EBIOS Risk Manager
A French cyber risk analysis method, published by the national agency in 2018, that starts from plausible attack scenarios and threat sources rather than vulnerabilities alone, and speaks management's language.
EBIOS Risk Manager is the digital risk assessment and treatment method published in 2018 by the French national cybersecurity agency, with the support of a club of practitioners. It is organized in five workshops: scope and security baseline, identification of risk sources and their objectives, strategic scenarios describing how a source would reach its objectives through the organization's ecosystem, operational scenarios detailing technical attack methods, then risk treatment. Its distinctive feature is to start from the attacker, its motivations and means, and the business value of what is threatened, rather than from an inventory of vulnerabilities. It explicitly includes the ecosystem, suppliers, partners, customers, which is often the real attack path. For insurance, this logic matches the underwriter's: reasoning in scenarios, threat sources and financial impact. An organization that has carried out such an analysis has a risk map directly usable to size its cover, engage with its insurer and justify its measures, and the state scenarios it identifies shed light on the real scope of its war exclusion.
Textbook case: a defense component manufacturer carries out the analysis and identifies two risk sources: a criminal group seeking ransom and a foreign intelligence service seeking its designs. The second scenario runs through a poorly protected engineering subcontractor. The company imposes requirements on that subcontractor and notes that the state attack would be excluded from its policy: it draws the consequences for its retention.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.