MIS 4850 Systems SecurityWeek3 Risk Analysis ExercisesSubmis.docx

MIS 4850 Systems Security
Week3 Risk Analysis Exercises
Submission instructions:
1) Edit this Word file and type in your answers to the questions
for Exercise 1 and Exercise 2.
2) When done, save the file to your flash disk and upload a copy
to the Week3 Risk Analysis Exercises dropbox
Exercise 1
As a junior Security Analyst at Zinder Inc., your boss asked you
to perform a classic risk analysis in order to help the company
make a decision about whether or not to investing in one of the
countermeasures that the company is planning on implementing.
The countermeasures are meant to help protect the company’s
multifunction server (that has a value of $15,000) and all the
software and databases it host against security attacks. The
value of the software and the databases is estimated at
$485,000. In case of a successful attack, it is expected that 80
percent of the asset’s value will be lost. An attack is expected
to be successful once every five years. Countermeasure A will
cut the amount lost per incident by 75 percent. Countermeasure
B will cut the frequency of successful attack in half.
Countermeasure A will cost $30,000 per year, while
Countermeasure B will cost $5,000 per year.
Question 1: Conduct a classic risk analysis using the template
below. Note: you need to calculate all the numbers and use them
to complete this template (table).
Base Case
Countermeasure

A
B
Asset Value
AV
$500,000
$500,000
$500,000
Exposure Factor
EF
80%
20%
80%
Single Loss Expectancy
SLE
$400,000
$100,000
$400,000
Annualized Rate of Occurrence
ARO
20%
20%
10%
Annualized Loss Expectancy
ALE
$80,000
$20,000
$40,000
ALE Reduction for Countermeasure
--
NA
$60,000
$40,000
Annualized Countermeasure Cost
--
NA
$30,000

$5,000
Annualized Net Countermeasure Value
--
NA
$30,000
$35,000
Question 2: Based on the results of the risk analysis, which of
the two countermeasures Zinder Inc. should implement (if any).
Explain your choice of countermeasure by providing supporting
evidence from the result the risk analysis you performed when
answering Question 1.
Countermeasure B seems to be the best because:
· Its annualized cost is less costs ($5000 versus $30000)
· Its net annualized value is also higher than the net value of A
($35000 versus $30000)
· Finally, it cuts the ARO by half from 20% to 10
Exercise 2:
A company has a resource XYZ. If there is a single breach of
security, the company may face a fine of $100,000 and pay
another $20,000 to clean up the breach. Based on statistics
gathered by the SANS Government agency, an attack targeting
the company’s assets is likely to be successful about once in
five years. A proposed countermeasure should cut the frequency
of occurrence in half. How much should the company be willing
to pay for the countermeasure
Question 1: Use you classic risk analysis skills to complete the
template below based on the information provided in this case.
Note: you need to calculate all the numbers.
Base Case

With Countermeasure
Single Loss Expectancy
$120,000
$120,000
Annualized Rate of Occurrence
20% (1 in 5 years)
10% (1/2 of base frequency)
Annualized Loss Expectancy
$24,000
$12,000
ALE Reduction for Countermeasure
$12,000
Question 2: Based on the results of the risk analysis, what is the
maximum that the company should be willing to pay for the
countermeasure? Explain.
The countermeasure’s annualized expected benefit is $12,000
per year. The company should be willing to pay up to $12,000
annually but no more. If the countermeasure’s cost is > $12,000
then, the Annualized net value for the countermeasure will be
negative.
Running Head: SUN COAST REMEDIATION COURSE
PROJECT 1
SUN COAST REMEDIATION COURSE PROJECT
2

