EBIOS Risk Manager assessment
A full assessment on a target information system, from security baseline to operational scenarios and their treatment.
The method
EBIOS Risk Manager runs as five workshops, from scoping to the treatment plan. Its value is not the formalism but the fact that it forces you to name an attacker, their objective and their path — instead of listing vulnerabilities out of context.
What I did
- Scoping and security baseline: perimeter, business values, supporting assets, gaps against the regulatory baseline.
- Risk sources: source / target-objective pairs, selected and justified.
- Strategic scenarios: attack paths running through the ecosystem and its stakeholders.
- Operational scenarios: technical breakdown of the retained paths, down to modes of operation.
- Risk treatment: controls, prioritisation, accepted residual risk.
Outcome
[TODO: metric] number of operational scenarios retained and controls arbitrated.
What I took from it
The step from the strategic workshop to the operational one is where most assessments hollow out: the link between the real threat and the technical control gets lost. Holding that link is what makes the treatment plan fundable.