Lion Cipher Lab

Model threats with quantified attack trees (Schneier) and prioritize countermeasures

• GRC / Compliance
• Advanced
• ~70 min
• Free · no account required

Why it matters

Most threat modeling stops at enumeration: STRIDE walks a diagram and lists the categories of thing that could go wrong per component (spoofing here, tampering there). That is necessary, but it does not tell you what to FIX FIRST, because it does not reason about the attacker as an economic actor who will take the cheapest route to their goal. An attack tree does. Invented by Bruce Schneier in 1999, it puts the attacker's GOAL at the top and asks, recursively, 'what are all the ways to achieve this, and what does each cost?' -- until you reach concrete leaf attacks you can price. Once you…

What you'll learn

• what an attack tree is: attacker GOAL at the root, decomposed through AND/OR nodes down to concrete leaf attacks
• reading AND nodes (every child required) vs OR nodes (any one child suffices) and drawing the tree in indented outline form
• annotating leaf attacks with attributes: cost to the attacker, probability of success, required skill, and detectability
• propagating cost up the tree -- MINIMUM over OR children, SUM over AND children -- to compute the cheapest attack path
• propagating probability -- MAXIMUM over OR children, PRODUCT over AND children -- to find the most-likely path (which is NOT the cheapest)
• deriving and prioritizing countermeasures by 'cut the cheapest path first' and re-propagating to watch the attacker's cost climb
• how the attack tree COMPLEMENTS STRIDE (categories per component) and feeds quantitative risk assessment (NIST SP 800-30)
• the judgment: attack trees vs STRIDE vs kill-chains, using invented numbers for RELATIVE ranking (not false precision), and keeping trees scoped, maintainable, and reusable

Steps in this lab

1. What an attack tree is (every term, from zero)
2. Frame the system and put the attacker's goal at the root
3. Decompose the goal into AND/OR sub-goals down to concrete leaves
4. Annotate each leaf with cost, probability, skill, and detectability
5. Propagate COST up the tree to find the cheapest attack path
6. Propagate PROBABILITY to find the most-likely path (it is NOT the cheapest)
7. Derive and prioritize countermeasures: cut the cheapest path first, then re-propagate
8. The judgment: attack trees vs STRIDE vs kill-chains, and keeping trees honest

Open the full interactive lab →