Information Security Management Metrics

Current State of Security Metrics ◾ 31

higher the ARO. For example, if insurance data suggests that a serious fire is likely

to occur once in 25 years, then the ARO is 1/25 = 0.04.

3.2.2.2 ROSI

Return on security investment (ROSI) was introduced in 2002. It is a derivative of

ROI. ROSI deals with balancing risk and the cost of a mitigating (risk-reducing)

solution for that risk. ROSI uses single loss expectancy (SLE) to calculate risk expo-

sure, or annual loss expectancy (ALE).

As discussed, SLE is the cost of a single loss. It is expressed as the value of an asset

value and an exposure factor for that asset. ALE is the SLE multiplied by the frequency

of occurrence, typically the number of such losses over the course of one year.

is risk e