Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
The OWASP Application Threat Modeling, quoting step 2 says specifically:
These threats can be identified further as the roots for threat trees; there is one tree for each threat goal.
what is threat tree and what it has to do with a potential threat goal in threat modeling for web applications?
An attack tree and a threat tree are the same thing. In a traditional application threat model, you start with the component that you're building, (be that the entire application, a component or function, a data flow, etc.) and enumerate the potential threats to that component.
When you're building an attack tree, the development is reversed. You start with the attacker's end goal, and then enumerate the possible ways you could achieve the end goal, and only then look at the application to find locations where it may be vulnerable to the vectors you've identified.
As Adam Shostack mentioned in his answer, attack trees are generally more suited to more advanced practitioners, and usually as a complement to traditional threat models, not a replacement for them.
Ideologically, attack trees are more a red-team style attacker-centric approach to the problem, which can provide useful additional insight.
Focus first on drawing a 'whiteboard style' diagram your web application, its dependencies, and its trust boundaries and then use STRIDE, CAPEC or the OWASP top ten to identify threats.
(Creating new threat trees is a task requiring a good deal of expertise. I'm not aware of threat trees designed to be used by those new to web threat modeling.)
@schoeder: STRIDE and attack trees are defined independently. STRIDE comes from here, http://blogs.microsoft.com/cybertrust/2009/08/27/the-threats-to-our-products/ attack trees were defined by Amaroso.
fix side of things, do you point to being on the defensive side rather the attacking side? For defensive, I have always thought positive security testing rather than focused on negative security testing. The latter reveals holistic approach to risk management in software security.
Sep 4 '15 at 20:17
there is one tree for each threat goal. Also the termthreat treemight be different from anattack treeor are they same? Since an attack is a process and threat might be just an logical assumption that a risk exists which has agents or threat agents giving birth to security risks?