Risk sources
Risk sources (RS) are the entities — human or not — likely to cause damage to the system under study. They are used in Workshop 2 of EBIOS RM.
Select the relevant risk sources
Start by browsing the risk source library (📚 Library button) rather than creating everything manually. The system library offers generic profiles classified by type:
- Cybercriminals — financially motivated groups, ransomware
- Nation states / intelligence services — espionage, strategic sabotage
- Hacktivists — ideological groups, denial of service, defacement
- Malicious insiders — employees or service providers with legitimate access
- Accidental insiders — human errors without malicious intent
- Competitors — industrial espionage
- Terrorists — reputational damage or physical sabotage
- Environmental causes — natural disasters, infrastructure failures
Create a risk source
- In Workshop 2, click ＋ Add a risk source
- Fill in the fields below
Fields
| Field | Description |
|---|---|
| Name | Label of the source (e.g.: Organized cybercriminal group, Disgruntled former employee) |
| Type | Deliberate human / Accidental human / Environmental |
| Category | Subtype according to the EBIOS RM taxonomy (cybercriminal, nation state, insider…) |
| Description | Detailed profile: geographic origin, mode of operation, history of similar incidents |
| Motivation | What the source seeks to obtain (financial gain, espionage, sabotage, revenge, ideology) |
| Resources | Available technical and financial means (low / medium / significant / very significant) |
| Expertise | Level of technical skill (novice / intermediate / advanced / expert) |
| Activity | Level of activity observed in the sector (rare / occasional / regular / permanent) |
Targeted objectives
For each retained risk source, associate the targeted objectives among your business values (defined in Workshop 1):
- Click ＋ Add an objective
- Select the targeted business value
- Describe the source's objective (e.g.: Exfiltrate customer data, Block production)
- Rate the likelihood that this source actively seeks this objective (V1 to V4)
This RS → Objective → Business value link is the starting point for the strategic scenarios of Workshop 3.
Rating risk sources
Each retained risk source is rated on two axes:
- Relevance (1 to 4) — how likely this source is to target your organization (industry sector, size, media exposure, past incidents)
- Capability — combination of Resources and Expertise, which determines the reference Security Level (SL) for the operational scenarios
The rating feeds the treatment priority and the selection of Source-Objective pairs to explore further in Workshop 3.
Link with the library
To reuse a source in a future project: detail sheet → Save to library. You can enrich the system library by adding sources specific to your sector.