Building Secure Servers with Linux

Simple Risk Analysis: ALEs

Once you’ve identified your electronic assets, their vulnerabilities, and some attackers, you may wish to correlate and quantify them. In many environments, it isn’t feasible to do so for more than a few carefully selected scenarios. But even a limited risk analysis can be extremely useful in justifying security expenditures to your managers or putting things into perspective for yourself.

One simple way to quantify risk is by calculating Annualized Loss Expectancies (ALE).^[4] For each vulnerability associated with each asset, you must do the following:

1. Estimate the cost of replacing or restoring that asset (its Single Loss Expectancy)

2. Estimate the vulnerability’s expected Annual Rate of Occurrence

3. Multiply these to obtain the vulnerability’s Annualized Loss Expectancy

In other words, for each vulnerability, we calculate:

Single Loss       x  expected Annual      = Annualized Loss 
Expectency (cost)    Rate of Occurrences    Expectancy (cost/year)

For example, suppose your small business has an SMTP (inbound email) gateway and you wish to calculate the ALE for Denial of Service (DoS) attacks against it. Suppose further that email is a critical application for your business: you and your nine employees use email to bill clients, provide work estimates to prospective customers, and facilitate other critical business communications. However, networking is not your core business, so you depend on a local consulting firm for email-server support.

Past outages, which have averaged ...