EBIOS RM core concepts — risk, severity, and likelihood

1Risk, severity, and likelihood

EBIOS RM defines risk as the possibility that a feared event occurs and its effects disrupt the missions of the subject under study. Risk is measured by combining two factors:

Severity

An estimate of the level and intensity of a risk's effects. The more valuable the subject under study, the more severe the consequences may be.

Likelihood

An estimate of the feasibility or probability that a risk occurs. It varies with threat exposure, vulnerability, and security measures already in place.

Risk level

A measure of risk significance, expressed by combining severity and likelihood and represented in a matrix.

Running example from the training material: the car hits a tree. The severity level varie selon la vitesse, la taille de l'arbre, la valeur de la voiture ; la likelihood varies with the number of trees (exposure), driver attention (vulnerability), and road signs (security measures). In the cyber version, the feared event becomes: the embedded system is hacked and the car hits a tree. Severity remains unchanged, but likelihood now depends on the number of attackers and weaknesses in the embedded system.

A generic four-level scale, adaptable to the organisation. Risk increases towards the top-right corner.

Reuse a severity scale already defined by the organisation or in a previous study instead of improvising a new one for every analysis.

2Assets—what must be protected

Knowing what has value in the organisation is essential to knowing what to protect. Assets fall into four broad families:

🗂Actifs d'information
Files, databases, procedures, and archives

💻Actifs applicatifs
Software packages, custom software, operating systems, and tools

🖥Actifs physiques
Servers, laptops, network equipment, and PBXs

👤Actifs humains
Management, technicians, developers, and administrators

3Security needs (CIA)

These security needs apply to organisational assets and are assessed in Workshop 1 when feared events are qualified.

Availability

The property of being accessible and usable on demand by an authorised entity.

Integrity

The property of accuracy and completeness, ensuring that systems and information are modified only through intentional, legitimate action.

Confidentiality

The property that information is neither disseminated nor disclosed to unauthorised people, entities, or processes.

A fourth need is sometimes added, producing CIAT: traceability —the ability to prove that an event or action occurred and identify its author. It is often treated as a security measure supporting the other three needs rather than as a standalone need.

4Threat and vulnerability

Threat

A generic term for any hostile intent to cause harm in cyberspace. A threat may or may not target the subject under study. In EBIOS RM, only cyber intentionnelles lead to scenarios; accidental and environmental risks are covered by the security baseline in Workshop 1.

Vulnerability

A flaw, whether malicious or accidental, in a system's specification, design, implementation, installation, configuration, or use. A vulnerability may be exploited to gain unauthorised access.

A vulnerability alone causes no damage: a threat must exist to exploit it. Conversely, a threat without an associated vulnerability does not constitute a risk.

Vulnerability	Associated threat
Unprotected, unsupervised warehouse	Vol
Complex data-processing procedures	Erreur de saisie par le personnel
No segregation of duties	Fraud or unauthorised system use
Unencrypted data	Vol d'information
No access-rights review	Unauthorised access by someone who has left the organisation
No backup procedure	Perte d'information

5Build effective scales

Severity, likelihood, and risk level all depend on scales. An effective scale has these qualities:

It is unambiguous and explicit for those who will use it.
Every level can realistically be used; there is no decorative level that is never reached.
It preferably uses an even number of levels even —typically four—to avoid a non-committal middle refuge.
It is defined en amont the risk analysis by several stakeholders to avoid bias, not at the moment it is needed.
Where possible, it is shared across the organisation and reused between analyses, also enabling meta-analyses that compare several studies.