Engie: EBIOS RM Risk Analysis on Azure
A risk analysis of the group's Cloud platform, then a security approach built into application projects.
Two successive engagements for the ENGIE group IT department: the EBIOS RM risk analysis of the Azure Cloud platform in 2022, then the industrialisation of an EBIOS-type approach across application projects in 2023.
Project Context
The ENGIE group IT department wanted to analyse the risks weighing on Microsoft's Azure Cloud platform: to make sure it met the needs and stakes of the business, and complied with the group security policy.
Beyond this first analysis, the challenge was to industrialise the approach: to build an EBIOS-type approach into application projects from their inception, alongside the architects and the business CISOs.
Strategic Objectives
Business needs
Make sure the Azure Cloud platform meets the needs and stakes of the group's businesses.
Group security policy
Check that the platform complies with the ENGIE group security policy.
Industrialised risk analysis
Turn Cloud risk analysis into a repeatable approach, built into application projects.
Solutions Delivered by Adservio
Adservio worked in two stages: in 2022 with a delivery manager, a senior ISO 27005 / EBIOS RM consultant and a Cloud security consultant; in 2023 with a delivery manager, a senior consultant and two ISO 27005 / EBIOS RM consultants.
Questionnaires and interviews
Risk questionnaires and interviews with the business, the CISOs and the suppliers, to capture security needs and stakes.
Cloud EBIOS RM analysis
EBIOS RM risk analysis of the Azure platform following ISO 27005, a risk level matrix and a proposed action plan.
Designing the approach
Design of an EBIOS-type approach for application projects, with contributions to the working group bringing security into the group's project processes and to the design of the tooling.
Pilot run
The approach run as a pilot, with security needs defined from the inception phase of projects.
DICT criteria
Project security needs characterised against DICT criteria (availability, integrity, confidentiality, traceability), taking business impacts into account.
Measures and residual risks
Technical risk analysis, security measures built into application architectures and residual risks formalised.
A one-off risk analysis,
turned into a group approach.
Starting from the EBIOS RM analysis of the Azure Cloud platform, the engagement led to a security approach built into application projects from their inception, carried by the architects and the business CISOs.
Results
In two years, a one-off risk analysis became a security approach shared across the group. The risks of the Azure Cloud platform are identified, ranked in a matrix and paired with an action plan to reduce them. Areas of non-compliance are mapped at group level and for each department. And security now enters application projects from their inception, with needs expressed against DICT criteria and measures built into the architectures.
More Client Work
SIAG modernisation via SAP Fiori
TIV Test & Reporting: rail maintenance
GOC 2.0 project: critical architecture audit
INES programme: AI-augmented depositary control
Augmented CIO: GenAI in the data software factory
Augmented CIO: GenAI at the heart of the SDLC
Augmented CIO: a sovereign AI foundation across the SDLC
Interbank flows & SAP S/4HANA modernisation
360° Performance & Observability
Dentaline: deep learning on panoramic X-rays
AI FastPass & Mobile Order
EBIOS RM risk analysis & GDPR
Application Performance Centre
DevOps automation for life insurance
Building an educational nonprofit information system
Cinké Évolution : data visualisation steering
DevOps & DataOps: Azure cloud migration
Redesign & digital maintenance: web performance
Fabrik Digitale: cloud-native on Azure
Digital transformation: Soon & Connect
SpeedBooking: a platform shipped for 600+ hotels
A time-management rules engine rebuilt with no regression
A Workday migration mapping accelerated by AI
Real-time fraud detection and faster KYC
Secure your Cloud projects from the design stage
EBIOS RM risk analysis, ISO 27005, security built into projects: let's discuss your Cloud cybersecurity challenges. An Adservio expert gets back to you within 24h.