Strategic scenarios (Workshop 3)¶
Mapping the attacker's path through the ecosystem¶
Scaldimet's CISO keeps returning to the same conclusion: the weakest way into Beta is not through Scaldimet at all, but through the maintenance contractor who already has trusted access. That insight is exactly what a strategic scenario is built to surface. A strategic scenario is a high-level attack path that shows how a risk source reaches a business value by way of the ecosystem, the suppliers, partners and intermediaries that surround the organisation. It is the EBIOS RM workshop where the method clearly goes beyond a checklist, because it forces you to look outside your own walls.
What a strategic scenario is¶
Take a risk-source-and-objective pair from the last chapter, and trace the macro chain it would follow: risk source → (compromises) an ecosystem stakeholder → (reaches) a business value, producing a feared event. The scenario stays high-level: it names the path and the stepping stones, not yet the technical detail of each break-in (that is the next Lesson). Staying at this level makes it possible to see the shape of the threat and expose paths that an internally focused analysis would never notice.
For Scaldimet, a strategic scenario might read: a competitor (risk source, seeking design data) compromises the maintenance contractor (ecosystem stakeholder, trusted but weakly secured) to reach the engineering systems and exfiltrate the OEM design data (business value), causing the data-disclosure feared event. Another: a ransomware crew compromises a remote-access supplier to reach the Beta OT and halt the line. Notice that the dangerous stepping stone in both is a third party, which is why the ecosystem view is central to the workshop.
Mapping the ecosystem¶
To build these scenarios you first map the ecosystem: every stakeholder that interacts with your business values, and how exposed and how dangerous each is as a route in. Scaldimet's ecosystem includes the maintenance contractor, the SCADA and MES vendors, the OEM customer, IT service providers, and the interconnection between the two sites. For each, you ask: how reachable is this stakeholder, how strong is its own security, and how much access does it have to our business values? A stakeholder that is highly trusted, highly connected and weakly secured (the contractor, precisely) is the prime candidate for a strategic scenario.
Rating by severity¶
Each strategic scenario is rated for severity, and it inherits the severity of the feared event it produces (set back in Chapter 4.3). The data-disclosure scenario is as severe as the data-disclosure feared event; the line-halt scenario is as severe as three days of lost production and OEM penalties. Severity, not likelihood, is the measure here: a strategic scenario answers "how bad is this path's outcome", while the question of "how feasible is it technically" is deferred to the operational scenarios. Keeping the two separate prevents a frightening-but-implausible scenario and a trivial-but-easy one from being scored the same.
Scaldimet's lead strategic scenario
The one to carry forward: a deliberate attacker reaches Beta's production OT through the maintenance contractor's trusted, weakly monitored access, to halt the line. It scores high on severity (the line's continuity is a top business value, and a stoppage triggers OEM penalties), and its stepping stone is an ecosystem stakeholder that Scaldimet does not control. A control-list view of Scaldimet's own systems would have missed it, because the weakness is between organisations. This scenario becomes the worked example for the operational detail in the next Lesson.
Application: build two strategic scenarios¶
On paper, take two risk-source-and-objective pairs from Chapter 4.3 and write the strategic scenario for each as a macro chain (source → stakeholder → business value → feared event). Then mark which ecosystem stakeholder each passes through, and assign each the severity of its feared event.
Model answer (open after you've drafted yours)
Scenario 1 — competitor after design data, via the SCADA/MES vendor. Source: competitor (through a hired actor) → stakeholder: the vendor with remote access → business value: design-data confidentiality → feared event: design data disclosed. Severity: Critical.
Scenario 2 — ransomware crew after payment, via the maintenance contractor. Source: ransomware crew → stakeholder: the contractor with trusted, unmonitored access to Beta → business value: production continuity → feared event: French line unavailable for days. Severity: Critical.
Both worst-case scenarios involve third parties, showing why the ecosystem analysis is important.
Key takeaway
A strategic scenario is a high-level attack path showing how a risk source reaches a business value through the ecosystem (suppliers, partners, intermediaries), producing a feared event. You build it by mapping the ecosystem and finding stakeholders that are trusted, connected and weakly secured (for Scaldimet, the maintenance contractor). It is rated by severity, inherited from its feared event, with technical feasibility deferred to the operational scenarios. This is where the EBIOS RM approach adds something that a control-list view can miss: the need to look beyond the organisation's own boundaries.
Next: Lesson 4.4.B · Operational scenarios and attack paths →