,000
SCADA vendor access misuse: ARO 0.2 x SLE 400,000 = ALE 80,000
payment card breach: ARO 0.05 x SLE 1,500,000 = ALE 75,000
billing outage: ARO 0.5 x SLE 120,000 = ALE 60,000
lost laptop: ARO 4.0 x SLE 6,000 = ALE 24,000
total ALE 329,000
7.3 Limits of averages
Prof. Brenner warns that expected loss hides the shape of outcomes. The card breach has a low expected value but a catastrophic single outcome that could threaten the cooperative, while lost laptops are frequent but small. A board that only sees averages might underweight rare severe events. Nadia learns to report ranges and worst plausible cases next to averages, and she reads how Freund and Jones (2015) decompose frequency and magnitude in the FAIR model to make such estimates more structured and defensible.
Worked example
Nadia computes ALE for five risks, ranks ransomware first at ninety thousand, totals three hundred and twenty-nine thousand and notes close rankings.
Synthetic case. All estimates are synthetic; Freund and Jones (2015) is real.
Errors and limits
Single estimates hide uncertainty. Averages underweight rare catastrophes.
Exercises
- EX019 — ALE formula. How is annualised loss expectancy computed? Rubric: 3 = rate of occurrence times single loss expectancy;; 2 = ARO x SLE;; 1 = vague;; 0 = none.
- EX020 — Top two. Which two risks ranked highest by ALE in the lab? Rubric: 3 = ransomware 90k and vendor misuse 80k;; 2 = ransomware first;; 1 = laptops;; 0 = none.
- EX021 — Hidden shape. Why might the card breach deserve more attention than its ALE suggests? Rubric: 3 = rare but catastrophic single outcome;; 2 = tail;; 1 = vague;; 0 = none.
Synthesis
Expected loss gives a useful first ranking, but ranges and tails must accompany it.
Continue studying — chapter 07 of 50
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →