Attack Trees on tplat

Creating Attack Trees

Mon, 01 Jan 0001 00:00:00 +0000

Creating Attack Trees

Creating attack trees helps structure your thinking about threats.

Core Steps

Decide on a representation
Create a root node
Create subnodes
Consider completeness
Prune the tree
Check presentation

1. Decide on a Representation

Choose:

OR tree (most common): any child achieves the parent
AND tree: all children required

Also decide:

Graphical vs outline format

2. Create a Root Node

Two common approaches:

Attacker goal (recommended)
System component

Best practice:

Representing Attack Trees

Mon, 01 Jan 0001 00:00:00 +0000

Representing Attack Trees

Attack trees can be represented in different formats depending on the audience and purpose.

Graphical Representation

graph TD
    A[Attack system]

    A -->|AND| B[Gather knowledge]
    A -->|AND| C[Gain access]

    B -->|OR| B1[From insider]
    B -->|OR| B2[From components]

    C -->|OR| C1[Vendor access]
    C -->|OR| C2[Illegal entry]

Outline Format

Attack system (AND)

1.1 Gather knowledge (OR)
- Insider
- Components
1.2 Gain access (OR)
- Vendor
- Illegal entry

Structured Representations

Attack trees can also be treated as data structures.

Example Attack Tree

Mon, 01 Jan 0001 00:00:00 +0000

Example Attack Tree

Goal: Access a Building

This is a simple OR-based attack tree.

graph TD
    A[Access building]

    A --> B[Through a door]
    A --> C[Through a window]
    A --> D[Through a wall]
    A --> E[Other means]

    %% Door branch
    B --> B1[Unlocked]
    B --> B2[Drill lock]
    B --> B3[Pick lock]
    B --> B4[Use key]
    B --> B5[Social engineering]

    B1 --> B11[Get lucky]
    B1 --> B12[Block latch]
    B1 --> B13[Distract staff]

    B4 --> B41[Find key]
    B4 --> B42[Steal key]
    B4 --> B43[Copy key]
    B4 --> B44[Social engineer key]

    B5 --> B51[Follow someone in]
    B5 --> B52[Build relationship]
    B5 --> B53[Carry items to appear legitimate]

    %% Window branch
    C --> C1[Break window]
    C --> C2[Lift window]

    %% Wall branch
    D --> D1[Use tools]
    D --> D2[Use vehicle]

    %% Other means
    E --> E1[Fire escape]
    E --> E2[Roof access]
    E --> E3[Another tenant]

Real-World Attack Trees

Mon, 01 Jan 0001 00:00:00 +0000

Real-World Attack Trees

Several published attack trees provide valuable reference material.

Fraud Attack Tree

Election Threat Trees

SSL Mind Map

Observations

Flexible but less structured
Harder to navigate visually
Inconsistent categorisation

Limitations and Perspective

Mon, 01 Jan 0001 00:00:00 +0000

Limitations and Perspective

Attack trees are useful but not without challenges.

Key Issues

1. Completeness

No guarantee all attack paths are captured
Missing a root node can omit entire threat classes
Hard to know when you’re “done”

2. Scoping

Some attacks fall outside your control
Example: hardware-level attacks vs software systems

You must define:

What is in scope
What is someone else’s responsibility

3. Meaning and Consistency

AND/OR semantics often unclear
Sequence rarely well-defined
Different authors use different conventions

This increases cognitive load when interpreting trees.