{"id":68,"date":"2024-06-18T06:24:04","date_gmt":"2024-06-18T04:24:04","guid":{"rendered":"https:\/\/stefanescu.lu\/?p=68"},"modified":"2024-06-18T18:41:13","modified_gmt":"2024-06-18T16:41:13","slug":"a-quick-look-at-ebios-risk-manager","status":"publish","type":"post","link":"https:\/\/stefanescu.lu\/?p=68","title":{"rendered":"A Quick Look at EBIOS Risk Manager"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

What is EBIOS RM?<\/h2>\n\n\n\n

EBIOS Risk Manager (EBIOS RM)<\/a> is the method published by the French National Cybersecurity Agency<\/a>(ANSSI – “Agence nationale de la s\u00e9curit\u00e9 des syst\u00e8mes d’information”) for assessing and managing digital risks(EBIOS: “Expression des Besoins et Identification des Objectifs de S\u00e9curit\u00e9<\/a>” can be translated as “Description of Requirements and Identification of Security Objectives”) developed and promoted with the support of Club EBIOS<\/a> (a French non-profit organization that focuses on risk management, drives the evolution of the method and proposes on its website a number of helpful resources for implementing it – some of them in English).<\/p>\n\n\n\n

EBIOS RM defines a set of tools that can be adapted, selected and used depending to the objective of the project, and is compatible with the reference standards in effect, in terms of risk management (ISO 31000:2018) as well as in terms of cybersecurity (ISO\/IEC 27000).<\/p>\n\n\n\n

Why is it important?<\/h2>\n\n\n\n

Why use a formal method for your (cyber)security risk analysis and not just slap the usual cybersecurity technical solutions (LB + WAF + …) on your service? <\/p>\n\n\n\n

On a (semi)philosophical note – because the first step to improvement is to start from a known best practice and then define and evolve your own specific process.<\/p>\n\n\n\n

Beyond the (semi)philosophical reasons are then the very concrete regulations and certifications you may need to implement right now, and the knowledge that in the future the CRA regulation will require cybersecurity risk analysis (and proof of) for all digital products and services offered on EU market.<\/p>\n\n\n\n

OK, so it is important: lets go to the next step:<\/p>\n\n\n\n

How is it used?<\/h2>\n\n\n\n

First a few concepts<\/strong><\/h4>\n\n\n\n

In general the target of any risk management \/cybersecurity framework is to guide the organization’s decisions and actions in order to best defend\/prepare itself.<\/p>\n\n\n\n

While risk\/failure analysis is something we all do natively, any formal practice needs to start by defining the base concepts: risk, severity, likelihood, etc.<\/p>\n\n\n\n

Risk and its sources:<\/strong><\/h4>\n\n\n\n

ISC2 – CISSP<\/a> provides these definitions:<\/p>\n\n\n\n