Sun Coast Remediation Course Project
Name
Institution
Introduction
Senior leadership at Sun Coast has identified several areas for
concern that they believe could be solved using business
research methods. The previous director was tasked with
conducting research to help provide information to make
decisions about these issues. Although data were collected, the
project was never completed. Senior leadership is interested in
seeing the project through to fruition. The following is the
completion of that project and includes the statement of the
problems, literature review, research objectives, research
questions and hypotheses, research methodology, design, and
methods, data analysis, findings, and recommendations.
Research problems
Six business problems were identified:
Particulate Matter (PM)
There is a concern that job-site particle pollution is adversely
impacting employee health. Although respirators are required in
certain environments, PM varies in size depending on the
project and job site. PM that is between 10 and 2.5 microns can
float in the air for minutes to hours (e.g., asbestos, mold spores,
pollen, cement dust, fly ash), while PM that is less than 2.5
microns can float in the air for hours to weeks (e.g. bacteria,
viruses, oil smoke, smog, soot). Due to the smaller size of PM
that is less than 2.5 microns, it is potentially more harmful than
PM that is between 10 and 2.5 since the conditions are more
suitable for inhalation. PM that is less than 2.5 is also able to be
inhaled into the deeper regions of the lungs, potentially causing
more deleterious health effects. It would be helpful to
understand if there is a relationship between PM size and

employee health. PM air quality data have been collected from
103 job sites, which is recorded in microns. Data are also
available for average annual sick days per employee per job-
site.
Safety Training Effectiveness
Health and safety training is conducted for each new contract
that is awarded to Sun Coast. Data for training expenditures and
lost-time hours were collected from 223 contracts. It would be
valuable to know if training has been successful in reducing
lost-time hours and, if so, how to predict lost-time hours from
training expenditures.
Sound-Level Exposure
Sun Coast’s contracts generally involve work in noisy
environments due to a variety of heavy equipment being used
for both remediation and the clients’ ongoing operations on the
job sites. Standard ear-plugs are adequate to protect employee
hearing if the decibel levels are less than 120 decibels (dB). For
environments with noise levels exceeding 120 dB, more
advanced and expensive hearing protection is required, such as
earmuffs. Historical data have been collected from 1,503
contracts for several variables that are believed to contribute to
excessive dB levels. It would be important if these data could
be used to predict the dB levels of work environments before
placing employees on-site for future contracts. This would help
the safety department plan for procurement of appropriate ear
protection for employees.
New Employee Training
All new Sun Coast employees participate in general health and
safety training. The training program was revamped and
implemented six months ago. Upon completion of the training
programs, the employees are tested on their knowledge. Test
data are available for two groups: Group A employees who
participated in the prior training program and Group B
employees who participated in the revised training program. It
is necessary to know if the revised training program is more
effective than the prior training program.

Lead Exposure
Employees working on job sites to remediate lead must be
monitored. Lead levels in blood are measured as micrograms of
lead per deciliter of blood (μg/dL). A baseline blood test is
taken pre-exposure and postexposure at the conclusion of the
remediation. Data are available for 49 employees who recently
concluded a 2-year lead remediation project. It is necessary to
determine if blood lead levels have increased.
Return on Investment
Sun Coast offers four lines of service to their customers,
including air monitoring, soil remediation, water reclamation,
and health and safety training. Sun Coast would like to know if
each line of service offers the same return on investment.
Return on investment data are available for air monitoring, soil
remediation, water reclamation, and health and safety training
projects. If return on investment is not the same for all lines of
service, it would be helpful to know where differences exist.
Research Objectives
The following were the objectives of the research:
RO1: To determine if there is a relationship between the size of
PM and the health of employees.
RO2: To identify whether safety training has been effective in
reducing the time lost in hours.
RO3: To determine the dB levels in job sites before sending
employees to work there.
RO4: To determine if the new employee training program is
more effective than the previous one.
RO5: To determine whether the blood lead levels in employees
have increased in order to determine the level of exposure to
lead.
RO6: To identify if there is a difference in the return on
investment on the company’s lines of service.
Research Questions and Hypotheses
This research aimed at measuring the following hypotheses and
answering the following research question:
RQ1: Is there a relationship between the size of PM and the

health of employees?
H01: There is no relationship between the size of PM and the
health of employees.
HA1: There is a significant relationship between the size of PM
and the health of employees.
RQ2: Has the safety training been effective in reducing the time
lost in hours?
H02: The safety training has not been effective in reducing the
time lost in hours.
HA2: The safety training has caused a significant reduction in
the time lost in hours.
RQ3: Does the dB level in the job site exceed the standard
12decibels?
H03: The dB level does not exceed 120 decibels in the job site.
HA3: There is evidence that the dB level exceeds 12o decibels
in the job site.
RQ4: Is the new employee training program more effective than
the previous one?
H04: The new employee training program is not as effective as
the previous one.
HA4: There is significant evidence that the new employee
training program is more effective than the previous one.
RQ5: Have the blood lead levels in employees increased?
H05: There is no evidence of increase in blood lead levels in
employees.
HA5: There is evidence of increase in blood lead levels in
employees.
RQ6: Is there a difference in the return on investment among
the company’s lines of service?
H06: There is no notable difference in the return on investment
among the company’s lines of service.

HA6: There is a significant difference in the return on
investment among the company’s lines of service.
Running head: INSERT TITLE HERE 1
INSERT TITLE HERE 3
Insert Title Here
Insert Your Name Here
Insert University Here
Research Methodology, Design, and Methods
After providing a brief introduction to this section, students
should detail the research design they have selected and why it
is an appropriate research approach for addressing the business
problems. Use the following subheadings to include all required
information. Important Note: Students should refer to the
information presented in the Unit III Study Guide and the Unit
III Syllabus instructions to complete this section of the project.
Delete this before you begin.
Research Methodology
Explain the research methodology chosen for this research

project and provide rationale for why it is appropriate given the
problems.
Research Design
Students should explain whether the research design is
exploratory, causal, or descriptive. Provide rationale for the
choice.
Research Methods
Students should describe the research methods used for this
research study based on the research methodology, research
design, and research questions, and provide a rationale as to
why they were chosen. They might include a combination of
experimentation, descriptive statistics, correlation, and causal-
comparative methods.
Data Collection Methods
Students should specify how the data were most likely collected
to test the hypotheses. Data collection methods include, but are
not limited to, survey, observation, and records analysis.
Sampling Design
Students should briefly describe the type of sampling design
that was most likely used for the data that were collected.
Choices include, but are not limited to, random sample,
convenience sample, etc. Explain your rationale for your
sampling design selection(s).
Data Analysis Procedures
Students should specify the statistical procedures used to test
each set of hypotheses from among correlation, regression, t
test, and ANOVA. They should explain why each procedure was
the most appropriate choice.
Example:
Correlation is the preferred procedure to use to test the RQ1
hypotheses since the interest is whether a relationship exists
between an independent variable (IV) and dependent variable
(DV). Correlation will indicate if there is a relationship between
height (IV) and weight (DV), the strength of the relationship,
and the direction of the relationship.

References
Include references here using hanging indentations like the
example below. Remember to delete this example.
Creswell, J. W., & Creswell, J. D. (2018). Research design:
Qualitative, quantitative, and mixed methods approaches (5th
ed.). Thousand Oaks, CA: Sage.
Running head: INSERT TITLE HERE 1
INSERT TITLE HERE 17
Insert Title Here
Insert Your Name Here
Insert University Here
Sun Coast Remediation Course Project Guidance
Background
To help make a connection between business research and its
use in the real world, this course will use an iterative course
project. Throughout the term, you will serve as the health and
safety director for Sun Coast Remediation (Sun Coast).

Sun Coast provides remediation services to business and
governmental organizations. Most of their contracts involve
working within contamination sites where they remove toxic
substances from soil and water. In addition to the toxicity of the
air, water, and soil their employees come into contact with, the
work environment is physically demanding and potentially
contributory to injuries involving musculoskeletal systems,
vision, and hearing. Sun Coast genuinely cares about the health,
safety, and well-being of their 5,500 employees, but they are
also concerned about worker compensation costs and potential
long-term litigation from injuries and illness related to
employment.
Health and Safety Director Task
Sun Coast hired you last month to replace the previous health
and safety director, who left to pursue other opportunities. This
is a critical position within the company because there are many
health and safety-related issues due to the nature of the work.
The former health and safety director was in the midst of
analyzing these issues through the implementation of a research
project when she left the organization.
Throughout the term, you will use your knowledge of research
methods to bring the research project to fruition. You will
conduct a literature review, develop research questions and
hypotheses, create the research design, test data, interpret data,
and present the findings. Each unit will accomplish one of these
tasks. It has already been decided that the business problems
will be best addressed using a quantitative research
methodology. You will not collect any data for this project. The
former health and safety director had already collected the data,
which is provided for you in an Excel spreadsheet.
Statistical Tools

