Information System Security Risk Analysis Using the Annual Loss Expectancy (ALE) Method (Case Study: Website of the Information Systems Department, UPN “Veteran” Jawa Timur) - Indi Ariyanti Sardi; Rania Nurbaity Winarno; Riska Febriana Rahmawati; Agung Brastama Putra; Rizka Hadiwiyanti; Amalia Anjani Arifiyanti, (Journal of Artificial Intelligence and Engineering Applications (JAIEA), 2026)
The development of information technology in higher education institutions poses significant security risks to digital assets, including the Department of Information Systems website at UPN “Veteran” Jawa Timur. This study aims to identify, analyze, and evaluate information security risks using the quantitative Annual Loss Expectancy (ALE) method. This method measures risk based on the parameters of Asset Value (AV), Exposure Factor (EF), and Annualized Rate of Occurrence (ARO). The analysis was conducted on four main risk categories: service disruption, device damage, data loss, and system security threats. The results of the study show that information system security threats have the highest potential loss of IDR 81,750,000 per year. After simulating mitigation measures, the annual loss value (ALE Projected) decreased dramatically in all categories. The investment feasibility evaluation using Return on Investment (ROI) resulted in a ratio above 2:1 for all categories, with the highest value of 3.10 in handling security threats. This shows that the proposed security investment is very feasible to implement in order to ensure the continuity of academic services and protect the department's information assets.