7.2 Quantitative Risk Analysis & FAIR Framework

7.2 Quantitative Risk Analysis & FAIR Framework

While qualitative analysis categorizes risk using descriptive labels, quantitative risk analysis expresses risk in objective, verifiable financial figures and empirical metrics. By translating technical vulnerabilities into monetary loss projections (e.g., dollars, euros, or yen), quantitative analysis enables business leaders to evaluate security investments using traditional corporate financial methodologies, such as Cost-Benefit Analysis (CBA) and Return on Security Investment (ROSI).

---

1. Classic Quantitative Risk Formulas & Metrics

The ISACA CRISC exam rigorously tests the core mathematical relationships governing classical quantitative risk assessment:

+-----------------------------------------------------------------------------+
|                     CLASSICAL QUANTITATIVE RISK FORMULAS                    |
|                                                                             |
|   1. SINGLE LOSS EXPECTANCY (SLE):                                          |
|      SLE = Asset Value (AV) x Exposure Factor (EF)                          |
|                                                                             |
|   2. ANNUALIZED LOSS EXPECTANCY (ALE):                                      |
|      ALE = Single Loss Expectancy (SLE) x Annualized Rate of Occurrence (ARO)|
|      ALE = (AV x EF) x ARO                                                  |
|                                                                             |
|   3. COST-BENEFIT ANALYSIS (CBA) / NET ANNUAL BENEFIT:                      |
|      Net Annual Benefit = (ALE_current - ALE_mitigated) - Annual_Control_Cost|
+-----------------------------------------------------------------------------+

Detailed Variable Definitions:

1. Asset Value (AV): The comprehensive financial worth of the asset to the organization. This includes replacement cost, hardware/software acquisition, intellectual property value, data reconstruction labor, and business revenue generated by the asset.
2. Exposure Factor (EF): A percentage (ranging from 0% to 100%, expressed as 0.0 to 1.0) representing the proportion of asset value destroyed or lost during a single realized risk event.
3. Single Loss Expectancy (SLE): The total financial loss incurred by the organization each time the specific risk event occurs ($ Amount).
4. Annualized Rate of Occurrence (ARO): The estimated frequency with which a risk event is expected to occur within a single calendar year.
   • Example: An event occurring once every 4 years has an ARO = 1 / 4 = 0.25.
   • Example: An event occurring 12 times a year has an ARO = 12.0.
   • Example: An event occurring once every 10 years has an ARO = 0.1.
5. Annualized Loss Expectancy (ALE): The statistically expected financial loss the enterprise will suffer from this risk event on an annualized basis ($ Amount per year).

---

2. Worked Calculation Scenarios

Calculation Scenario 1: E-Commerce Database Ransomware Exposure

• Asset Value (AV): Customer transaction database valued at $4,000,000.
• Exposure Factor (EF): A successful ransomware attack is estimated to corrupt or lock 40% of operational data (EF = 0.40).
• Annualized Rate of Occurrence (ARO): Threat intelligence estimates this specific exploit occurs once every 2 years (ARO = 0.50).

Step 1: Calculate Single Loss Expectancy (SLE)
        SLE = AV x EF
        SLE = $4,000,000 x 0.40 = $1,600,000

Step 2: Calculate Annualized Loss Expectancy (ALE)
        ALE = SLE x ARO
        ALE = $1,600,000 x 0.50 = $800,000 per year

Calculation Scenario 2: Justifying Safeguard Investment via CBA

The Chief Information Security Officer (CISO) proposes deploying an automated immutable backup and endpoint detection system costing $150,000 annually.

• With the safeguard in place, the Exposure Factor is reduced to 10% (EF = 0.10) and the ARO drops to once every 5 years (ARO = 0.20).

Step 1: Calculate Mitigated SLE
        SLE_mitigated = $4,000,000 x 0.10 = $400,000

Step 2: Calculate Mitigated ALE
        ALE_mitigated = $400,000 x 0.20 = $80,000 per year

Step 3: Calculate Gross Annual Loss Reduction (Savings)
        Gross Savings = ALE_current - ALE_mitigated
        Gross Savings = $800,000 - $80,000 = $720,000 per year

Step 4: Calculate Net Annual Benefit (Cost-Benefit Analysis)
        Net Annual Benefit = Gross Savings - Annual Safeguard Cost
        Net Annual Benefit = $720,000 - $150,000 = $570,000 per year

Governance Conclusion: Because the Net Annual Benefit is positive (+$570,000), the security control is financially justified and provides a massive Return on Security Investment (ROSI).

