Consider the following scenario. You are part of an information security organization at your company. Your company is an online stockbroker, like Etrade. Your companys top management is very concerned about your computer systems online availability and is especially concerned about your vulnerability to a DDOS attack that could take your systems offline for long periods of time. The business analyst side of the company estimates that your company could lose $1M for each hour your systems are offline. A set of countermeasures costing $200,000 per year have been recommended. Youve been asked to estimate the risk leverage of the proposed set of countermeasures given the following additional criteria: The probability of a DDOS attack in any given year: 0.12 (12%) Estimated length of an outage due to a DDOS attack: 8 hours Estimated length of an outage after the countermeasures are applied: 0.75 hours What is the risk leverage in this situation? How would you interpret this risk leverage to someone unfamiliar to risk analysis? If you were the decision maker, what, if any, concerns would you have about this proposal? What questions would you ask?