The Security Risk Assessment Handbook, 2nd Edition

Security Risk Mitigation  ◾  391

© 2011 by Taylor & Francis Group, LLC

Table10.3  Estimating Benefits

Estimate Benefits 1st Year 2nd Year 3rd Year 4th Year 5th Year Assumptions

Reduction in rework — $120,000 $240,000 $360,000 $360,000 1st year, no reduction (learning curve)

2nd year, 10% reduction

3rd year, 20% reduction

4th and 5th year, 30% reduction;

rework is 30% of coders’ time

Reduction of threat impact:

Disclosure $180,000 $180,000 $180,000 $180,000 $180,000 $10,000/disclosure; ALE = 1.5

disclosures per app.

Reduction = 60%

Integrity $75,000 $75,000 $75,000 $75,000 $75,000 $5,000/mistake; ALE = 1 mistake/app.

Reduction = 75%

Availability $125,000