Lion Cipher Lab

Justify a security control with ALE and ROSI (the money case)

• GRC / Compliance
• Intermediate
• ~45 min
• Free · no account required

Why it matters

Security spending competes with every other line in the budget -- new hires, a sales tool, a warehouse -- and 'trust me, this is risky' loses that fight every time to a number. The quantitative-risk chain (Asset Value and Exposure Factor give you a Single Loss Expectancy; the Annualized Rate of Occurrence turns that into an Annualized Loss Expectancy; a proposed control lowers that ALE, and Return on Security Investment measures whether the drop is worth the price) is the lingua franca that translates a control from a technical wish into a business case a CFO can weigh against anything else.…

What you'll learn

• defining, in plain words, the six terms of the classic quantitative-risk chain: Asset Value (AV), Exposure Factor (EF), Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), Annualized Loss Expectancy (ALE) and Return on Security Investment (ROSI)
• computing SLE = AV x EF and ALE = SLE x ARO for a concrete asset, and reading ALE as the yearly 'do nothing' cost of a risk
• modelling a proposed control's effect by lowering the EF and/or the ARO to get the modified ALE (ALE_after)
• computing ROSI = ((ALE_before - ALE_after) - Cost) / Cost and reading what its sign and percentage actually tell you
• turning those numbers into a defensible business decision: invest, don't invest, or go find a cheaper control
• writing a tiny offline Python snippet (or spreadsheet) that reproduces the whole chain so the math is auditable, not hand-waved
• comparing two candidate controls on ROSI to pick the better spend -- the RELATIVE use the model is actually good at
• stating the model's honest limits unprompted: a single-point estimate on guessed inputs (garbage in, garbage out), a hidden tail (a rare catastrophic loss averages to a small ALE), and a ROSI you can game by inflating ALE_before
• naming the distribution-aware successor -- FAIR with Monte Carlo simulation and a loss-exceedance curve -- and when you would graduate to it

Steps in this lab

1. From zero: the six words that turn a risk into money
2. Set the scenario and gather the inputs -- honestly
3. Compute the 'do nothing' cost: SLE and ALE_before
4. Model the control: how it changes EF and/or ARO -> the modified ALE
5. Compute ROSI and make the call
6. Use it the way it's actually good: compare two controls
7. The honest negative: where these numbers lie to you
8. Do it better: model the distribution, not a point

Open the full interactive lab →