Below is my quantitative data findings on the threats and vulnerabilities our qualitative research founded in our look into your company. First we will provide some recent attacks that have happened to other companies. Second we will let you know how likely the attack is to occur at your company. Third we will provide you the real number data to support the idea if you should spend money or not on improving your protection from this type of attack.
Spoofing: In 2006 banks were targeted by attackers with a spoofing attack. An article written by McMillan (2006) stated that the attackers were able to hack into the banks' ISP servers and redirect traffic from the legitimate banks' websites to a bogus server. The attackers were able to affect about 20 customers by being able to get them to enter in PINs and other personal information (para. 2). There is an article by Zetter (2012) in which a mathematician noticed that several technology companies and other types of companies used a weak DomainKeys Identified Mail (DKIM) that he was able to break and then use to pretend to be high up personnel in that company. In our report we noted you had in-house servers and the firewalls seem properly configured for outside attacks. In 2014, AOL had its mail service attacked, and the attackers used the email address book to send spam to everyone in the address book as the owner of the email. Spoofing is still a viable attack and even with properly configured network and validation methods human error is still a major contributing factor to spoofing. The major threat here comes from employees surfing the internet such as Facebook and answering personal emails. Under the right conditions, a spoofing attack can be extremely dangerous and the credentials stolen can lead to serious system impact. The major financial loss will come from the public perception of a spoofing attack.
Exposure Factor * Asset value = Single loss expectancy
EF has been determined to be 40% or .4
AV has been determined to be 1 in 5 customers take their revenue with them as they move to another company due to bad publicity in a spoofing attack, revenue from customers is estimated at $1,000,000 so 20% of that will be $200,000.
The SLE is now .4 * $200,000 = $80,000
The Annualized Rate of Occurrence (ARO) is estimated to occur once every one year with current employee use policies. This makes the ARO = 1
The Annualized Loss Expectancy (ALE) = SLE * ARO or 1 * $80,000 = $80,000
The proper response will be to perform training with employees four times a year to make them aware of spoofing attacks. Also to set up a firewall policy to restrict users from accessing websites considered "unsafe" due to a high volume of spoofing attacks. The costs of these implementations and for continued review of these policies is estimated at $35,000/year.
The expectation here is that by spending the $35,000 to increase your security standards to help protect from a spoofing attack you will prevent an $80,000 yearly estimated loss. This is a net saving of $55,000/year.
Further into our report we consider the repudiation attacks to your company. There have not been any known instances of repudiation attacks in the past from your company nor are there any well-known attacks in the recent news. Your company has well-documented log in controls, and you do not use a role-based authorization model. You also do not allow anonymous access to critical data and audit log-ins.
Exposure Factor * Asset value = Single loss expectancy
EF has been determined to be 10% or .1
The asset value has determined to be the cost of investigating possible repudiation attacks or $35,000/year.
The SLE is .1 * $35,000 = $3,500
The Annualized Rate of Occurrence (ARO) is estimated to occur once every ten years with current employee use policies. This makes the ARO = .1
The Annualized Loss Expectancy (ALE) = SLE * ARO or .1 * $3,500 = $350
As you already have proper protections in place, the recommendation is to continue with the current policy in place. The costs to increase security for this type of attack would be to perform daily audits by hiring one additional personnel. The costs for this hire is around $45,000/year costing $44,650/year more for a $350/year savings. Review the policy yearly.
When analyzing the information disclosure portion of our report, we looked back at 2014 when the "HeartBleed" Bug was announced. According to Heartbleed.com (2014) the bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software (para. 2). This bug was considered a big deal as it compromised secret keys, names and passwords of users, and actual content. Your company is not using OpenSSL for encryption and has a good policy regarding encryption is noticed that certain 3rd party software such as Adobe was not being updated by every user promptly. We also noticed directory indexing was possible through a mistakenly configured web server allowing an attacker to access backup files and hidden files. Recently NetGear has a vulnerability located in a service designed to interact with Netgear Genie, a remote application used on several of its wireless routers. Your company does not use NetGear routers, but the lack of immediate patching could one day lead to similar issues.
Exposure Factor * Asset value = Single loss expectancy
EF has been determined to be 30% due to the misconfigured webserver and small volume of clear text emails. The number is at 30% because there is no record of previous abuse of the system.
The asset value has determined to be the cost of data such as intellectual property being exposed or website information leading to a loss of revenue from the customer being unable to purchase services or attackers holding intellectual property for ransom is estimated at $250,000 year.
