Return on Security Investment Calculator Statistical 2.2

NSW Dept of Commerce OICT ROSI TOOL V2.0 Prototype Statistical Module LOOKUP TABLES FOR QUANTIFYING THREAT LIKELIHOOD AND CONSEQUENCE Legend Purple cells contain values to be entered by the user Yellow cells contain calculated results Grey cells are copied as is from an actual TRA TABLE 5 LIKELIHOOD GRADE TRANSORMED TO PROBABILISTIC FREQUENCY Annual freq. Min freq Negligible #NAME? 0.0 Very Low #NAME? 0.1 Low #NAME? 0.8 Medium #NAME? 1.5 High #NAME? 2.5 Very High #NAME? 20.0 Extreme #NAME? 120.0 TABLE 6 SEVERITY GRADE TRANSFORMED TO PROBABILISTIC DIRECT COST Dollar Cost Min Cost Insignificant Minor #NAME? -$ Significant #NAME? 5,000 $ Damaging #NAME? 50,000 $ Serious #NAME? 500,000 $ Grave #NAME? 5,000,000 $ RISK CALCULATIONSMay cause system to be permanently closed, and/or be subsumed by another (secure) environment. May result in complete compromise of Government agencies. Will result in some tangible harm, albeit only small and perhaps only noted by a few individuals or agencies. Will require some expenditure of resources to repair (eg "political embarrassment"). May cause damage to the reputation of system management, and/or notable loss of confidence in the system's resources or services. Will require expenditure of significant resources to repair. May cause extended system outage, and/or loss of connected customers or business confidence. May result in compromise of large amounts of Government information or services. Will have some minor effect on the asset value. Will not require any extra effort to repair or reconfigure the system. Unlikely to occur Likely to occur two/three times every five years Likely to occur once every year or less Likely to occur once every six months or less Likely to occur multiple times per day Likely to occur multiple times per month or less Will have almost no impact if threat is realised. Likely to occur once per month or less Insignificant Minor Significant Damaging Serious Grave Negligible Negligible Negligible Negligible Negligible Negligible Negligible Very Low Negligible Low Low Low Medium Medium Low Negligible Low Medium Medium High High Medium Negligible Low Medium High High Critical High Negligible Medium High High Extreme Extreme Very High Negligible Medium High Critical Extreme Extreme Extreme Negligible Medium High Critical Extreme Extreme FORECAST ANNUAL COST AT EACH RISK POINT Capped at cost of a single Grave incident Insignificant Minor Significant Damaging Serious Grave Annual Prob $ -#NAME? #NAME? #NAME? #NAME? #NAME? Negligible #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Very Low #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Low #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Medium #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? High #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Very High #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Extreme #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Likelihood Degree of Harm and Cost per Incident Degree of Harm LikelihoodMax freq 0.10 0.8 1.5 2.5 20.0 120.0 1000.0 Likely cost Max Cost 1,000 $ 2,000 $ 10,000 $ 20,000 $ 100,000 $ 200,000 $ 1,000,000 $ 2,000,000 $ 10,000,000 $ 20,000,000 $ NSW Dept of Commerce OICT ROSI TOOL V2.0 Prototype Statistical Module Sample Threat & Risk Assessment PLUS Cost Analysis Legend Purple cells contain values to be entered by the user Yellow cells contain calculated results Grey cells are copied as is from an actual TRA No. Asset Potential incident (Threat to the Asset) Likelihood Severity Estimated Risk Annual rate of occurrence Direct Cost per incident Opportunity Cost per incident Total UNTREATED Annual Cost #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? Significant Low A12 A13 Denial of service attack on carrier or provider network infrastructure Very Low Incorrect building patching Low Serious High Damaging Low Medium A11 Hardware failure of key infrastructure e.g. routers, PIX, switches) Very Low A10 A9 Destruction of key infrastructure e.g. routers, PIX, switches) Negligible A8 Availability of DXXY internet connection Serious Nil Significant Medium Misconfiguration of key infrastructure e.g. routers, PIX, switches) Low Failure of Cooling System Medium SignificantA14 DNS hardware failure Negligible Damaging Nil #NAME? #NAME? #NAME? #NAME? #NAME? #NAME? A16 Accidental misconfiguration of mail servers Low Damaging Medium #NAME? #NAME? #NAME? ANNUAL TOTALS #NAME? SUMMARY Annual Cost of Incidents -Untreated #NAME? (thousands) Annual Cost of Incidents -Residual after Countermeasures #NAME? (thousands) Annual Gross Savings #NAME? Countermeasure Upfront Cost 370,000 $ Countermeasure Recurring Cost 105,000 $ Ammortisation period (years) 3 Ammortised Countermeasure upfront cost 123,333 $ Countermeasure Annual Cost 228,333 $ Annual Nett Savings #NAME? (thousands) Damaging High A15 Availability of DXXY internet email Denial of service attack on email system HighCounter Measures Upfront Cost per Countermeaasur Recurring Cost per Countermeaasur Residual likelihood Residual severity Total TREATED Annual Cost Saving Per Threat Notes Business Continuity Plan (1) $ 50,000 $ 20,000 Spare parts (4) $ 50,000 $ 10,000 Service level agreements (5) $ -$ -Physical security (access control procedures and controls for computer room) (6) $ 10,000 $ 10,000 Negligible Minor #NAME? #NAME? Environmental controls for computer room (2) $ 30,000 $ 5,000 Business Continuity Plan (1) Counted Counted Service level agreements (5) Counted Counted Very low Minor #NAME? #NAME? Configuration management system (8) $ 70,000 $ 10,000 Change control procedures (15) $ 30,000 $ 5,000 Negligible Serious #NAME? #NAME? Business Continuity Plan (1) Counted Counted Spare parts (4) Counted Counted Service level agreements (5) Counted Counted Very low Minor #NAME? #NAME? Standards for cabling including labelling and coding (9) $ 10,000 $ -Physical security (6) Counted Counted Very low Significant #NAME? #NAME? Large capacity network connection (10) $ 10,000 $ 10,000 Redundant Internet connection (7) $ 10,000 $ 10,000 Very low Minor #NAME? #NAME? Harm reduced to Minor by BCP; Likelihood to Very Low by Environ controls Likelihood reduced to Negligible by Config Mgt Won't affect the likelihood of an event, but reduces harm by better recovery Redundancy means minor effect on failoverReplication of DNS server (11) $ 10,000 $ -Negligible Minor #NAME? #NAME? Network based Intrusion Detection System (NIDS) (12) $ 70,000 $ 20,000 Use DSD evaluated products (13) $ 20,000 $ 5,000 Deny all unless explicitly allowed firewall rules (14) $ -$ -Low Significant #NAME? #NAME? Change control procedures (15) (including peer review) Counted Counted Very low Damaging #NAME? #NAME? 370,000 $ 105,000 $ #NAME? #NAME? No amelioration of degree of harmoutputıNett Savings+ıNett Savingsı(thousands) Bin Min Bin Max Bin Range Frequency Cumulative% 800 1200 800 to 1200 6 2.40% 1200 1600 1200 to 1600 21 10.80% 1600 2000 1600 to 2000 35 24.80% 2000 2400 2000 to 2400 34 38.40% 2400 2800 2400 to 2800 43 55.60% 2800 3200 2800 to 3200 47 74.40% 3200 3600 3200 to 3600 35 88.40% 3600 4000 3600 to 4000 14 94.00% 4000 4400 4000 to 4400 9 97.60% 4400 4800 4400 to 4800 3 98.80% 4800 5200 4800 to 5200 2 99.60% 5200 5600 5200 to 5600 0 99.60% 5600 6000 5600 to 6000 1 100.00% 6000 6400 6000 to 6400 0 100.00% 6400 6800 6400 to 6800 0 100.00% Statistics Count 250 Mean 2662.955 Minimum 892.61 Maximum 5732.72 Range 4840.11 Median 2707.125 Sample Std Dev 837.0071 95 percentile 4076.224 90 percentile 3634.355 80 percentile 3302.514 20 percentile 1861.618 10 percentile 1539.278 5 percentile 1351.982 Kurtosis 0.121136 Skewness 0.324246 Nett Savings+ Nett Savings (thousands) 05 10 15 20 25 30 35 40 45 50 800 to 1200 1200 to 1600 1600 to 2000 2000 to 2400 2400 to 2800 2800 to 3200 3200 to 3600 3600 to 4000 Bin Range Frequency Frequencyoutput Nett Savings+ Nett Savings (thousands) 2800 to 3200 3200 to 3600 3600 to 4000 4000 to 4400 4400 to 4800 4800 to 5200 5200 to 5600 5600 to 6000 6000 to 6400 6400 to 6800 Bin Range 0.00% 10.00% 20.00% 30.00% 40.00% 50.00% 60.00% 70.00% 80.00% 90.00% 100.00% Cumulative% Frequency Cumulative%outputıTreated Cost+ıTreated Cost (thousands) Bin Min Bin Max Bin Range Frequency Cumulative% 30 48 30 to 48 12 4.80% 48 66 48 to 66 11 9.20% 66 84 66 to 84 28 20.40% 84 102 84 to 102 33 33.60% 102 120 102 to 120 34 47.20% 120 138 120 to 138 38 62.40% 138 156 138 to 156 28 73.60% 156 174 156 to 174 22 82.40% 174 192 174 to 192 13 87.60% 192 210 192 to 210 13 92.80% 210 228 210 to 228 9 96.40% 228 246 228 to 246 5 98.40% 246 264 246 to 264 3 99.60% 264 282 264 to 282 0 99.60% 282 300 282 to 300 1 100.00% Statistics Count 250 Mean 127.6752 Minimum 30 Maximum 291.51 Range 261.51 Median 125.075 Sample Std Dev 50.39796 95 percentile 220.069 90 percentile 199.956 80 percentile 167.366 20 percentile 83.218 10 percentile 