#attack trees

[brokenmusicboxwolfe]

Tonight’s movie was....um....there was no movie. I mean, there WAS but the DVD failed half way through. I got it back in 2009 so I think it is a wee bit late to return it. This is the drawback to having a mountain of unwatched discs.

So....this is weird....

I feel like I should be saying something.

 I had an interesting dream last night. I and some others were out trying to save the world. That bit is a bit like usual in my dreams. World saving? check. Gang of friends? check. What I liked about the dream involved a bit of imagery. The powerful baddie could control even inanimate objects, and we were racing to get away in an open topped vehicle. We needed to get to a certain place with a book of directions written in a code we needed another book to decipher. The key book was Jane Eyre, which is nice and conviently common but also made it dangerous. If something happened to our copy the baddie found out he could destroy every copy for miles around before we could get a replacement.

 And so the baddie sent a giant tree to attack us. That was the cool bit, the tree pulled itself out of the ground with it’s limbs, and then began to run. It ran on it’s roots, moving them in a rippling motion like a centipede’s legs! It was amazing to watch. The baddie was trying to enchant any trees in the area, but it was a place at high altitude, grass and stone but few trees. We passed a row of stumps from a logging that were thrashing in place, unable to claw their way out of the ground without limbs. These were somehow amusing, sad and frightening all at once. The tree caught up and I passed the direction book forward, just out of the oddly talon like reach of the tree. Before I coud get the copy of Jane Eyre safe the tree managed to grab my arm. It dug into the flesh and someone was shouting I shoud just let the book go before I got killed. Since the world depended on the book, to heck of I was going to give it up! 

And that is how I fought with a tree that was  running on a hundred roots over an ordinary copy of Jane Eyre. I won too. Well, it WAS my dream.

And so I woke up, my wrist decidedly not bleeding. Then, as I ate breakfast, a basket Mom had set aside full of old jelly jars fell over. As I was trying to clean it all up I ended up getting cut. Guess where...yep, exactly where that treeclawed me!

Back to movies as usual tomorrow!

[thumbing]

Attack trees: because intelligent adversaries are all the rage

Recently I had an interesting conversation around incident response (IR) and preparedness for incidents. For some reason conversation centred around attack trees and how they can be used to better the information security posture of the company.

My take on it is that attack trees are great for the security mindset that puts prevention first, second, and third and detection and response equal distant fourth. They’re not so good in the world where non-agent failure happens and your response to it defines how much damage the organisation wears in the end.

Engineering has tools like Failure Mode and Effects analysis (FMEA), Fault Tree Analysis (FTA), etc. that take a holistic view and focus on the undesired outcomes, a significantly shorter list than focusing on what an intelligent (not necessarily 100% rational) adversary will do. By focusing on the threat, and an intelligent threat at that, attack trees steer attention and funding away from more common failures that happen as a product of garden variety negligence, ignorance, poor planning or just plain old bad luck.

Even worse, focusing solely on potential attack vectors means that too much time and effort is spent on preventing bad things from happening - which works just as well in information security as it does in the real world: when was the last time a provable major disaster was successfully prevented? Exactly.

Negative:

Only goes to the attack phase;

Does not take into consideration the chance of success (assumes success);

Only as good as the skills and knowledge of the person creating attack trees;

Does not take into consideration non-agent failures;

Takes resources away from more holistic approaches.

Positive:

Methodical approach to list majority of attack vectors (theoretical);

Forces analysis of the attack vectors, improving the knowledge of the defenders;

Improves awareness of the attack vectors.

If you’re subject to the same laws of finite resources and resource optimisation like the rest of us, do yourself and your organisation a favour and spend (40-40-20 ratio usually works well):

just enough on prevention to stop common threats;

two thirds of the rest of the resources on detecting when your prevention controls failed; and

a third of the rest of the resources on responding to those failures.

Keep in mind that response involves the full spectrum from initial reaction through post-event review to dissemination and inculcation of lessons learnt.

[bongrye]

Attack Trees

Attack Trees