Why frameworks, and the EBIOS RM pyramid¶
The question the baseline cannot answer¶
Scaldimet now has a socle: a compliant baseline that handles the risks common to any manufacturer. So why is the CISO still uneasy? A baseline cannot answer a more specific question: who might deliberately target Scaldimet, how they could do it, and what the consequences would be. Answering it needs a method: a repeatable way to reason about targeted risk. This Lesson explains why, and gives you the picture that organises the whole Module.
The pyramid: baseline at the base, bespoke at the apex¶
ANSSI's EBIOS Risk Manager method opens with an image it calls the digital risk management pyramid, and it is the clearest way to see where Module 3 ended and Module 4 begins.
Picture a pyramid. The wide base is the compliance approach: basic cyber hygiene and the regulatory and standards framework. It is wide because it covers a broad spectrum of common, undirected attacks that threaten everyone, and it is efficient because a known baseline of controls knocks most of them out at once. That base is the socle you built in Module 3.
The narrow apex is the scenario approach: the analysis of targeted, deliberate, well-resourced attacks. It is narrow because these targeted attacks require organisation-specific analysis. ANSSI's own description of the method is that it seeks "a synthesis between compliance and scenarios", positioning each where it adds the most value: compliance for the broad base, and scenario analysis for the targeted risks that require deeper analysis.
The key risk lesson here is to adapt the level of analysis to the level of risk. You do not scenario-model every conceivable risk; that would waste the effort the base already spent efficiently. You build the socle for common risks, then reserve deeper scenario analysis for the targeted risks that justify the additional effort. Module 4 is the apex, and it assumes the base is already there.
EBIOS RM Process: the five workshops¶
The pyramid says what a complete risk picture looks like, but it does not say how you build it. That is what EBIOS RM's five workshops do. Each one completes another part of the pyramid.
Diagram adapted from ANSSI's EBIOS Risk Manager method.
- Workshop 1 — context and security baseline builds the base: the socle. You did this in Module 3.
- Workshops 2 to 5 build the apex, and they are this Module: risk origins (W2), strategic and operational scenarios (W3, W4), and risk treatment (W5).
The two pictures are one idea seen twice: the pyramid is the destination, the workshops are the route to it. When a later Lesson names "Workshop 3", it means "the step that fills in the strategic-scenario part of the apex".
This course is modelled on EBIOS RM — it does not teach it
The risk method in this Module is closely modelled on EBIOS RM. But this is a course on risk reasoning, not a manual for running the method. To learn or run EBIOS RM itself, use the authoritative sources: ANSSI, which publishes the method, and the Club EBIOS, which maintains and supports it.
Three methods, positioned¶
You will hear three names. They are not rivals to choose between so much as layers that do different jobs.
| Method | What it is | Best understood as |
|---|---|---|
| ISO/IEC 27005 | The international standard for information-security risk management, supporting ISO 27001 | ISO 27005 describes the elements of a risk-management process |
| EBIOS RM | ANSSI's scenario-based method, aligned to ISO 27005 | The concrete method: a prescriptive, workshop-based way to actually do what ISO 27005 describes, strong on attackers and ecosystem |
| NIST RMF | The US federal Risk Management Framework (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) | The control-and-authorisation lifecycle: system-centric, heavy on control baselines and formal authorisation to operate |
The relationship is straightforward: ISO 27005 provides a broad framework for information-security risk management; EBIOS RM provides one concrete method for carrying out a risk analysis. This course teaches EBIOS RM because its attacker-and-ecosystem focus fits Scaldimet's situation: a targeted manufacturer with a complex supply chain and OT.
NIST RMF is worth recognising as another risk-management framework. It has a strong control-baseline, assessment and authorization orientation, with controls selected and tailored according to risk and with ongoing monitoring and risk decisions built into the lifecycle. It was developed for US federal information systems, but NIST also presents it as applicable more broadly to organisations and system types. For Scaldimet, EBIOS RM is the main risk-analysis method used in this course; ISO 27005 provides the broader risk-management context, while NIST RMF is a useful point of comparison rather than the method used here.
Why EBIOS RM suits Scaldimet
EBIOS RM forces two things particularly relevant to Scaldimet. It makes you name real adversaries (not generic "threats"), which matters when your worry is a competitor or a ransomware crew targeting OEM design data. And it makes you map the ecosystem, the suppliers, the maintenance contractor, the interconnections, which is exactly where Scaldimet's worst exposure lives. A purely internal, control-list view would miss the contractor's trusted path into Beta entirely. These characteristics make EBIOS RM particularly relevant to the weaknesses identified in Scaldimet's environment.
Application: place the work on the pyramid¶
On paper, draw the pyramid and sort six items onto it: (1) enforcing MFA across all staff; (2) a competitor bribing the maintenance contractor to plant malware on Beta's SCADA; (3) routine patching at Alpha; (4) a ransomware crew encrypting the ERP the week before an OEM delivery; (5) basic awareness training; (6) backups and segmentation.
Model answer (open after you've drafted yours)
Base (compliance approach — the socle): (1) MFA, (3) routine patching, (5) awareness training, (6) backups and segmentation. Generic hygiene: every organisation needs them, they counter common risk, and you adopt them as a baseline without scenario analysis.
Apex (scenario approach — this Module): (2) the competitor bribing the contractor to plant malware on Beta's SCADA, and (4) the ransomware crew timed to an OEM delivery. Named, deliberate, Scaldimet-specific attacks with an actor, a motive and a path; only scenario work finds and sizes them.
Most items land at the base, and that is the point: the socle carries the bulk of the risk cheaply, so scarce scenario effort goes to the few apex threats that require deeper analysis. Put a hygiene item at the apex and you waste deep analysis on what a baseline already handles; put a targeted attack at the base and you never analyse the path that could stop the line.
Key takeaway
A compliance baseline handles common risk, but it does not replace organisation-specific scenario analysis. The EBIOS RM pyramid shows the split: the compliance approach is the wide base (the socle, Module 3), the scenario approach the narrow apex (this Module). The pyramid is the goal; EBIOS RM's five workshops are the route to it: Workshop 1 built the base, Workshops 2 to 5 build the apex. This course is modelled on EBIOS RM and names its workshops, but it teaches the risk reasoning, not the method itself; to run EBIOS RM, use ANSSI and the Club EBIOS. ISO 27005 frames the wider risk-management context, while EBIOS RM is the method this Module follows.