EBIOS RM Workshop 3 — Strategic scenarios and ecosystem

1Cadre de l'atelier

Objective	Identify critical ecosystem stakeholders and build high-level risk scenarios.
Inputs	Missions and business values, feared events and their severity (Workshop 1); selected risk sources and targeted objectives (Workshop 2).
Participants	Business teams, functional architects, legal specialists, CISO, and cybersecurity specialist.
Sorties	Ecosystem threat map, strategic scenarios, and security measures selected for the ecosystem.

2The ecosystem

The fourth EBIOS RM fundamental is theecosystem comprising all stakeholders that interact with the subject of the study—suppliers, service providers, and partners. It is an increasingly exploited indirect attack vector: between January 2020 and July 2021, ENISA documented 24 supply-chain attacks, including SolarWinds Orion and Mimecast, with the potential for rapid propagation across an entire sector.

Which ecosystem stakeholders could expose the system through low cyber reliability combined with the organisation's strong dependence on them?

3Assess stakeholder criticality

Each stakeholder is assessed across several dimensions, typically rated from 1 to 4:

Dependence

How dependent is the organisation on this stakeholder for its operations?

Penetration

What level of access does this stakeholder have to the information system?

Cyber maturity

What is its cybersecurity maturity? The lower it is, the easier the stakeholder becomes as an entry point.

A stakeholder that is both highly relied upon and peu mature in cybersecurity terms is the most concerning indirect attack vector.

4Build strategic scenarios

A strategic scenario connects a selected RS/TO pair to a business value, either directly, soit through one or more stakeholders in the ecosystem (an attack path). One strategic scenario may include several alternative attack paths.

5Running example — biotechnology company

Fictional training case: a biotechnology company manufacturing vaccines, with cyber maturity assessed as low.

Risk source	Concurrent
Targeted objective	Steal R&D information
Hazardous event	Disclosure of the company's research and study information
Severity	3 — Important
Strategic scenario	Comprising three possible attack paths, including one through a poorly secured laboratory-equipment supplier

Once strategic scenarios have been established, Activity 3.3 defines security measures for the ecosystem itself—for example increasing the cyber maturity required of a provider—even before moving to the technical level in Workshop 4.