FRM Part II · FRM Exam Part II · Case Study: Cyberthreats and Information Security Risks
A bank's risk team wants to express cyber risk in financial terms for the board. Which approach best reflects a quantitative cyber risk measure rather than a qualitative one?
Estimating annual loss exposure as frequency times severity is a quantitative cyber risk measure because it produces a monetary expected loss. Heat-map ratings, blocked-email counts and control checklists describe status or activity but do not convert cyber risk into financial terms for decision making.
- ARating each system red, amber or green based on workshop opinions
- BEstimating annual loss exposure as expected event frequency multiplied by expected loss severityCorrect
- CCounting the number of phishing emails blocked each month
- DListing the controls from a security framework that are fully implemented
Explanation
Multiplying estimated annual frequency by expected severity yields a monetary expected loss, which is a quantitative measure. Red/amber/green ratings are qualitative. Phishing counts and control lists are activity or compliance indicators, not financial loss measures.
Did you get it right without looking?
One question tells you little. A timed set on Case Study: Cyberthreats and Information Security Risks shows your real accuracy, how long you take and where you lose marks.
More Case Study: Cyberthreats and Information Security Risks questions
- A bank's cyber control self-assessment rates a key control as effective, but a penetration test shows an attacker could bypass it in under a…
- A bank's payment-processing database is hit by ransomware that encrypts the files, so tellers and customers cannot access account balances f…
- Following a ransomware event, a firm finds that its backups were stored on the same network and were encrypted along with production data. W…
- When a bank quantifies cyber risk using scenario analysis, which practice best improves the reliability of the resulting estimates?
- A bank's risk team ranks a customer-data repository as high priority because a breach would expose personal information and trigger regulato…
- After a major breach, a post-incident review finds that security alerts had fired for weeks but were not escalated because the monitoring te…