EBIOS and Mehari
The five workshops of EBIOS Risk Manager and what each produces, the method's vocabulary (business value, supporting asset, risk source, targeted objective, feared event), then Mehari and what sets it apart.
- 22 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
- Understand
A few cards from the deck
Feared event: what is it?
Show the answer
A harm to a business value that the organisation fears, rated by its severity, regardless of how it would come about.
It is worded from the business's point of view, without mentioning an attack: 'leak of study results', 'production stopped'. Workshop 1 rates it.
An EBIOS Risk Manager study has just listed the pairs of risk source and targeted objective. Which workshop does this belong to, and which follows?
- Workshop 2; it is followed by the strategic scenarios
- Workshop 1; it is followed by the risk sources
- Workshop 3; it is followed by risk treatment
- Workshop 4; it is followed by the strategic scenarios
Show the answer
Workshop 2; it is followed by the strategic scenarios
The order is fixed: framing and baseline, risk sources, strategic scenarios, operational scenarios, treatment. You cannot write an attack path before saying who attacks, and why.
EBIOS Risk Manager, a method published by …, runs in … workshops.
Show the answer
EBIOS Risk Manager, a method published by ANSSI, runs in five workshops.
ANSSI is the French national cybersecurity agency. The five workshops run from framing to risk treatment, through risk sources and the two levels of scenarios.
Risk source: what is it?
Show the answer
A person, group or entity, internal or external, that may be at the origin of a risk by pursuing a specific aim.
It is described by its profile (competitor, hacktivist, former employee) and paired with a targeted objective: that is the pair produced in workshop 2.
A team wants to write detailed attack paths going through a maintenance provider. It has not yet identified any business values or risk sources. What should it be told?
- Start with workshop 5, to set the measures before writing the paths
- Write the operational scenarios first, being more concrete, then derive the business values
- Replace the study with a Mehari audit, which does not require business values
- Go back to workshops 1 and 2: with no value or attacker, the paths are empty
Show the answer
Go back to workshops 1 and 2: with no value or attacker, the paths are empty
Workshops 3 and 4 build on the outputs of 1 and 2: attack paths aim at an objective for a given source against a business value. Without these inputs, attacks are described with nothing at stake.