Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I would like to know how one could go about creating an attach graph, what use cases they are best suited for, and how to prepare a deliverable with the attach graph with recommendations that I can turn into my boss for further review and analysis.

Any help that you could provide would be greatly appreciated.

share|improve this question
1  
are you referring to Attack Trees? (I guess strictly speaking a tree is a subset of a graph, but semantically they just feel different...) –  AviD Apr 4 '11 at 5:59
    
Besides the wikipedia entry and Bruce Schneier's article, googling also brings a lot of interesting work on the subject. –  adamo Apr 4 '11 at 7:05
    
@AviD - I am not sure what the differences are between an attack graph and an attack tree. Any help or understanding of the differences would be appreciated. –  John Apr 13 '11 at 14:39
    
Well I've never heard it called an attack graph, only an attack tree. And, judging from the answers, I'm guessing that's what you meant. As far as data structure go, a tree is a kind of a graph, so... –  AviD Apr 13 '11 at 16:09
    
Questioner uses "attach graph" twice. I can't edit that to "attack graph" because I'm not sure if it's correct and because it's less than 6 chars. But correct spelling helps search. –  DanBeale Aug 10 '11 at 12:54
add comment

3 Answers

up vote 6 down vote accepted

I suggest the Microsoft Press book titled "Threat Modeling"

share|improve this answer
1  
+1 - It is really a very good book. It shows a lot of what has gone into the change in mindset in Microsoft over the last 6 years or so. –  Rory Alsop Apr 4 '11 at 11:31
    
Off to my Amazon Wish List it goes! Thanks for the recommendation. –  JCCyC Apr 4 '11 at 21:05
1  
I agree - but it's not really much of an answer here... Wanna give some highlights? –  AviD Apr 5 '11 at 9:51
add comment

Besides the Microsoft book stuff, you may find interest in "The Beauty and the Beast: Vulnerabilities in Red Hat's Packages" which uses Formal Concept Analysis.

share|improve this answer
add comment

While it's not dedicated entirely to thread models, Microsoft's book on the SDL does a fairly in depth talk on the different types of models.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.