EBIOS Risk Manager
EBIOS Risk Manager (EBIOS RM) is ANSSI's method for cyber risk assessment and treatment. The exam tests whether you can run its five workshops in order, keep strategic and operational reasoning distinct, and turn outputs into defensible treatment decisions.
The five workshops
- Workshop 1 - framing and baseline: define scope, business values, supporting assets, feared events, and the security baseline.
- Workshop 2 - risk sources: identify sources, their objectives and motivations, then select the ones retained for study.
- Workshop 3 - strategic scenarios: link a risk source, via stakeholders, to a feared event on a business value.
- Workshop 4 - operational scenarios: decompose each strategic scenario into attack paths across supporting assets.
- Workshop 5 - risk treatment: select security measures, reassess residual risk, and record acceptance.
Core rules
Keep the business value to supporting asset chain explicit. A feared event belongs to a business value, not to a server. Strategic scenarios stay non-technical; operational scenarios carry the technical detail. The baseline from Workshop 1 is reused, not rebuilt, later. Likelihood and impact are assessed consistently, and treatment must map to a specific scenario.
Worked example
A hospital's patient-record system is the business value; the database server is a supporting asset. In Workshop 2 a financially motivated actor is retained. Workshop 3: the actor exploits a supplier's remote access to reach the records - a strategic scenario ending in a feared event (records unavailable). Workshop 4 details the path: stolen supplier credentials, then VPN, then database. Workshop 5 selects MFA for suppliers and logging, then reassesses residual likelihood.
Traps
- Swapping strategic and operational scenarios.
- Starting attack paths before agreeing the scope and baseline.
- Treating a measure as a treatment without re-evaluating residual risk.
- Confusing business values with supporting assets.