You will conduct the data analysis using Microsoft Excel
Toolpak. View these links for information:
https://support.office.com/en-us/article/load-the-analysis-
toolpak-in-excel-6a63e598-cd6d-42e3-9317-6b40ba1a66b4 and
https://www.excel-easy.com/data-analysis/analysis-toolpak.html
Sun Coast Remediation Course Project Sections
Since this is a quantitative research study, there are specific
steps that should be followed. The following is a template that
will help you develop your project. (It is also provided as a
template in Unit VII.) Use this information to guide your
completion of the course project.
Table of Contents
Include the table of contents here. There is a tool for creating a
table of contents in the References tab of the Microsoft Word
tool bar at the top of the screen. Remember to delete this text
and the instructions from the previous page before you begin.
Executive Summary
The executive summary will go here. The paragraphs are not
indented, and it should be formatted like an abstract. The
executive summary should be composed after the project is
complete. It will be the final step in the project. Delete this text
before you begin.
Introduction
Note: The following introduction should remain in the research
project unchanged. Delete this note before you begin.
Senior leadership at Sun Coast has identified several areas for
concern that they believe could be solved using business
research methods. The previous director was tasked with
conducting research to help provide information to make
decisions about these issues. Although data were collected, the

project was never completed. Senior leadership is interested in
seeing the project through to fruition. The following is the
completion of that project and includes the statement of the
problems, literature review, research objectives, research
questions and hypotheses, research methodology, design, and
methods, data analysis, findings, and recommendations.
Statement of the Problems
Note: The following statement of the problems should remain in
the research project unchanged. Delete this note before you
begin.
Six business problems were identified:
Particulate Matter (PM)
There is a concern that job-site particle pollution is adversely
impacting employee health. Although respirators are required in
certain environments, PM varies in size depending on the
project and job site. PM that is between 10 and 2.5 microns can
float in the air for minutes to hours (e.g., asbestos, mold spores,
pollen, cement dust, fly ash), while PM that is less than 2.5
microns can float in the air for hours to weeks (e.g. bacteria,
viruses, oil smoke, smog, soot). Due to the smaller size of PM
that is less than 2.5 microns, it is potentially more harmful than
PM that is between 10 and 2.5 since the conditions are more
suitable for inhalation. PM that is less than 2.5 is also able to be
inhaled into the deeper regions of the lungs, potentially causing
more deleterious health effects. It would be helpful to
understand if there is a relationship between PM size and
employee health. PM air quality data have been collected from
103 job sites, which is recorded in microns. Data are also
available for average annual sick days per employee per job-
site.
Safety Training Effectiveness
Health and safety training is conducted for each new contract
that is awarded to Sun Coast. Data for training expenditures and
lost-time hours were collected from 223 contracts. It would be
valuable to know if training has been successful in reducing
lost-time hours and, if so, how to predict lost-time hours from

training expenditures.
Sound-Level Exposure
Sun Coast’s contracts generally involve work in noisy
environments due to a variety of heavy equipment being used
for both remediation and the clients’ ongoing operations on the
job sites. Standard ear-plugs are adequate to protect employee
hearing if the decibel levels are less than 120 decibels (dB). For
environments with noise levels exceeding 120 dB, more
advanced and expensive hearing protection is required, such as
earmuffs. Historical data have been collected from 1,503
contracts for several variables that are believed to contribute to
excessive dB levels. It would be important if these data could
be used to predict the dB levels of work environments before
placing employees on-site for future contracts. This would help
the safety department plan for procurement of appropriate ear
protection for employees.
New Employee Training
All new Sun Coast employees participate in general health and
safety training. The training program was revamped and
implemented six months ago. Upon completion of the training
programs, the employees are tested on their knowledge. Test
data are available for two groups: Group A employees who
participated in the prior training program and Group B
employees who participated in the revised training program. It
is necessary to know if the revised training program is more
effective than the prior training program.
Lead Exposure
Employees working on job sites to remediate lead must be
monitored. Lead levels in blood are measured as micrograms of
lead per deciliter of blood (μg/dL). A baseline blood test is
taken pre-exposure and postexposure at the conclusion of the
remediation. Data are available for 49 employees who recently
concluded a 2-year lead remediation project. It is necessary to
determine if blood lead levels have increased.
Return on Investment
Sun Coast offers four lines of service to their customers,

