EBIOS RM Workshop 2 — Risk sources

1Cadre de l'atelier

Objective	Identify Risk Sources (RS) and their Targeted Objectives (TO) in relation to the subject of the study.
Inputs	Business values and feared events (Workshop 1).
Participants	Business teams, CISO, cyber-threat intelligence specialist, and management for approval.
Sorties	RS/TO pairs selected for the rest of the study; secondary pairs placed under monitoring; pair map.

Risk Source (RS)

An element that, alone or combined with others, can generate a risk—typically an attacker or category of attackers.

Targeted Objective (TO)

The effect sought by a risk source in line with its motivations.

2Risk-source families

If no dedicated intelligence service exists, whether internal or outsourced CTI, work directly from broad families:

🏛State-sponsored

📢Ideological activist

💣Terroriste

🕸Organised crime

🏢Concurrent

👤Malicious employee (insider)

🤝Prestataire malveillant

🎯Amateur / vengeur

At this stage, there is no need to consider risk sources targeting your providers rather than you directly; Workshop 3 addresses this through the ecosystem.

According to ANSSI's annual report, cybercrime is becoming more professional, state actors are harder to identify, espionage remains the leading objective in France, and indirect supply-chain attacks are increasingly common.

3Build RS/TO pairs

After identifying RSs and TOs separately, build meaningful pairs by linking objectives to sources. Relationships are many-to-many: one risk source may target several objectives, and one objective may be targeted by several sources.

A generic targeted objective such as Espionage is insufficient. It must be contextualised : Theft of R&D information in order to… specifies the link to a business value and identifies supporting assets to consider in Workshop 4.

4Running example

Returning to the example of a pupil hacking the school system to improve their grades:

Risk source	Pupil
Targeted objective	Change school results (or, in a variant, take revenge on the school)
Motivation	Strong motivation to secure promotion to the next grade
Ressources	Access to a basic computer

5Assess the relevance of an RS/TO pair

Each selected pair is assessed according to the risk source's motivation de la source, ses resources (technical, financial, and human capabilities) and, when known, its activity previously observed against the organisation or its sector. Together these define relevance, sometimes called IPR. Only the most relevant pairs continue; others can be monitored rather than permanently discarded.

Common mistake: selecting too many RS/TO pairs. An exhaustive but superficial list is less useful than a small number of well-qualified pairs later developed into strategic scenarios.