According to the risk assessment theory, is this expenditure appropriate?

Question

Consider the following scenario: A company has a database server whose value, information and equipment, is approximately $200 000. When the manager has checked up the literature regarding this type of server he found that there is the probability of a general failure every 10 years. This failure could lead to the complete deletion of the information that this system stores. Because of that information, the security manager has decided to establish an information backup plan that will cost USD 10 000 per year.

According to that information, I have made the following calculations:

ALE=200 000*(1/10)=20 000

The question that I have is that if the cost of applying the backup procedure would be better than no applying it. I consider that the total cost that I would spend in the ten years, period of time in which it could pass the incident mentioned above, would be:

10 000*10=$100 000

According to this logic, could I establish that it is better not to make the expenditure for the backup of the information? Any comments?

Thanks

Answer 1

You've missed a key point. By not backing it up it costs you on average $200k every 10 years.

Backing it up it costs you $10k every year - so $100k every 10 years fixed and then the cost of the system going down.

But if it is backed up the cost of the loss is not $200k. So when it fails you have the cost of the down time, equipment loss and repair costs but you do not have the cost of information loss. You also do not have any ongoing losses as a result of losing that information.

In the simplistic case if the information value is more than half ($100k) of the $200k on average it works out cheaper to pay for the backup.

Although its never that simple. For example the risk of failure is unlikely to be linear - You often find if electronics do not die in the first 6 months they are less to die in the first few years. Then with age for certain components the risk increases.

Meanwhile information value is also unlikely to remain constant. Under most use cases of large scale database systems you collect information over time - meaning the initial information value starts off low and increases.

So potentially the company may decide the best option is to look at the hardware failure over time profile and start paying for the backup from year X.

Answer 2

If "probability of a general failure" means that, on average, this server type fails every 10 years, then the expected cost of loss to the company is $200,000/10, or $20,000 per year. Since the cost of the backup plan is $10,000 per year, then it seems to better than the expected cost of a loss. Obviously, this is quite simplified and reality is far more complex.