High-level (macro) risk assessment¶
When the deep method is the wrong first move¶
The scenario method is powerful and slow. If Scaldimet's new CISO began by building detailed operational attack scenarios for every system across both sites, the first useful output would arrive months later, and most of the effort would land on things that did not warrant it. A detailed scenario assessment should not necessarily be the first step. A macro risk assessment provides a faster, high-level view that can help identify where deeper analysis is justified.
What macro assessment is¶
Macro assessment works at the level of business areas or asset groups, not individual attack paths. You list the handful of things that matter (the major activities, sites, systems or data groups), and for each you make a quick, defensible judgement of how exposed it is and how badly its loss would hurt. The output is a rough ranking, a heat-map of where attention is needed, deliberately traded for speed over precision.
A workable macro pass has four moves:
- List the big blocks. Not every asset; the major ones. For Scaldimet: the ERP and customer design data, the Alpha MES and IIoT, the Beta SCADA and production line, the corporate IT estate, the supplier and contractor connections.
- Rate impact, coarsely. For each block, how bad is the worst plausible loss (to safety, to the OEM relationship, to revenue, to legal standing)? A simple low/medium/high/critical is enough here.
- Rate exposure, coarsely. How reachable and how weakly protected is it, given what you already know? Beta's flat network and unmonitored contractor access score high without any deep analysis.
- Rank and triage. Combine the two into a rough priority order, and mark the top few blocks as candidates for full scenario assessment.
The discipline is to resist false precision. Macro numbers are judgements, not measurements; their purpose is simply to prioritise where deeper analysis should start. Treating a quick macro score as if it were a quantified risk is a mistake the rest of Chapter 4.5 will warn against in detail.
How macro and scenario work fit together¶
The two methods are high-level assessment / detailed scenario assessment. Macro assessment surveys the whole estate quickly and points at the few areas that justify the expense of scenario analysis. Scenario analysis then goes deep on those areas: the named attackers, the strategic and operational paths, the careful evaluation. Done in that order, you spend the costly method only where the cheap method flagged danger, which is the proportion lesson of the pyramid applied to your own time. Macro also has a second use: a yearly macro pass is a fast way to check whether the risk landscape has shifted enough to warrant re-running deeper analysis.
Scaldimet's macro pass, in outline
A first-day macro assessment would, with no deep work, almost certainly surface the same uncomfortable cluster: Beta's SCADA and production line (critical impact, high exposure) and the contractor and supplier connections (high impact, high exposure) at the top, with the well-run Alpha IT estate lower down. The ranking is only a triage result: its purpose is to determine where the deeper analysis should focus. Scaldimet's scarce scenario effort should go to Beta and the supply chain first, which is exactly where Chapters 4.3 to 4.6 take it.
Application: a macro pass for Scaldimet¶
On paper, take the five or six big blocks listed above, give each a coarse impact rating and a coarse exposure rating, and produce a ranked shortlist of the top three for deep scenario assessment. Then write one sentence justifying why a macro pass was the right first step rather than diving straight into scenarios.
Model answer (open after you've drafted yours)
A workable macro pass (coarse High / Medium / Low):
- Beta OT / production — impact High (a stoppage breaches the OEM contract), exposure High (unpatched, flat, unmonitored access). Top of the shortlist.
- Third-party / contractor access — impact High, exposure High (the way in). Shortlisted.
- Customer design data — impact High (contract and reputation), exposure Medium. Shortlisted.
- Alpha IT / ERP — impact Medium–High, exposure Medium (better managed). Below the line for now.
- Corporate / HR data — impact Medium, exposure Low. Below the line. Top three: Beta OT, contractor access, customer data. Why macro first: it spends days to aim months of deep work at the blocks that matter, instead of modelling everything to the same depth or diving in blindly. It is the proportion rule applied before the expensive work, not after.
Key takeaway
A macro risk assessment is a fast, top-down, coarse pass over the major business areas, rating impact and exposure just well enough to rank them and decide where deep scenario work is worth doing. It complements the scenario method as a coarse pass before a fine one, applying the pyramid's proportion lesson to your own time, and a periodic macro pass flags when the landscape has shifted. Its scores are judgements for sorting the queue, not measurements; treating them as precise is the error Chapter 4.5 dissects. For Scaldimet, the macro pass points straight at Beta's OT and the supply chain.