including air monitoring, soil remediation, water reclamation,
and health and safety training. Sun Coast would like to know if
each line of service offers the same return on investment.
Return on investment data are available for air monitoring, soil
remediation, water reclamation, and health and safety training
projects. If return on investment is not the same for all lines of
service, it would be helpful to know where differences exist.
Literature Review
should include the literature review information here. Important
Note: Students should refer to the information presented in the
Unit I Study Guide and the Unit I Syllabus instructions to
complete this section of the project. Delete this before you
begin.
Research Objectives
should include research objectives here. Students should
compose short, direct statements about the objectives of the
study. Research objectives should relate to the problems that
have been identified above, and there should be one objective
for each problem as shown in the example below. Important
Note: Students should refer to the information presented in the
Unit II Syllabus instructions to complete this section of the
project. Delete this before you begin.
Example:
RO1: Determine if a person’s height is related to weight.
RO2:
RO3:
RO4:
RO5:
RO6:
Research Questions and Hypotheses
should state the research questions and hypotheses. Each
research objective should have a corresponding research
question and a null and alternative hypothesis as shown in the

example below. In total, there should be six research questions
and twelve hypotheses. Important Note: Students should refer to
the information presented in the Unit II Study Guide and the
Unit II Syllabus instructions to complete this section of the
project. Delete this before you begin.
Example:
RQ1: Is there a relationship between height and weight?
H01: There is no statistically significant relationship between
height and weight.
HA1: There is a statistically significant relationship between
height and weight.
RQ2:
H02:
HA2:
RQ3:
H03:
HA3:
RQ4:
H04:
HA4:
RQ5:
H05:
HA5:
RQ6:
H06:
HA6:
Research Methodology, Design, and Methods
should detail the research design they have selected and why it
is an appropriate research approach for addressing the business
problems. Use the following subheadings to include all required

information. Important Note: Students should refer to the
information presented in the Unit III Study Guide and the Unit
III Syllabus instructions to complete this section of the project.
Delete this before you begin.
Research Methodology
Explain the research methodology chosen for this research
project and provide rationale for why it is appropriate given the
problems.
Research Design
Students should explain whether the research design is
exploratory, causal, or descriptive. Provide rationale for the
choice.
Research Methods
Students should describe the research methods used for this
research study based on the research methodology, research
design, and research questions, and provide a rationale as to
why they were chosen. They might include a combination of
experimentation, descriptive statistics, correlation, and causal-
comparative methods.
Data Collection Methods
Students should specify how the data were most likely collected
to test the hypotheses. Data collection methods include, but are
not limited to, survey, observation, and records analysis.
Sampling Design
Students should briefly describe the type of sampling design
that was most likely used for the data that were collected.
Choices include, but are not limited to, random sample,
convenience sample, etc. Explain your rationale for your
sampling design selection(s).
Data Analysis Procedures
Students should specify the statistical procedures used to test
each set of hypotheses from among correlation, regression, t
test, and ANOVA. They should explain why each procedure was
the most appropriate choice.
Example:
Correlation is the preferred procedure to use to test the RQ1

hypotheses since the interest is whether a relationship exists
between an independent variable (IV) and dependent variable
(DV). Correlation will indicate if there is a relationship between
height (IV) and weight (DV), the strength of the relationship,
and the direction of the relationship.
Data Analysis: Descriptive Statistics and Assumption Testing
should provide the Excel Toolpak results of their descriptive
analyses. Frequency tables, histograms, and descriptive
statistics tables should be cut and pasted from Excel directly
into the final project document. Important Note: Students
should refer to the information presented in the Unit IV Study
Guide and the Unit IV Syllabus instructions to complete this
section of the project. Delete this before you begin.
Correlation: Descriptive Statistics and Assumption Testing
Students should include this information here. Include
frequency table, histogram, and descriptive statistics table.
Evaluate and discuss the descriptive statistics and make an
explicit statement about whether the assumptions for parametric
statistical testing were met or not met. Delete these statements
before you begin.
Simple Regression: Descriptive Statistics and Assumption
Testing
Evaluate and discuss the descriptive statistics, and make an
before you begin.
Multiple Regression: Descriptive Statistics and Assumption
Testing
Evaluate and discuss the descriptive statistics and make an

