The EBIOS Risk Manager method
- Risk management fundamentals.
- Spotlight on cybersecurity (priority threats).
- Overview of EBIOS.
- Main definitions of an EBIOS Risk Manager.
Framing and security base
- Identifying the technical and business scope.
- Identifying the feared events and assessing their severity levels.
- Determining the security base.
Hands-on work
Identifying the feared events.
Sources of risk.
- Identifying risk origins (ROs) and their target objectives (TOs)
- Assessing the relevance of these pairs.
- Assessing the RO/TO pairs and selecting the ones deemed a priority for the analysis.
- Assessing the severity of the strategic scenarios.
Hands-on work
Identifying risk origins (ROs) and their target objectives (TOs) Assessing the RO/TO pairs.
Strategic scenarios
- Assessing the threat levels associated with stakeholders.
- Building a digital threat map of the ecosystem and critical stakeholders.
- Writing strategic scenarios.
- Defining security threats to the ecosystem.
Hands-on work
Assessing the threat levels associated with stakeholders. Writing strategic scenarios.
Operational scenarios
- Writing operational scenarios.
- Assessing likelihoods.
- Threat modeling, ATT&CK.
- Common Attack Pattern Enumeration and Classification (CAPEC).
Hands-on work
Writing operational scenarios. Assessing likelihoods.
Handling risk
- Conducting a summary of risk scenarios.
- Defining the treatment strategy.
- Defining security measures in a SCIP.
- Evaluating and documenting residual risks.
- Setting up a risk monitoring framework.
Hands-on work
Defining the security measures in a Security Continuous Improvement Plan (SCIP). Setting up a risk monitoring framework.
2d
- 14h00 
