Question :

Suppose that an attack would do $200,000 in damage and has a 25% annual probability of success. Spending $15,000 per year on Countermeasure A would reduce the damage of a successful attack by 50%.

a) Do a risk analysis comparing benefits and costs. Show your work clearly. Explain whether or not the company should spend the money.

b) Do another risk analysis if Countermeasure B costs $25,000 per year but would cut the annual probability of a successful attack by 40%.

Again, show your work. Explain whether or not the company should spend the money.