before you begin.
Independent Samples t Test: Descriptive Statistics and
Assumption Testing
before you begin.
Dependent Samples (Paired-Samples) t Test: Descriptive
Statistics and Assumption Testing
before you begin.
ANOVA: Descriptive Statistics and Assumption Testing
before you begin
Data Analysis: Hypothesis Testing
should provide the Excel Toolpak results of their hypothesis
testing. The statistical output tables should be cut and pasted
from Excel directly into the final project document. For the
regression hypotheses, the students should display and discuss
the predictive regression equations. Important Note: Students
should refer to the information presented in the Units V and VI
Study Guides and the Units V and VI Syllabus instructions to
complete this section of the project. Delete this before you
begin.
Correlation: Hypothesis Testing

Students should include this information here. Restate the null
and alternative hypotheses, cut and paste the statistical output
from Excel Toolpak, discuss the p-value in relation to alpha and
explicitly accept or reject the null and alternative hypotheses.
Delete these statements before you begin.
Simple Regression: Hypothesis Testing
Students should include this information here. Restate the
null and alternative hypotheses, cut and paste the statistical
output from Excel Toolpak, and interpret and explain the simple
regression analysis results below the Excel output. Your
explanation should include: multiple R, R square, alpha level,
ANOVA F value, accept or reject the null and alternative
hypotheses for the model, statistical significance of the x
variable coefficient, and the regression model as an equation
with explanation. Delete these statements before you begin.
Multiple Regression: Hypothesis Testing
from Excel Toolpak, and interpret and explain the simple
regression analysis results below the Excel output. Your
explanation should include: multiple R, R square, alpha level,
ANOVA F value, accept or reject the null and alternative
hypotheses for the model, statistical significance of the x
variable coefficients, and the regression model as an equation
with explanation.
Independent Samples t Test: Hypothesis Testing
Dependent Samples (Paired Samples) t Test: Hypothesis Testing

ANOVA: Hypothesis Testing
Findings
After providing a brief introduction to this section,
students should discuss the findings in the context of Sun
Coast’s problems and the associated research objectives and
research questions. Important Note: Students should refer to the
information presented in the Unit VII Study Guide and the Unit
VII Syllabus instructions to complete this section of the project.
Restate each research objective, and discuss them in the context
of your hypothesis testing results. The following are some
things to consider. What answers did the analysis provide to
your research questions? What do those answers tell you? What
are the implications of those answers? Delete these statements
before you begin.
Example:
RO1: Determine if a person’s height is related to weight.
The results of the statistical testing showed that a person’s
height is related to their weight. It is a relatively strong and
positive relationship between height and weight. We would,
therefore, expect to see in our population taller people having a
greater weight relative to those of shorter people. This
determination suggests restrictions on industrial equipment
should be stated in maximum pounds allowed rather than
maximum number of people allowed.
RO2:
RO3:
RO4:
RO5:
RO6:
Recommendations

should include recommendations here in paragraph form. This
section should be your professional thoughts based upon the
results of the hypothesis testing. You are the researcher, and
Sun Coast's leadership team is relying on you to make evidence-
based recommendations. Delete these statements before you
begin.
References
Include references here using hanging indentations, and delete
these statements and example reference.
Creswell, J. W., & Creswell, J. D. (2018). Research design:
Qualitative, quantitative, and mixed methods approaches (5th
ed.). Thousand Oaks, CA: Sage.

MIS 4850 Systems SecurityWeek3 Risk Analysis ExercisesSubmis.docx

Recommended

Recommended

More Related Content

Similar to MIS 4850 Systems SecurityWeek3 Risk Analysis ExercisesSubmis.docx

Similar to MIS 4850 Systems SecurityWeek3 Risk Analysis ExercisesSubmis.docx (20)

More from ssuserf9c51d

More from ssuserf9c51d (20)

Recently uploaded

Recently uploaded (20)

MIS 4850 Systems SecurityWeek3 Risk Analysis ExercisesSubmis.docx