Chapter 14 — Security governance, risk and compliance: methods I
Lesson map
Lesson 14 published. Map, example, EX040.
flowchart TD
N0["Learning outcomes"]
N1["14.1 Estimating"]
N2["14.2 Comparing"]
N3["Lab — Expected annual loss for four Riverton scenari"]
N4["14.3 Uncertainty"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX040"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 Estimating"]
N2["14.2 Comparing"]
N3["Lab — Expected annual loss for four Riverton scenari"]
N4["14.3 Uncertainty"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX040"]
[Learning outcomes]
|
v
[14.1 Estimating]
|
v
[14.2 Comparing]
|
v
[Lab — Expected annual loss for four Riverton scenari]
|
v
[14.3 Uncertainty]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX040]
Learning outcomes
You will (1) estimate expected annual loss for scenarios; (2) compare scenarios in money terms; (3) recognise uncertainty in estimates.
14.1 Estimating
For the four chosen scenarios, Priya asks managers to estimate how often each might happen per year and a typical cost when it does. Ransomware at a clinic might happen once in about seven years at one hundred and eighty thousand. Misdirected records might happen twice a year at four thousand. Card skimming might happen once in twenty years at two hundred and twenty thousand. A lost laptop might happen once a year at nine thousand. These rough frequencies and costs feed directly into the expected loss comparison in the next section.
14.2 Comparing
The lab multiplies frequency by cost. Ransomware has the highest expected annual loss at twenty-seven thousand, card skimming eleven thousand, lost laptops nine thousand and misdirected records eight thousand. The total is fifty-five thousand a year. Priya notes that misdirected records happen most often but cost least per year, while ransomware is rare but most costly. Expected loss helps compare very different scenarios on one scale. Being able to put ransomware at twenty-seven thousand and misdirected records at eight thousand on one scale is what makes the ranking possible.
Lab — Expected annual loss for four Riverton scenarios
"""Expected annual loss per scenario and in total (synthetic Riverton estimates)."""
sc = [("ransomware at a clinic", 0.15, 180_000), ("patient record misdirected", 2.0, 4_000),
("card skimming on booking site", 0.05, 220_000), ("lost clinic laptop", 1.0, 9_000)]
for n, f, m in sc: print(f"{n}: {f} x {m:,} = {f*m:,.0f}")
print(f"total {sum(f*m for _, f, m in sc):,.0f}")
Run with python3 lab_ale.py. Verified output:
ransomware at a clinic: 0.15 x 180,000 = 27,000
patient record misdirected: 2.0 x 4,000 = 8,000
card skimming on booking site: 0.05 x 220,000 = 11,000
lost clinic laptop: 1.0 x 9,000 = 9,000
total 55,000
14.3 Uncertainty
Mr. Lind asks how confident the managers were. Priya admits the estimates are rough and that ransomware's cost could be much higher if records were stolen and many patients notified. She records each estimate with a low and high value and notes the source. She learns that single numbers are useful for comparison but should always be read with their uncertainty, especially for rare, severe events where averages hide what could actually happen. For ransomware, for example, the high value would include notification costs if records were stolen.
Worked example
Priya computes expected annual losses totalling fifty-five thousand, with ransomware highest at twenty-seven thousand, and records ranges for uncertainty.
Synthetic case. Estimates are synthetic.
Errors and limits
Manager estimates are rough. Averages hide severe outcomes.
Exercises
- EX040 — Highest scenario. Which scenario has the highest expected annual loss? Rubric: 3 = ransomware at 27k;; 2 = ransomware;; 1 = records;; 0 = none.
- EX041 — Total loss. What is the total expected annual loss? Rubric: 3 = 55k;; 2 = 55,000;; 1 = vague;; 0 = none.
- EX042 — Frequent but small. Which scenario happens most often but costs least per year? Rubric: 3 = misdirected records at 8k;; 2 = records;; 1 = vague;; 0 = none.
Synthesis
Expected loss puts different scenarios on one scale but must be read with its uncertainty.
Continue studying — chapter 14 of 30
← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →