An investigation by the Information Security department has shown that the cost of rectifying a website damaged by a hacker is about Rs. 200k per incident. Available records (over the last ten years) show that such hacking activity has happened about five times during this period for comparable businesses. You have been asked to evaluate a security solution consisting of

• Two application-level firewalls (costing Rs. 20k each),

• One IPS/IDS appliance (costing Rs. 10k each).

The expected lifetime of the solution is 5 years - the cost is capitalised over 5 years. All security systems carry a simplified 20% (of total cost) charge for ‘installation, support, maintenance, and management’ per year.

If the suggested security solution reduces the cost of the damage by 70% per incident, I need to find the value of the safeguard to the company. So, I calculate as below:

SLE('Single Loss Expectancy’) : 200K

ARO('Annualised Rate of Occurrence') : 0.5 per year

ALE('Annualised Loss Expectancy') : 100k (200k * 0.5)

ALE(Before) : 100k

ALE(After)  : 30K

Controls cost : 2 firewalls + 1 IDS + maintenance = 50k + 50k = 100k (for five years)
Annualised cost : 100k / 5 = 20k

Value of safeguard to the company: 100 - 30 - 20 = 50K

1 Answer 1


What you have calculated is the traditional "Cost Benefit Analysis" (CBA). The calculation is:

CBA = ALE(prior) – ALE(post) – ACS

Where ACS is the Annualised Cost of Safeguard.

This is used to determine if the CBA is positive and also to estimate the projected Return on Security Investment (ROSI). If positive, then you know that the safeguard will provide more protection than it costs. The ROSI helps to qualify this safeguard against other safeguards and to weigh against other non-monetary costs that might also need to be considered.

This is not strictly "value" as you suggest in your question, but it might be understood that way.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .