"EBIOS Risk Manager"

Collaborate efficiently for your EBIOS Risk Manager analyses!

From the EBIOS Risk Manager method to its agile and collaborative application

Agile Risk Manager is designed to support you in the implementation of risk analysis using the EBIOS Risk Manager method. Take advantage of the strength of an adapted tool to focus on the fundamental values highlighted by the method: knowledge, agility and commitment.

Agile Risk Manager brings you the efficiency and ergonomic facilities of an on-premise solution, while allowing a complete and intuitive collaborative work. From change history to role and access management on your shared analyses, everything is done to enable you to work as a team.

The power of a fully customizable tool

Go even further with the strength of a dedicated software that guides you without restricting you. Agile Risk Manager adapts its presentation to your needs, making recommendations while leaving you in control of your choices.

Customize your experience:

• Select data from the integrated knowledge bases
• Use the standard reference systems available (ISO 27001, IEC 62443, PSSIE, NIS, etc.)
• Define your own enterprise repositories to facilitate collaborative work
• Select the workshops and activities to be carried out according to your objectives

Start with an existing asset and enhance your data

Thanks to an Excel data import and a simple open template, you can directly retrieve your existing analyses in Agile Risk Manager. Preserve your data capital and improve it in our tool, or simply start new analyses.

Agile Risk Manager also allows you to exchange data with customers or colleagues by exporting every table to Excel and every graph and matrix as an image. A global report can also be generated at any point in your analysis. The content of this report is customizable and you can export it in different formats, such as HTML, Word and PDF.

How can you try Agile Risk Manager?

Taking our software in hands is simple and easy. Get started directly with our integrated examples and take advantage of a dedicated support with our online demonstrations and a free 7-day evaluation.

For more information or to request your evaluation version, contact us at riskoversee [at] all4tec.net or visit https://www.riskoversee.com.

About ALL4TEC

ALL4TEC, a French software editor with more than 20 years of experience, designs and distributes risk analysis tools in the field of cybersecurity and operational safety through its brand RiskOversee. This brand brings together a range of tools to respond to the twofold “Safe & Secure” issue.

Screenshots

The following document can be used for determining the baseline of the Workshop 1 of EBIOS Risk Manager, when the scope of the study is a processing of personal data:
> Download

It constitutes a declaration of applicability relating to the fundamental principles related to the protection of privacy.

The other Workshops of the study makes it possible to satisfy the obligations of the GDPR in terms of security (cf. art. 32) if you assess the impacts on the data subjects in addition to those on the organization.
You can thus use EBIOS Risk Manager to carry out a PIA (cf. art. 35).

This international standard defines the vocabulary that must be respected by any approach specific to information security.

>See the standard (for free)

This international standard defines the vocabulary and the principles which must be respected by any risk management approach specific to information security.

> See the standard (paying)

Answer from a Club EBIOS member: “Pay attention to scales using several types of impacts”

EBIOS guide reminder: “This action [scale development] consists of creating a scale describing all possible levels of impacts, just like the scales of needs, a scale of impact levels is usually ordinal (the objects are classified in order of magnitude, the numbers indicate ranks and not quantities) and composed of several levels to classify all risks“.Therefore, it is usual to see users of the method build several ordinal scales depending on the nature of the impact (financial, legal, operations, privacy…) to estimate the severity of the feared events. The construction is then done by individually scaling each type of impact, without worrying about the consistency between the levels.

However, only a global result is used in risk maps to assess the severity of each compared to the others. Information on the nature of the impacts is lost.

To avoid misleading conclusions about the importance of risks, care must be taken to check the transverse coherence of the gradation of impacts in the scales. For example, checking that the estimatation of a level 3 impact on operations will be of the same value for the organization as the financial and legal impacts of the same level.
Where possible, the pivotal criterion (for consistency) may be the financial scale. If this is not the case (often the case), the side-by-side impacts should be presented and their importance assessed by those seeking consensus. In this case, the scales can have empty boxes (level having no equivalence for all types of impacts considered). This can be the case when one estimates the loss of human lives for example.

It is sometimes difficult for managers to establish these scales in a generic way. A good solution is then to ask the stakeholders to prioritize the feared events after identifying the impacts, and build the scales based on this estimate.

Answer from another member: “It is useful to have heterogeneous impact scales, it is an important means of communication with the business”

In addition, the ideal is in my opinion:

• to have a scale for each type of impacts (financial, image, legal, operation, privacy…) by covering the entire spectrum of possibilities (from worst to best);
• to present the impacts side by side when analyzing the feared events and consider their severity;
• to recall the different impacts and their estimation when presenting the risks map (which only keeps the most important value).

This makes it easy to carry out a study of both information security and privacy by presenting side-by-side the impacts to the organization and the impacts to the individuals (data subjects).

Answer from a Club EBIOS member: “Two options”

Several proposals are possible to demonstrate that the problems associated with traceability are treated in an EBIOS study without considering traceability as a criterion:

• an elegant but somewhat theoretical solution: we consider the information “traces” (or “proof”, or “log”) as an essential asset, and the traceability becomes the integrity and the availability of this essential asset. This means limiting the study to the traces that induce a feared event and to put the others out of the perimeter of the essential assets, in order to avoid the columns filled with “0”;
• an applied solution: traceability is not a criterion, but a security measure. Being able to trace an action is a measure of both deterrence and recovery, and to consider traceability as such allows us to limit ourselves to the study of (really) feared events: we admit that not being able to trace is not really the feared event, but reduces the associated risk.

Another answer’s response: “Traceability is not a security criterion”

The security criteria are used to assess the impacts in case of reaching each of them, and in particular to study the security needs. In information security, only availability, integrity and confidentiality are considered as security criteria (see in particular ISO/IEC 2700x).They should not be confused with the topics of security measures or regulatory references. Indeed, the (false) need for traceability comes from the fact that we want to know what happened after an incident (detection measure) and/or various obligations (legal, regulatory, sectoral or security policy-related). It is therefore useless and even counterproductive to study the need for traceability.

In addition, a scale of needs and a scale of impacts related to traceability should be available. It is often by trying to build them that one realizes that it is a “desire of someone” that falls under security measures or coverage of a legal “risk”.

Finally, this would involve studying all the threats that lead to the loss of traceability! Actually, this is related to the good implementation of a security measure, which is not necessary to treat as a risk (or otherwise it should be done for encryption, access control, etc.).

However, as the study of the needs is a communication tool with business, it is possible to integrate traceability into the security criteria so that business becomes more involved in the process by seeing its point of view taken into account…

EBIOS, the French reference method, helps organizations to identify and understand their own digital risks. It allows determining security controls that suit to the threat and setting up the monitoring and continuous improvement framework following a risk analysis shared at the highest level.

On the ANSSI website: EBIOS Risk Manager

Listen to the podcast with Fabien CAPARROS (ANSSI) on NoLimitSecu.

> Read the article

> Read the article