Safari Books Online is a digital library providing on-demand subscription access to thousands of learning resources.
- Create BookmarkCreate Bookmark
- Create Note or TagCreate Note or Tag
- DownloadDownload
- PrintPrint
Chapter 1. Threat Modeling and Risk Management > An Alternative: Attack Trees
1.3. An Alternative: Attack Trees
Bruce Schneier, author of Applied Cryptography, has proposed a different method for analyzing information security risks: attack trees.[4] An attack tree, quite simply, is a visual representation of possible attacks against a given target. The attack goal (target) is called the root node; the various subgoals necessary to reach the goal are called leaf nodes.
[4] Schneier, Bruce. "Attack Trees: Modeling Security Threats." Dr. Dobbs' Journal: Dec 1999.
To create an attack tree, you must first define the root node. For example, one attack objective might be "Steal ABC Corp.'s Customers' Account Data." Direct means of achieving this could be as follows:
