Cost benefit analysis (cba)-information security, Computer Network Security

Cost Benefit Analysis (CBA)

The common approach for information security controls is economic feasibility of implementation. CBA is begun by evaluating the worth of assets which are to be protected and the loss in value if those assets are compromised. The formal manner to document this is called as cost benefit analysis or economic feasibility study. Items which impact cost of a control or safeguard include: cost of development; implementation cost; service costs; training fees; cost of maintenance.

Benefit is the value an organization realizes by using controls to avoid losses associated with vulnerability. Asset valuation is the process of assigning financial value or worth to every information asset; there are several components to asset valuation.

Once worth of various assets is anticipated, potential loss from exploitation of vulnerability is examined. Process results in approximation of potential loss per risk. Expected loss per risk stated in equation given below:

Annualized loss expectancy (ALE) equals Single loss expectancy (SLE) TIMES Annualized rate of occurrence (ARO),Here SLE is equal to asset value times exposure factor (that is EF).

Posted Date: 10/9/2012 2:22:44 AM | Location : United States







Related Discussions:- Cost benefit analysis (cba)-information security, Assignment Help, Ask Question on Cost benefit analysis (cba)-information security, Get Answer, Expert's Help, Cost benefit analysis (cba)-information security Discussions

Write discussion on Cost benefit analysis (cba)-information security
Your posts are moderated
Related Questions
QUESTION (a) One of the biggest drawbacks that GNS3 has is that it supports only the IOS images of routers. This means that users cannot emulate Cisco switches. Suggest two sol

(a) Mention the five main security services. (b) What is a passive attack? Give an example of passive attack? (c) What four types of active attacks and mention their respecti

1.  We used the National Vulnerability Database. Select a recent vulnerability from that Database and analyse it from the following aspects: Criticality level Impact in

UDP- DATAGRAM TRANSPORT SERVICE INTRODUCTION:  UDP is the one of the transport protocols in TCP/IP protocol suite. UDP protocol accepts applications on the computers to

Question: (a) What is the major problem with public key encryption when compared to symmetric key encryption? (b) Consider the following protocol for communication between t

Protocols for Secure Communications Securing Internet Communication by using S-HTTP and SSL Secure Socket Layer (SSL) protocol is a protocol that uses public key encryption t

FRAGMENTATION Fragmentation information is kept in different extension header.  Every fragment has base header and fragmentation header. Whole datagram including original hea

Firewalls A firewall in an information security program that prevents specific types of information from moving between the outside world and the inside world. The firewall may

Problem a) Consider a 1000 Mbps Ethernet with a single Store-N-Forward switch mid-way in the path between two nodes A and B. Assume that there are no other nodes on the network

What key which if used to encrypt the ciphertext again would give back the plaintext (i.e. key is a weak key)? Define a formula for identifying weak keys for the cipher below (