Attack Tree Analysis: [Attacker goal against system name]

Attack tree analysis following the method popularised by Bruce Schneier ("Attack Trees", Dr. Dobb's Journal, December 1999): one attacker goal as the root, sub-goals refined through AND and OR nodes down to concrete leaf attacks, attributes on each leaf (cost, skill, likelihood), analysis of the cheapest and most likely paths, and countermeasures mapped to the nodes they cut. Replace every [bracketed] value and every row marked Example. The worked example targets the administrator account of a fictional SaaS billing console.

1. Goal and scope

Root goal: Example: Obtain an authenticated session with billing administrator rights in the production billing console.

2. Attacker profile

3. Attack tree

The tree below refines the root goal; [OR] means any child achieves the parent and [AND] means all children are needed.

3.1 Tree as a nested list

• 0 Take over a billing administrator account [OR]
  • 1 Steal credentials and bypass MFA [AND]
    • 1.1 Obtain password [OR]
      • 1.1.1 Phish the administrator with a fake login page (leaf)
      • 1.1.2 Reuse a password from a third-party breach (leaf)
    • 1.2 Defeat MFA [OR]
      • 1.2.1 Adversary-in-the-middle proxy relays the one-time code (leaf)
      • 1.2.2 MFA fatigue: send repeated push prompts until approved (leaf)
  • 2 Abuse account recovery [AND]
    • 2.1 Gather personal details of the administrator from social media (leaf)
    • 2.2 Persuade the support desk to reset MFA (leaf)
  • 3 Hijack an existing session [OR]
    • 3.1 Steal a session cookie with malware on the administrator's laptop (leaf)
    • 3.2 Exploit stored XSS in the console to exfiltrate the session (leaf)
  • 4 Escalate from a low-privilege account [AND]
    • 4.1 Obtain any customer-support account (leaf)
    • 4.2 Exploit a broken authorization check to assign the admin role (leaf)

3.2 Tree as a diagram

The diagram shows the same structure; AND gates are drawn as hexagons and OR gates as rounded boxes.

4. Leaf attributes

Each leaf is rated for cost to the attacker (USD), skill (1 low to 5 expert), likelihood of success per attempt (0 to 1) and detectability (Low, Medium, High) with current controls.

5. Path analysis

Values propagate upwards with these rules:

where $C$ is cost, $P$ likelihood and $S$ required skill.

5.1 Computed node values

5.2 Critical paths

Expected loss for the top path, using the impact in section 1: $0.18 \times 250{,}000 = \text{USD } 45{,}000$ per targeted campaign.

6. Countermeasures

6.1 Re-analysis after countermeasures

Example: After CM-01 to CM-04, session hijack (path 3) becomes the most likely path; CM-03 and CM-05 limit what it can achieve.

7. Conclusions and actions

Example: The cheapest and most likely routes to administrator takeover go around MFA rather than through it: relayable one-time codes and support-desk resets. Phishing-resistant keys and a strict reset process remove both. Session theft then becomes the leading path and is addressed by device binding and step-up authentication for payouts.

8. References

Standard and licence note

Based on the attack tree method described by Bruce Schneier ("Attack Trees", Dr. Dobb's Journal, 1999) and common security engineering practice for AND/OR decomposition and attribute propagation. This template is original text written for this collection and reproduces no text from that article. Template licence: MIT.