---

3. The Factor Analysis of Information Risk (FAIR) Framework

While classical quantitative models calculate single-point static numbers, modern risk engineering relies on the Factor Analysis of Information Risk (FAIR) framework (standardized by The Open Group as Open FAIR™). FAIR establishes a precise, non-redundant ontology that breaks risk down into its fundamental causal components.

+-----------------------------------------------------------------------------+
|                        FAIR RISK ONTOLOGY STRUCTURE                         |
|                                                                             |
|                                     [ RISK ]                                |
|                      (Probable Frequency & Magnitude of Loss)               |
|                                        |                                    |
|                    +-------------------+-------------------+                |
|                    |                                       |                |
|                    v                                       v                |
|        [ LOSS EVENT FREQUENCY (LEF) ]             [ LOSS MAGNITUDE (LM) ]   |
|        (How often loss occurs/year)               (Financial loss/event)    |
|                    |                                       |                |
|         +----------+----------+                 +----------+----------+     |
|         |                     |                 |                     |     |
|         v                     v                 v                     v     |
|    [THREAT EVENT         [VULNERABILITY]   [PRIMARY LOSS]     [SECONDARY    |
|   FREQUENCY (TEF)]           (VULN)          (Direct Org)       LOSS]       |
|         |                     |                 |            (External)     |
|    +----+----+           +----+----+       +----+----+       +----+----+    |
|    |         |           |         |       |    |    |       |    |    |    |
|    v         v           v         v       v    v    v       v    v    v    |
|   [CF]     [PoA]       [TCap]     [CS]   [Prod][Resp][Repl] [Fine][Rep][Leg]|
+-----------------------------------------------------------------------------+

FAIR Taxonomy Breakdown:

A. Loss Event Frequency (LEF)

LEF is the estimated number of times within a given time period (typically one year) that a threat actor will successfully compromise an asset and cause loss.

1. Threat Event Frequency (TEF): The frequency with which a threat actor comes into contact with an asset and acts against it.
   • Contact Frequency (CF): How often an adversary reaches the perimeter (e.g., random network scans or targeted phishing).
   • Probability of Action (PoA): The probability that the threat actor will actually launch an exploit once contact is established.
2. Vulnerability (VULN): In FAIR, vulnerability is defined strictly as the probability that a threat event will result in a loss event.
   • Threat Capability (TCap): The force, skill, and resources an attacker can bring against a control (expressed as a percentile).
   • Control Strength (CS): The defensive strength of the control baseline compared to a benchmark threat capability (expressed as a percentile).
   • FAIR Principle: If TCap > CS, a loss event occurs; if CS >= TCap, the control repels the attack.

B. Loss Magnitude (LM)

Loss Magnitude is the total financial and operational impact resulting from a realized loss event.

+-----------------------------------------------------------------------------+
|                     FAIR LOSS MAGNITUDE CLASSIFICATION                      |
|                                                                             |
|   PRIMARY LOSS (Direct Impact to Victim):                                   |
|   - Productivity: Revenue lost during system downtime and operational halt. |
|   - Response: Incident response retainers, forensic analysts, legal counsel.|
|   - Replacement: Hardware rebuild, clean restore, software re-licensing.    |
|                                                                             |
|   SECONDARY LOSS (Reactions of External Stakeholders):                      |
|   - Fines & Penalties: Statutory sanctions (GDPR, HIPAA, PCI-DSS, SEC).    |
|   - Legal & Judgments: Customer class-action lawsuits, shareholder suits.   |
|   - Reputation / Churn: Lost future contracts, brand damage, stock drop.    |
|   - Competitive Advantage: Stolen trade secrets, blueprints, pricing data.  |
+-----------------------------------------------------------------------------+

[!IMPORTANT] Primary vs. Secondary Loss on the CRISC Exam: Primary losses are incurred directly by the organization as an immediate consequence of the attack (e.g., internal staff overtime, paying for clean-up). Secondary losses occur only when external third parties (regulators, customers, media, investors) react to the primary loss event. An organization might have a low primary loss ($20,000 incident response) but suffer catastrophic secondary loss ($10,000,000 in GDPR fines and churn).