How to use attack trees and attack graphs

Question

I am trying to understand how attack trees\graphs can be used in the security process. I read a lot of papers presenting the topic and how this reppresentation can be useful, but I really don't understand in which ways.

For example in here there is an example that uses the CVE to collect vulnerabilities. But what if my system is up to date and no CVE vulnerabilities are found?

However what I understand from here is that you have to think about all the way an attacker can compromise your network (not to a specific vulnerabilities in the CVE) and then you have to:

• consider if its worth to take countermeasures
• verify if attacks are feasible...which leads to penetration testing.

What do you think about that?

Answer 1

Yup, you've got the idea. Your last paragraph beginning "However what I understand..." captures the idea well. That's about right.

Attack trees are one possible tool that to assist with what is sometimes known as "architectural risk analysis" (Microsoft calls this "threat modelling"; two names, same idea). The idea of architectural risk analysis is to identify potential security risks in a software system, based upon the design and architectural features of the system. This can be helpful to identify security risks, brainstorm defenses and mitigations, or pinpoint areas of the code that should be examined more closely for vulnerabilities. Attacks trees can be helpful to systematize the process of thinking through the space of possible attacks that someone might try against your system.

There is no way to automatically generate attack trees for a complex system. Attack trees do not eliminate the need for domain knowledge about the system and about computer security. You still have to understand the system, understand the kind of attacks you might face, and think through the potential risks.

The biggest limitation of attack trees is that they can be enormous. Building a complete attack tree is very labor-intensive, and it seems unlikely in most situations that this effort is the best possible use of an expert's time. This is probably why attack trees aren't very widely used. Most work on architectural risk analysis and threat modelling tries to provide ways to identify the highest-risk possible attacks. See, e.g., STRIDE and other techniques to try to focus in quickly on the most significant risk factors.

Anyway, I think you've understood the basic gist of it. What precisely is your question?

Answer 2

Attack Trees are useful to figure out whether certain adversarial objectives / goals are viable to defend against. They are particularly useful during Threat Modelling to validate contentious threats. For example you may identify some weakness in a system, but you don't know if it's something you should really care about. Since you have some context regarding the weakness, you can now frame some objectives, which could exploit the weakness. You can draw up an Attack Tree in the context of the system and environment, which could answer questions like; what would it take to achieve this goal, how effective is my existing controls, what's the probability that this objective could be achieved. Once you have a firm grasp of the tree you could annotate it with attributes like skill, tools, etc. You can then apply adversarial profiles to prune your tree. This will show you how effective your controls will be against different adversarial classes.