67.799 5 percentile 48.201 Kurtosis -0.070369 Skewness 0.481518 Treated Cost+ Treated Cost (thousands) 05 10 15 20 25 30 35 40 30 to 48 48 to 66 66 to 84 84 to 102 102 to 120 120 to 138 138 to 156 156 to 174 Bin Range Frequency Frequencyoutput Treated Cost+ Treated Cost (thousands) 120 to 138 138 to 156 156 to 174 174 to 192 192 to 210 210 to 228 228 to 246 246 to 264 264 to 282 282 to 300 Bin Range 0.00% 10.00% 20.00% 30.00% 40.00% 50.00% 60.00% 70.00% 80.00% 90.00% 100.00% Cumulative% Frequency Cumulative%outputıUntreated Cost+ıUntreated Cost (thousands) ı Bin Min Bin Max Bin Range Frequency Cumulative% 1200 1600 1200 to 1600 7 2.80% 1600 2000 1600 to 2000 26 13.20% 2000 2400 2000 to 2400 34 26.80% 2400 2800 2400 to 2800 32 39.60% 2800 3200 2800 to 3200 43 56.80% 3200 3600 3200 to 3600 50 76.80% 3600 4000 3600 to 4000 29 88.40% 4000 4400 4000 to 4400 13 93.60% 4400 4800 4400 to 4800 10 97.60% 4800 5200 4800 to 5200 3 98.80% 5200 5600 5200 to 5600 2 99.60% 5600 6000 5600 to 6000 0 99.60% 6000 6400 6000 to 6400 1 100.00% 6400 6800 6400 to 6800 0 100.00% 6800 7200 6800 to 7200 0 100.00% Statistics Count 250 Mean 3018.963 Minimum 1207.97 Maximum 6112.75 Range 4904.78 Median 3075.075 Sample Std Dev 850.9572 95 percentile 4444.323 90 percentile 4024.926 80 percentile 3648.446 20 percentile 2232.722 10 percentile 1903.6 5 percentile 1670.51 Kurtosis 0.1163 Skewness 0.325521 Untreated Cost+ Untreated Cost (thousands) 0 10 20 30 40 50 60 1200 to 1600 1600 to 2000 2000 to 2400 2400 to 2800 2800 to 3200 3200 to 3600 3600 to 4000 4000 to 4400 Bin Range Frequency Frequencyoutput Untreated Cost+ Untreated Cost (thousands) 3200 to 3600 3600 to 4000 4000 to 4400 4400 to 4800 4800 to 5200 5200 to 5600 5600 to 6000 6000 to 6400 6400 to 6800 6800 to 7200 Bin Range 0.00% 10.00% 20.00% 30.00% 40.00% 50.00% 60.00% 70.00% 80.00% 90.00% 100.00% Cumulative% Frequency Cumulative%output Untreated Cost+ Untreated Cost (thousand s) output Treated Cost+ Treated Cost (thousand s) output Nett Savings+ Nett Savings (thousand s) $2,234.59 $144.39 $1,861.86 $3,015.07 $82.01 $2,704.73 $3,049.91 $112.06 $2,709.52 $2,690.81 $127.06 $2,335.42 $1,965.54 $39.45 $1,697.76 $2,268.19 $111.92 $1,927.93 $3,131.84 $106.87 $2,796.63 $2,697.97 $76.12 $2,393.52 $3,243.70 $105.48 $2,909.88 $5,288.84 $214.02 $4,846.49 $3,111.59 $116.49 $2,766.77 $3,348.20 $130.23 $2,989.64 $2,518.93 $82.63 $2,207.96 $2,340.98 $93.73 $2,018.91 $2,057.96 $96.87 $1,732.75 $1,979.33 $33.76 $1,717.23 $2,518.94 $128.86 $2,161.75 $3,552.03 $30.00 $3,293.70 $2,325.22 $191.95 $1,904.93 $3,490.20 $242.42 $3,019.44 $3,030.45 $141.29 $2,660.83 $3,140.93 $116.86 $2,795.74 $1,526.77 $150.14 $1,148.30 $2,404.11 $114.82 $2,060.96 $2,590.75 $138.08 $2,224.33 $4,718.42 $177.66 $4,312.43 $3,024.83 $98.91 $2,697.59 $3,622.94 $78.32 $3,316.29 $3,344.25 $206.21 $2,909.71 $3,292.39 $232.58 $2,831.48 $4,661.12 $208.99 $4,223.80 $3,746.36 $163.33 $3,354.70 $3,201.38 $70.45 $2,902.59 $2,578.80 $100.72 $2,249.74 $3,406.28 $129.16 $3,048.78 $1,974.61 $98.42 $1,647.85 $3,317.84 $48.41 $3,041.10 $1,652.19 $124.60 $1,299.25 $2,006.90 $100.27 $1,678.29 $3,755.46 $122.97 $3,404.16 $3,589.52 $62.11 $3,299.07 $3,625.39 $139.98 $3,257.08 $3,469.22 $159.70 $3,081.19 $3,530.08 $75.94 $3,225.81$2,415.15 $90.44 $2,096.37 $2,622.81 $79.89 $2,314.58 $3,956.36 $193.98 $3,534.05 $3,022.32 $153.34 $2,640.65 $3,752.75 $182.07 $3,342.35 $4,041.09 $183.65 $3,629.11 $2,866.70 $209.40 $2,428.97 $3,581.01 $127.13 $3,225.54 $2,139.17 $199.40 $1,711.44 $2,583.84 $160.38 $2,195.13 $3,161.81 $146.09 $2,787.39 $2,284.49 $115.31 $1,940.84 $2,754.08 $40.12 $2,485.63 $2,450.92 $112.72 $2,109.87 $3,173.25 $111.02 $2,833.89 $3,115.69 $106.02 $2,781.34 $2,717.50 $158.04 $2,331.13 $2,271.07 $137.34 $1,905.40 $2,537.36 $94.20 $2,214.83 $3,356.32 $76.58 $3,051.41 $2,128.87 $61.63 $1,838.91 $3,402.88 $83.24 $3,091.30 $1,865.99 $131.33 $1,506.32 $1,207.97 $87.03 $892.61 $2,982.45 $158.27 $2,595.84 $3,597.80 $167.22 $3,202.24 $3,263.61 $193.75 $2,841.53 $2,905.47 $90.53 $2,586.60 $2,541.23 $80.87 $2,232.03 $1,535.58 $125.09 $1,182.16 $1,644.00 $101.55 $1,314.11 $2,769.69 $189.54 $2,351.82 $2,042.57 $148.96 $1,665.28 $1,879.18 $134.52 $1,516.33 $2,297.60 $63.94 $2,005.33 $3,817.35 $189.52 $3,399.50 $1,775.52 $109.53 $1,437.66 $3,226.96 $99.00 $2,899.63 $2,982.28 $100.33 $2,653.62 $3,408.56 $89.24 $3,090.99 $3,908.34 $149.73 $3,530.28 $2,029.09 $145.14 $1,655.63 $2,184.82 $110.24 $1,846.25 $2,710.19 $87.55 $2,394.30 $2,569.26 $189.50 $2,151.43 $1,928.47 $70.66 $1,629.48 $4,009.99 $100.09 $3,681.56 $3,150.68 $125.06 $2,797.29 $4,406.63 $220.42 $3,957.88 $3,398.73 $181.73 $2,988.66 $2,084.01 $192.99 $1,662.69 $3,555.49 $139.74 $3,187.41$3,306.61 $85.17 $2,993.11 $3,148.14 $228.61 $2,691.20 $2,370.21 $153.52 $1,988.35 $3,682.04 $89.99 $3,363.72 $2,148.45 $131.45 $1,788.67 $5,449.34 $191.95 $5,029.06 $4,445.25 $77.13 $4,139.80 $3,403.79 $168.76 $3,006.69 $2,939.95 $79.34 $2,632.27 $3,150.11 $128.30 $2,793.47 $2,112.72 $125.86 $1,758.53 $4,510.87 $191.30 $4,091.24 $2,392.53 $100.94 $2,063.25 $3,302.66 $128.29 $2,946.04 $3,072.62 $104.36 $2,739.92 $4,682.72 $42.39 $4,412.00 $3,637.58 $134.75 $3,274.50 $3,118.60 $139.95 $2,750.32 $1,661.24 $86.50 $1,346.41 $3,559.54 $111.61 $3,219.60 $3,538.78 $209.39 $3,101.06 $1,952.81 $138.30 $1,586.18 $3,075.78 $75.44 $2,772.01 $4,606.85 $130.37 $4,248.15 $4,827.56 $134.54 $4,464.68 $1,623.18 $107.99 $1,286.85 $1,993.87 $79.37 $1,686.16 $2,315.99 $133.57 $1,954.08 $2,788.54 $164.75 $2,395.46 $3,786.53 $108.49 $3,449.70 $3,273.08 $162.94 $2,881.81 $3,116.11 $47.18 $2,840.60 $3,440.48 $112.16 $3,099.99 $4,337.60 $102.04 $4,007.23 $2,136.26 $77.24 $1,830.68 $1,633.44 $48.03 $1,357.08 $1,864.12 $96.34 $1,539.45 $3,316.48 $54.25 $3,033.90 $2,287.52 $209.23 $1,849.96 $2,195.68 $106.70 $1,860.65 $4,023.02 $240.05 $3,554.64 $3,222.73 $194.94 $2,799.46 $3,439.67 $118.12 $3,093.22 $3,025.95 $224.35 $2,573.27 $4,023.13 $251.78 $3,543.02 $4,427.89 $204.96 $3,994.60 $4,215.48 $148.06 $3,839.08 $3,573.54 $212.65 $3,132.55 $2,962.69 $138.53 $2,595.83 $4,775.46 $220.49 $4,326.64 $3,378.12 $95.86 $3,053.93 $2,649.72 $126.87 $2,294.52$2,027.97 $91.24 $1,708.40 $3,144.41 $85.06 $2,831.02 $2,144.36 $165.81 $1,750.22 $1,687.42 $71.08 $1,388.00 $1,904.13 $168.81 $1,506.99 $3,412.70 $162.65 $3,021.72 $2,727.05 $112.94 $2,385.77 $2,383.82 $126.85 $2,028.64 $3,130.52 $161.56 $2,740.63 $3,729.31 $44.35 $3,456.62 $3,539.86 $217.76 $3,093.77 $1,727.94 $97.07 $1,402.53 $3,984.99 $144.84 $3,611.81 $2,818.97 $70.57 $2,520.07 $2,348.87 $140.49 $1,980.04 $2,873.06 $152.24 $2,492.49 $3,241.82 $109.04 $2,904.45 $2,889.83 $82.92 $2,578.58 $2,784.40 $128.67 $2,427.40 $3,074.37 $99.36 $2,746.68 $3,460.54 $65.61 $3,166.60 $4,360.38 $219.64 $3,912.40 $3,639.64 $209.28 $3,202.03 $4,443.19 $156.98 $4,057.87 $2,416.19 $128.07 $2,059.79 $2,256.29 $149.64 $1,878.32 $3,263.40 $118.96 $2,916.10 $2,960.47 $104.03 $2,628.11 $4,806.71 $66.20 $4,512.18 $1,816.05 $67.07 $1,520.65 $3,638.40 $167.95 $3,242.12 $2,842.37 $123.11 $2,490.93 $2,100.11 $111.65 $1,760.13 $2,484.80 $90.99 $2,165.48 $2,415.88 $61.40 $2,126.14 $1,898.83 $164.22 $1,506.28 $3,918.87 $158.37 $3,532.16 $2,811.94 $125.50 $2,458.11 $2,426.78 $124.89 $2,073.56 $1,555.38 $75.42 $1,251.63 $1,423.35 $124.12 $1,070.90 $3,115.07 $243.29 $2,643.45 $2,697.12 $120.29 $2,348.50 $3,781.33 $86.44 $3,466.56 $3,663.07 $166.67 $3,268.07 $3,381.31 $78.11 $3,074.87 $3,809.84 $116.03 $3,465.48 $1,898.71 $149.30 $1,521.08 $3,291.02 $135.24 $2,927.44 $3,384.76 $103.96 $3,052.47 $3,011.99 $132.87 $2,650.79 $2,874.31 $83.13 $2,562.85$4,168.70 $91.31 $3,849.06 $2,434.90 $71.97 $2,134.59 $3,076.30 $291.51 $2,556.46 $1,338.90 $60.09 $1,050.48 $3,749.97 $177.89 $3,343.75 $3,713.22 $32.51 $3,452.38 $3,895.77 $137.43 $3,530.01 $3,617.47 $127.70 $3,261.43 $3,241.33 $98.73 $2,914.27 $3,600.29 $138.22 $3,233.73 $2,470.25 $106.61 $2,135.30 $4,832.92 $223.17 $4,381.41 $3,644.79 $195.94 $3,220.52 $2,212.84 $37.18 $1,947.33 $4,021.74 $177.72 $3,615.68 $2,834.26 $117.06 $2,488.86 $2,900.60 $129.89 $2,542.38 $1,872.89 $106.82 $1,537.73 $3,773.84 $141.24 $3,404.26 $3,175.57 $67.88 $2,879.36 $2,759.97 $80.33 $2,451.31 $2,559.70 $42.88 $2,288.48 $1,928.72 $37.10 $1,663.29 $1,419.39 $96.59 $1,094.47 $1,650.56 $131.40 $1,290.83 $3,282.51 $251.85 $2,802.32 $3,558.65 $131.37 $3,198.94 $3,383.09 $169.69 $2,985.07 $3,254.62 $147.61 $2,878.68 $4,274.97 $91.17 $3,955.47 $3,850.75 $160.59 $3,461.83 $2,225.25 $59.48 $1,937.44 $4,269.14 $138.72 $3,902.09 $2,942.19 $118.97 $2,594.88 $4,130.57 $129.42 $3,772.82 $1,681.84 $81.11 $1,372.40 $3,229.50 $107.75 $2,893.42 $3,677.57 $125.67 $3,323.56 $3,993.29 $142.81 $3,622.15 $4,182.24 $101.27 $3,852.64 $2,312.90 $218.11 $1,866.46 $2,732.98 $105.62 $2,399.02 $2,271.70 $183.82 $1,859.54 $2,370.23 $54.18 $2,087.71 $3,055.50 $168.90 $2,658.26 $3,211.06 $44.46 $2,938.27 $6,112.75 $151.70 $5,732.72 $3,321.62 $169.11 $2,924.17 $1,717.30 $141.16 $1,347.81 $3,400.89 $246.91 $2,925.65