Denial of Service attacks are estimated to happen once every six months (twice a year) in a mid-size company. One such company, XYZ, estimates the cost of recovering from a single DoS attack to be $12000. The company decides to apply a number of controls to counter these attacks. With these controls, the frequency of successful DoS attacks against the company reduces to once a year and the cost of recovering from an instance becomes $8000. The cost of implementing these controls is $7,000 a year. The annual loss expectancy (ALE) without controls is $ The annual loss expectancy (ALE) with controls is $

Denial of Service attacks are estimated to happen once every six months (twice a year) in a mid-size company. One such company, XYZ, estimates the cost of recovering from a single DoS attack to be $12000. The company decides to apply a number of controls to counter these attacks. With these controls, the frequency of successful DoS attacks against the company reduces to once a year and the cost of recovering from an instance becomes $8000. The cost of implementing these controls is $7,000 a year. The annual loss expectancy (ALE) without controls is $ The annual loss expectancy (ALE) with controls is $

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter7: Risk Management: Treating Risk

Section: Chapter Questions

Problem 9RQ

See similar textbooks

Similar questions

Denial of Service attacks are estimated to happen once every six months (twice a year) in a mid-size company. One such company, XYZ, estimates the cost of recovering from a single DoS attack to be $10,000. The company decides to apply a number of controls to counter these attacks. With these controls, the frequency of successful DoS attacks against the company reduces to once a year and the cost of recovering from an instance becomes $6,000. The cost of implementing these controls is $12,000 a year. From a purely financial point of view, is it worth for the company to implement these controls? O None of the these Yes, because the measures will save the company $2,000. ONo, because the measures will cost the company $2,000. No, because the measures will cost the company $4,000. Yes, because the measures will save the company save $14,000.
A phishing attack on a certain social media platform locks users out of their accountsand spreads by sending malicious links to their followers to gain access to more accounts. On thefirst day, the attack has hacked into 2 accounts. Near the beginning of each of the following days,each hacked account sends links to 4 new accounts, which subsequently become hacked as well.By the end of the second day, IT support has found a way to restore users’ accounts, and 1 accounthas been restored at that point. Each day thereafter, 5 times as many accounts have been restoredas the previous day. (a) Write a recurrence relation for the total number of hacked accounts at the end of day n.(b) Solve the recurrence relation.(c) How many days will it be until all users’ accounts have been completely restored?
A SAF authorization form is used in most universities to approve funding for students to aid their studies. Suppose a student fills out a blank form and sends it to his or her departmental chairperson for a signature. If the amount of funds requested by the student is small (under 10,000 Tk), then the chairperson signs the form and routes it to accounts payable to be input into the accounting system. The system cuts a check that is sent to the student for the right amount, and after the check is cashed, the form is filed away with the canceled check. If the check is not cashed within 30 days, the form expires. When the amount of the requested fund is large (over 10,000 Tk), the chairperson signs the form and sends it to the chief financial officer along with a paragraph explaining the reason for the grant, and the chief financial officer will sign the form and pass it along to accounts payable. Both the chairperson and the chief financial officer can reject the SAF authorization form…
It is important to compile a list of all known hazard categories and rank them according to the frequency with which they occur, preferably with URL proof.
Scenario 2 An organization dedicated to reducing spam tries to get Internet service providers (ISPS) in an East Asian country to stop the spammers by protecting their mail servers. When this effort is unsuccessful, the anti-spam organization puts the addresses of these ISPS on its "black list." Many ISPS in the United States consult the black list and refuse to accept email from the blacklisted ISPS. This action has two results. First, the amount of spam received by the typical email user in the United States drops by 25 percent. Second, tens of thousands of innocent computer users in the East Asian country are unable to send email to friends and business associates in the United States. Questions 1. Did the anti-spam organization do anything wrong? 2. Did the ISPS that refused to accept email from the black listed ISPS do anything wrong? 3. Who benefited from the organization's action? 4. Who was hurt by the organization's action? 5. Could the organization have achieved its goals…
Network/OS-only environments define "risk" differently. Are there any specific dangers?
Operating systems and most other types of software aren't completely bug-free when they're initially launched. There are applications out there that have tens of thousands of issues, which are referred to as bugs. Known problems with published software are routinely corrected by software firms via the provision of fixes (also known as patches). The day after a new vulnerability is publicly disclosed, hackers and other criminals often launch zero-day assaults to exploit it. No one can deny that these criminals' actions are unethical, but in the event that their negligence or haste to market causes harm to customers, what duty does a software firm have? What responsibilities do computer users have in terms of staying up to date on security patches?
HackerLand National Bank has a simple policy for warning clients about possiblefraudulent account activity. If the amount spent by a client on a particular day is greaterthan or equal to 2 ×the client's medianspending for the last d days, they send the client a notification about potential fraud. The bank doesn't send the client any notificationsuntil they have at least d prior days of transaction data.Given the value of d and a client's total daily expenditures for a period of n days (where n>d) write amethod which returns the number of times the client will receive a notification over all days.Note: Your algorithm time efficiency should not exceed O(nd) where n is the total number of daily expenditures and d is the number of prior day expenditures used for frauddetection.Your algorithm space complexity should not exceed O(n+d).where n is the total number of daily expenditures and d is the number of prior day expenditures used for frauddetection.Space complexity is defined as the…
Create a risk assessment for the following scenario, being sure to include all of the pertinent information: A writer goes to the CAF-POW coffee shop with his laptop so that he may make advantage of the free public open WiFi that is offered there.
What are the actions that take place during a downgrade attack?
Most software, including operating systems, is not error free when it is first released. Some programs, in fact, contain thousands of problems, called bugs. Software companies regularly release fixes (called patches) to correct known issues with released software. Many hackers and other criminals target these bugs with computer viruses or other attacks, frequently on the day a new vulnerability is announced—called a zero-day attack. Obviously, the acts by these criminals are not ethical, but what responsibility does a software company have to consumers if they are put at risk due to the company’s carelessness or rush to market? What responsibility do consumers have to make sure they keep their computers patched against new vulnerabilities?
Give an example of a scenario in which the complete denial of a service to a user (in other words, the user receives no answer from the computer) causes a significant issue for that user. Another scenario in which a 10 percent denial of service (that is, the user's calculation continues, but at a pace 10 percent slower than normal) represents a significant issue for that user is described below. It is possible that illegal access to a computer system results in a 10% denial of service to the legitimate users of that computing system. If so, how would you go about it?