6

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I would like to know how one could go about creating an attach graph, what use cases they are best suited for, and how to prepare a deliverable with the attach graph with recommendations that I can turn into my boss for further review and analysis.

Any help that you could provide would be greatly appreciated.

Improve this question
5
  • 1
    are you referring to Attack Trees? (I guess strictly speaking a tree is a subset of a graph, but semantically they just feel different...)
    – AviD ♦
    Apr 4, 2011 at 5:59
  • Besides the wikipedia entry and Bruce Schneier's article, googling also brings a lot of interesting work on the subject.
    – adamo
    Apr 4, 2011 at 7:05
  • @AviD - I am not sure what the differences are between an attack graph and an attack tree. Any help or understanding of the differences would be appreciated.
    – John
    Apr 13, 2011 at 14:39
  • Well I've never heard it called an attack graph, only an attack tree. And, judging from the answers, I'm guessing that's what you meant. As far as data structure go, a tree is a kind of a graph, so...
    – AviD ♦
    Apr 13, 2011 at 16:09
  • Questioner uses "attach graph" twice. I can't edit that to "attack graph" because I'm not sure if it's correct and because it's less than 6 chars. But correct spelling helps search.
    – DanBeale
    Aug 10, 2011 at 12:54

3 Answers 3

Reset to default
5

I suggest the Microsoft Press book titled "Threat Modeling"

Improve this answer
1
  • 2
    I agree - but it's not really much of an answer here... Wanna give some highlights?
    – AviD ♦
    Apr 5, 2011 at 9:51
0

While it's not dedicated entirely to thread models, Microsoft's book on the SDL does a fairly in depth talk on the different types of models.

Improve this answer
0

Besides the Microsoft book stuff, you may find interest in "The Beauty and the Beast: Vulnerabilities in Red Hat's Packages" which uses Formal Concept Analysis.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .