How can I calculate a single loss expectancy without a given Exposure Factor?
Can someone please explain me?
How can I calculate a single loss expectancy without a given Exposure Factor?
Can someone please explain me?
You cannot calculate a Single Loss Expectancy (SLE) without an actual, historical, estimated, or guess-estimated Exposure Factor (EF). I think what is lacking in most INFOSEC Risk Management training materials that cover quantitative analysis, is that they don't give much guidance how to translate the generic risk definition [risk = f(asset, threat, vulnerability)] into an EF and into the SLE and ALE formulas. I looked online just now, and I didn't see anyone that covered it well.
For a risk to exist there must be a vulnerability to exploit, and threats against that vulnerability. Those threats also have a probability of occurrence (which may be based upon observed attacks). The Threat Probability translates into the Annualized Rate of Occurrence in the quantitative analysis. So your EF mostly is based upon the vulnerability and its consequences to the asset when the threat occurs.
Many per-risk (meaning per-threat/vulnerability pair) EFs result in a 0 EF or a 1 EF which reduces some of the risk analysis workload. It also helps sometimes in doing EF estimation to also consider any mitigators what are put in-place to help reduce or eliminate the vulnerability.
Some simplistic examples of trivial 0 and 1 EFs:
Asset: an online-accessible bank account's balance
Threat: Hacker employs fishing emails to get bank account logins to drain accounts
Threat: Hacker employs fishing emails to get bank account logins to drain accounts
Threat: Hacker uses recent lists of stolen userid/password from a social media site
For most other risks, one has to assess the vulnerability, the threat, and any vulnerability mitigators to decide upon an estimated EF. If one does not have a lot of real observed data to base the EF depending upon the risk, then these individual SLEs can be wildly out-of-line. When rolled up into aggregate Annualized Loss Expectancies, it could have a very large margin of error due to all the poorly estimated individual EFs.
However using the banking industry as an example, for a bank that has been in-operation for many years, they have detailed historical loss data (including cyber-related losses). A bank can actually calculate these values (EF, SLE, ARO, ALE) quite accurately for their history-to-date, and then use them for predictions of future losses.
Also, given that detailed loss history, banks can do relatively accurate what-if cost-vs-benefit analysis of implementing new mitigators (such as two-factor authentication).