Example from Bruce Schneier's article in Dr. Dobb's Journal December 1999 with values from figures 1 to 5 and the filtering from figure 2.

Constraints

Attacker

Do not try the impossible!

Excluded Attacks:

Defender

installs a safe so that the attacker cannot just grab the assets.

Activated defences that are not applicable to this attack tree: none

Defences and effortless attacks in the attack tree:

(Defences inside an effortless attack are skipped when calculating its parents values.)

Attack Tree

Overview

Open Safe

Details

Open Safe

We model the safe as an optional defence so that we can statically include this attack tree as part of another one where cheaper defences may turn out to be good enough.

Properties: Including directly stated values:
  • security costs per year: $200 for defence: Pay instalment for a safe
Means: Pick Lock, Learn Combo, Cut Open Safe or Install Improperly
Pick Lock
sufficient for end: Open Safe
Properties:
  • Cost of attack: $30,000
  • no special equipment: false
  • possible: true
Learn Combo
sufficient for end: Open Safe
Properties:
  • Cost of attack: $20,000 (by Bribe)
  • no special equipment: true (by Bribe)
  • possible: true (by Bribe)
  • security costs per year: $0 (by Bribe)
Means: Find Written Combo or Get Combo From Target
Find Written Combo
sufficient for end: Learn Combo
Properties:
  • Cost of attack: $75,000
  • no special equipment: true
  • possible: false
Get Combo From Target
sufficient for end: Learn Combo
Properties:
  • Cost of attack: $20,000 (by Bribe)
  • no special equipment: true (by Bribe)
  • possible: true (by Bribe)
  • security costs per year: $0 (by Bribe)
Means: Threaten, Blackmail, Eavesdrop or Bribe
Threaten
sufficient for end: Get Combo From Target

hire thugs to do the threatening

Properties:
  • Cost of attack: $60,000
  • no special equipment: true
  • possible: false
Blackmail
sufficient for end: Get Combo From Target
Properties:
  • Cost of attack: $100,000
  • no special equipment: true
  • possible: false
Eavesdrop
sufficient for end: Get Combo From Target
Properties:
  • Cost of attack: $60,000
  • no special equipment: false
  • possible: false
Means: Listen to Conversation and Get Target to State Combo
Listen to Conversation
necessary for end: Eavesdrop
Properties:
  • Cost of attack: $20,000
  • no special equipment: false
  • possible: true
Get Target to State Combo
necessary for end: Eavesdrop
Properties:
  • Cost of attack: $40,000
  • no special equipment: true
  • possible: false
Bribe
sufficient for end: Get Combo From Target

The added subtree shows how to include a new defence that becomes effective under new constrains for the defender, only. (The original article suggests changing the cost of attack in place from $20000 to $80000.)

Properties: Including directly stated values:
  • Cost of attack: $20,000
  • no special equipment: true
  • possible: true
Means: and Extra effort to bribe well paid target
Extra effort to bribe well paid target
necessary for end: Bribe
Properties:
  • Cost of attack: $60,000
  • security costs per year: $5,000 for defence: Rise in salary
Cut Open Safe
sufficient for end: Open Safe
Properties:
  • Cost of attack: $10,000
  • no special equipment: false
  • possible: true
Install Improperly
sufficient for end: Open Safe
Properties:
  • Cost of attack: $100,000
  • no special equipment: true
  • possible: false
Impressum und Datenschutzhinweis