The SLE is .3 * $250,000 = $75,000
The Annualized Rate of Occurrence (ARO) is estimated to occur once every three years, ARO = .3
The Annualized Loss Expectancy (ALE) = SLE * ARO or .3 * $75,000 = $22,500/year
Updating the patching policy requires education at all levels and re-training. You will need the IT department to monitor needed patches and have communication for patching to all affected users as well as follow-up. The misconfigured webserver needs to be addressed and separate people assigned to review current configurations as well as periodic check-ins to continue to validate correct configuration. The patching follow-ups is sporadic depending on the software being patched but is estimated to costs about 20 hours/year to implement. Current IT hourly costs are $90/hour. This equates to $1800/year. The web server configuration and policy improvement will require an additional 3 hours weekly of IT time. This is 200 additional hours at $90/hour = $18,000/year. The total id $19,800/year. This results in savings of $2,700/year.
Denial of Service attacks is on the rise. They are one of the most common forms of attacks after phishing attacks. There have been several reports over the last few months in 215 of DoS attacks. The website DDoSattacks.net (2015) has listed multiple pages of attacks in 2015. TalkTalk, ProtonMail, a server that suffered 320 straight hours of DoS attacks, the Thai government website, and more have been victims of the DoS style attack this year alone. Some of the information used is provided by a DDOS Impact Survey provided by Icapsula.com (2014).
The Exposure Factor has been determined to be a 1. This type of attack cannot be understated, and the increase of DoS attacks has been growing every year.
The Asset Value is difficult to determine due to the nature of DoS attacks. The possible responses to DoS attacks by this company are good enough to bring potentially the systems back up, but a coordinated attack could cause severe issues. The AV has been determined to be around $40,000/hr with about 50% of attacks lasting 6-24 hours. This means the AV could be from $240,000 to $960,000. We will estimate $500,000.
The SLE is 1* $500,000 = $500,000
The Annualized Rate of Occurrence (ARO) is also difficult to determine however due to the current news we can estimate a concentrated attack could happen multiple times in a year. We are estimating an ARO of 2 as there is a 75% chance of an attack happening twice in a year.
The Annualized Loss Expectancy (ALE) = SLE * ARO or 2 * $500,000 = $1,000,000
Purchasing more Bandwidth than needed or Bandwidth Oversubscription combined with a DNS-based redirect service and automated mitigation should provide better than average security from DoS attacks. The costs of these services vary based on location and volume however the cost will be significantly lower than the loss of revenue from DoS attacks. This is the biggest savings the company can make totaling more potential savings than all other threats combined.
Finally, we come to Elevation of privilege. As the company uses Data Execution Prevention (DEP) for its hardware, applications are run with least privileges possible, the anti-software virus is up to date, and there is encryption of software we do not feel this is a significant threat for a Vertical privilege escalation. There is a possibility of Horizontal privilege escalation due to poor password requirements for users of the website.
Exposure Factor * Asset value = Single loss expectancy
EF has been determined to be 75% due to the password policy allowed to be used by users of the website. Strong password policies are considered an excellent first line defense.
The Asset Value is considered to be similar to a negative public perception because of users' accounts being hacked. While internally secure data may not be exposed to this type of attack user's perception can drive potential future customers away as well as have current customers leave. There will also be additional costs to make customers whole who are affected by their information being stolen and more customer service calls for lost/reset of passwords due to the new password policy you will implement. The AV is estimated to be $325,000.
The SLE is .75 * $325,000 = $243,750.
The Annualized Rate of Occurrence (ARO) is high with customer passwords being exposed, so we estimate a massive breach possibly once every other year at current policies. ARO = .5
The Annualized Loss Expectancy (ALE) = SLE * ARO or .5 * $243,750 = $121,875.
The costs to the company will be to develop a new password policy and then costs associated with the extra hours of time needed to help customers with password resets. We noticed you had an average of about 250 calls a day at seven days a week or 1,750 calls a week and 91,000 calls a year. We estimate an increase of about 25% over a one-year period or an extra 22,750 calls a year. Your calls average about 5 minutes in length which equates to an extra 1895 hours for one year worth of calls. The call center reps are paid $9/hr, so this equates to an extra $17,062.50. The password policy change could save you $121,875 - $17,062.50 = $104,812.50/year. This is a significant saving you can easily achieve by keeping passwords strong and a positive public perception of your company and its security policies.
This ends our report. We look forward to your response.
Thank you.

References:
McMillan, R. (2006). Banks Hit With New Spoofing Attacks. Retrieved November 6, 2015. Zetter, K. (2012, October 24). How a Google Headhunter's E-Mail Unraveled a Massive Net Security Hole. Retrieved November 6, 2015.
The Heartbleed Bug. (2014, April 1). Retrieved November 6, 2015.
DDoS Attacks | Latest News on DDoS Attacks. (2015). Retrieved November 6, 2015.
(2014). Retrieved November 6, 2015, from https://www.incapsula.com/blog/ddhttps://www.incapsula.com/blog/ddos-impact-cost-of-ddos-attack.htmlos-impact-cost-of-ddos-attack.html