Shot Down in Flames!

Author: Michael Peters
Published: October 20, 2011 at 12:57 pm
Share

The Return on Investment, aka ROI, is an essential financial measurement for any business venture and one that must be positive, or at least neutral, in order to demonstrate the viability of the proposition being examined. There are certain essential business functions however that does not provide a return on your investment; and two of those functions would be legal representation and security, both physical and digital.

Shot DownThey are not investments providing a return, like an MRI or commerce site. Security expenses and legal expenses, if utilized correctly, earn their keep in risk avoidance which does translate into tangible financial savings. They are both about avoiding losses associated with business risks, not about financial return.

The traditionally difficult part about getting funding for security and legal expenditures is collecting accurate quantifiable measurements to base our propositions on, fortunately, there is such a mechanism for accomplishing this and it is to leverage the mathematic power of the Annualized Loss Expectancy (ALE) (Source: Risky Thinking) which is the expected monetary loss that can be expected for an asset due to a risk over a one year period of time. An important feature of the ALE is that it can be used directly in a cost-benefit analysis.

To provide hopefully a brief explanation of how it is calculated, there are two factors that comprise the ALE. They are the Single Loss Expectancy (SLE), which is the percentage of the asset you are attempting to protect that would be lost in a single exposure, and the Annualized Rate of Occurrence (ARO), which is the frequency the loss event occurs in a year. Those two factors multiplied together give you’re the ALE (ALE = SLE * ARO).

For example, suppose than an asset is valued at $200,000 and the single cost of exposure is $50,000. Your SLE is now defined as $50,000 right? How many times in a year do we expect this exposure event to occur in a year? If we expect an exposure to occur once every year, then ARO is 100% whereas if we think there is a 50/50 shot, our ARO is now 50% right? For discussion purposes, let’s suggest we think there is a 50/50 chance an exposure might occur so our ARO is .5. With our SLE equaling $50,000, multiplied by our ARO of .5, the ALE is $25,000.

Continued on the next page
 
 

About this article

Profile image for mdpeters67

Article Author: Michael Peters

Michael D. Peters has been an independent information security consultant, executive, researcher, author, and catalyst with many years of information technology and business leadership experience. He has been referred to as the “Michelangelo of Security”. …

Michael Peters's author pageAuthor's Blog

Article Tags

Share: Bookmark and Share

Add your comment, speak your mind

Personal attacks are NOT allowed
Please read our comment policy