Operational scenarios and attack paths (Workshop 4)¶
From the strategic scenario to the attack path¶
The strategic scenario told Scaldimet that an attacker could reach the line through the contractor. It did not say how: which systems, which steps, which weaknesses, in what order. That is the job of the operational scenario, EBIOS RM's most technical workshop. It takes a strategic scenario and details the concrete attack path across supporting assets, the actual sequence of moves an attacker would make, and then rates how feasible that sequence is. For Scaldimet, this is where the OT-specific weaknesses become most consequential, so it is the focus of this Lesson.
What an operational scenario is¶
An operational scenario is the technical attack path: a chain of actions against supporting assets that realises the strategic scenario. A useful way to structure it, and the way EBIOS RM suggests, is along the phases of a cyber kill chain: the broad stages an intrusion passes through, such as gaining initial access, establishing a foothold, moving laterally, escalating privilege, and acting on the objective. For each phase you name the supporting asset involved and the technique used (this is where the MITRE ATT&CK vocabulary from Chapter 4.3 supplies realistic moves, including ATT&CK for ICS for the OT stages).
Scaldimet's lead scenario, made operational:
- Initial access: the attacker compromises the maintenance contractor's credentials or laptop (the contractor's access path is the supporting asset).
- Entry: they use the contractor's legitimate, unmonitored remote access to reach Beta's network.
- Lateral movement: because Beta's network is flat and unsegmented, they move from the entry point directly toward the OT.
- Reach the OT: they access the SCADA and PLCs, which run unsupported software with weak authentication.
- Act on objective: they alter or halt the process, stopping the line.
Read that chain against Scaldimet's known weaknesses and every step lands on a real gap: the unmonitored access, the flat network, the unsupported OT. The operational scenario is based on Scaldimet's identified weaknesses and orders them as an attacker could exploit them.
Rating by likelihood¶
Where strategic scenarios are rated by severity, operational scenarios are rated by likelihood: how feasible is it for the attacker to carry out this mode of operation, from start to finish, within the scope of the study? You can rate the path as a whole, or build it up from the difficulty of each step. A path of easy steps through weak controls scores high; a path that requires defeating strong controls at every stage scores low.
One precise point, easy to get wrong: in this workshop, likelihood means the feasibility of execution, not the chance that this particular attacker would choose Scaldimet. Whether an adversary is motivated to target you is a separate matter (weighed when selecting risk sources and mapping the ecosystem). Here you ask only: if they tried this path, how likely is it to work? Conflating "would they bother" with "would it succeed" muddies the rating and is a frequent error.
Technical explainer (read & discuss, don't build): why the OT path scores high
Beta's operational technology makes the line-halt path unusually feasible. The SCADA and PLCs run software that is years out of support, so known vulnerabilities go unpatched (patching risks stopping the line, so it is deferred indefinitely). The network is flat, with no zones-and-conduits separation (Lesson 3.2.B), so once inside, lateral movement to the OT meets no internal barrier. Authentication on the controllers is weak or shared, a common OT trait where systems were built for a trusted, isolated plant floor that no longer exists. And the contractor's remote access was added for convenience without monitoring. None of these weaknesses is unusual in legacy OT environments; together, they make the operational path highly feasible. This is why OT-specific controls (segmentation, monitored access, compensating controls around unpatchable systems) are Scaldimet's highest-value treatment, which Chapter 4.6 will act on.
Application: make a scenario operational¶
On paper, take your lead strategic scenario and write its operational attack path as a numbered chain along kill-chain phases, naming the supporting asset at each step and noting where a known Scaldimet weakness makes the step easy. Then rate the path's likelihood (high, medium, low) and write one sentence justifying the rating by reference to the controls the attacker would, or would not, have to defeat. If your chain reads like a tour of Scaldimet's real gaps, you have done it correctly.
Model answer (open after you've drafted yours)
Operational path for Scenario 2 (line unavailable, via the contractor), along kill-chain phases:
-
Initial access — phish or buy the maintenance contractor's remote-access credentials. Asset: the contractor's access path. Weakness: unmonitored, not individually authenticated.
-
Foothold — connect into Beta over that access. Asset: the site network. Weakness: flat network, no zones-and-conduits (3.2.B).
-
Lateral movement — cross from IT-adjacent systems onto the OT segment. Asset: the Beta OT network. Weakness: no internal segmentation to stop it.
-
Action on objective — reach and disrupt the SCADA/PLCs, halting the line. Asset: the controllers. Weakness: out-of-support software, weak or shared authentication.
Likelihood: High. At almost no step does the attacker meet a control they must defeat: access is unmonitored, the network unsegmented, the controllers unpatched; the weaknesses compound. That is why segmentation, monitored access and compensating controls around the OT are the highest-value treatment (4.6): each inserts a control the attacker would then have to defeat, breaking the chain.
Key takeaway
An operational scenario details how, technically, an attacker realises a strategic scenario: a chain of actions across supporting assets, structured along kill-chain phases, drawing on ATT&CK techniques. It is rated by likelihood, meaning the feasibility of executing the path start to finish, which is distinct from whether the attacker would choose to target you. Scaldimet's line-halt path scores high because each step lands on a real OT weakness: unmonitored contractor access, a flat network, unsupported and weakly authenticated controllers. The operational scenario is the organisation's own gaps sequenced as an attacker would walk them, which is why it points so directly at the treatment to come.