Varun Shourie
ASURITE #: 1214512793
CIS401 – Cyber Risk Management
Class Section #32303
Homework #05
PART A
Note: Formulas are shown by clicking “Show Formulas” under Formulas in Excel.
As shown below, company ABC is not well protected currently because considering all factors, most
cases as per the time-based model of security with the worst case and average of case of P show that
(D+R) > P. This signifies that the company cannot detect and respond to data breaches in an adequate
time.
To use a quantitative approach, I assume that the best case of P occurs only 5% of the time, the average
case of P occurs 50% of the time, and the worst case occurs 45% of the time. The average of the
quantities of P – (D+R) for the following tables are: -6 (P = 15), -1 (P = 20), and 4 (P = 25). The weighted
average therefore equals -6 (.45) + –1 (.5) + 4 (.05) = -2.7 + -0.5 + 0.2 = -3 min, which signifies that P < (D
+R) by 3 minutes on average accounting for the probabilities of each case happening.
Scores for P = 15 minutes (worst case)
D = 5 min (best
case)
D = 8 min (average
case)
D = 10 min (worst
case)
R = 6 (best case)
=15-(6+5)
=15-(8+6)
R = 14 (average
case)
=15-(14+5)
=15-(8+14)
R = 20 (worst case)
=15-(5+20)
=15-(8+20)
Scores for P = 20 minutes (average case)
D = 5 min (best
case)
D = 8 min (average
case)
D = 10 min (worst
case)
R = 6 (best case)
=20-(6+5)
=20-(8+6)
R = 14 (average
case)
=20-(14+5)
=20-(8+14)
R = 20 (worst case)
=20-(5+20)
=20-(8+20)
Scores for P = 25 minutes (best case)
D = 5 min (best
case)
D = 8 min (average
case)
D = 10 min (worst
case)
R = 6 (best case)
=25-(6+5)
=25-(8+6)
R = 14 (average
case)
=25-(14+5)
=25-(8+14)
R = 20 (worst case)
=25-(5+20)
=25-(8+20)
PART B
Note: Formulas are shown by clicking “Show Formulas” under Formulas in Excel.
Before providing my recommendations, I wish to define more precise answers by using the same
quantitative approach as in Part A. I assume the worst case for P happens for 45% of all times, the
average case happens for 50% of all times, and the best case happens 5% of all times.
Using the same logic as mentioned in Part 1, the weighted average for Investment 1 is the average of (P
– (D+R)) for each case of P multiplied by the probability of each case of P occurring.
Note: The average for each case of P are derived from the color-coded matrices provided below.
Therefore, the weighted averages are the following for each investment.
Investments
Weighted average, or net P – (D+R) value with current systems if added
1 – $75,000
-2(0.45) + 2(0.50) + 9(0.05) = -0.9 + 1 + .45 = 0.55
2 – $75,000
-2.67(0.45) + 2.33(0.50) + 7.33(0.05) = -1.20 + 1.17 + 0.37 = 0.40
3 – $75,000
1(0.45) + 6(0.50) + 11(0.05) = .45 + 3 + .55 = 4
4 – $25,000
-4(0.45) + 1(0.50) + 7(0.05) = -1.8 + 0.5 + .35 = -0.95
5 – $25,000
-5(0.45) + 0(0.50) + 7(0.05) = -2.25 + .35 = -1.90
6 – $25,000
-1(0.45) + 4(0.50) + 9(0.05) = -.45 + 2 + .45 = 2
Question 1 (restated from homework directions): Which single investment would you recommend?
Investment 3.