Harborline Logistics: MFA, Backups, or MDR?
Harborline Logistics has completed a FAIR analysis of a ransomware scenario on its warehouse-management platform. Threat event frequency is estimated at 6 campaigns per year and vulnerability at 0.30. Median loss per event is $4.2M, of which $3.0M is extortion and business interruption and $1.2M is response and replacement. The 90th-percentile annualised loss exposure is $8.1M against a board tolerance of $2.0M. Three treatments are on the table: (A) FIDO2 MFA for all administrative access, $400k per year, expected to cut vulnerability from 0.30 to 0.08 but with no effect on backup encryption; (B) immutable offline backups plus a tested recovery runbook, $250k per year, expected to cut the extortion and business-interruption component from $3.0M to $0.8M; (C) managed detection and response, $600k per year, expected to halve campaign volume to 3 per year. The CIO wants the option with the largest reduction in risk score and the shortest payback, and the vendor for C has supplied a customer case study showing a 90% reduction.
1. Compute expected annualised loss exposure for the baseline and for each option under the stated assumptions, rank them, and explain why the ranking depends on the metric chosen.
Read the worked answer
Baseline: LEF = 6 x 0.30 = 1.8 events per year. Expected loss per event = $4.2M. Expected annualised loss exposure = 1.8 x 4.2 = $7.56M.
- A, MFA: LEF = 6 x 0.08 = 0.48. Exposure = 0.48 x 4.2 = $2.02M. Reduction = $5.54M. Per dollar of annual cost: 13.9.
- B, backups: LEF stays 1.8. Loss per event = 1.2 + 0.8 = $2.0M. Exposure = 1.8 x 2.0 = $3.60M. Reduction = $3.96M. Per dollar: 15.8.
- C, MDR: LEF = 3 x 0.30 = 0.9. Exposure = 0.9 x 4.2 = $3.78M. Reduction = $3.78M. Per dollar: 6.3.
Ranked by absolute reduction: A, then B, then C. Ranked by reduction per dollar of annual cost: B, then A, then C.
The order flips between the two metrics. That is exactly why 'largest reduction in risk score' is the wrong decision rule: it silently selects absolute reduction, ignores cost, and ignores where the residual sits relative to tolerance. It also ignores that these treatments act on different factors, so their effects are not interchangeable.
2. The board's tolerance is set at the 90th percentile, not the mean. Explain why the expected-value ranking is insufficient and what else must be modelled.
Read the worked answer
At LEF 1.8, the probability of at least one event in the year is about 83%. The 90th percentile of annual loss is therefore driven by a single event in the upper part of the per-event loss distribution, not by the average event. The mean understates the exposure the board has actually capped.
A reduces LEF to 0.48, so the probability of no event rises to roughly 62%. That pulls the 90th percentile down much further than the mean reduction suggests, because most simulated years now contain no event at all. B truncates part of the per-event tail but leaves a 1.8-per-year chance of hitting the rest of the distribution, including a long recovery if restoration fails under attack. B may therefore move the mean more than the 90th percentile, or the reverse, depending on the shape of the tail. You cannot tell from these two numbers.
What must be modelled:
- The per-event loss distribution, not just its median. Extortion plus business interruption plus response is likely fat-tailed.
- The event count distribution, since zero-event years dominate once LEF falls.
- Control failure, such as MFA fatigue, help-desk resets, or a restore that fails during an active intrusion.
- Correlation, such as an actor who encrypts the backups as well as production, which would collapse B's assumed benefit.
- Parameter uncertainty, since a LEF of 0.48 could plausibly be 0.2 or 1.0.
Then compare the 90th percentile of each option with the $2.0M tolerance.
3. Advise on the vendor's 90% reduction claim, on whether A and B should be compared or combined, and on what to recommend.
Read the worked answer
The vendor claim. Ask what was measured: detected intrusions, dwell time, campaign volume, or something else? A vendor-supplied customer story is a selected, unverified sample, not a random one. MDR usually reduces dwell time, and therefore loss magnitude, rather than the number of campaigns launched against the firm. Modelling C as halving TEF likely attributes the effect to the wrong factor and flatters the option. Request the reference customer's baseline, the measurement window, and the definition used.
Compare or combine. A and B act on different factors: A on vulnerability, B on loss magnitude. They are complementary, but their individual reductions cannot be added. Both are computed against the same $7.56M baseline, so adding $5.54M and $3.96M gives $9.50M, more than the entire baseline. Combined, expected exposure is 0.48 x 2.0 = $0.96M, not $7.56M minus both reductions.
Recommendation. Implement B first: best reduction per dollar, and it removes the part of the tail the firm cannot otherwise control. Run A in parallel or immediately after, because it closes the most common initial access path and drives the frequency down. Hold C pending evidence, given the weakest cost-effectiveness and an unverified claim. Present residual risk as a simulated distribution with the 90th percentile against the $2.0M tolerance, name the owner of the residual, and state what would change the recommendation.