|
Attack trees are conceptual diagrams showing how an asset, or target, might be attacked. Attack trees have been used in a variety of applications. In the field of information technology, they have been used to describe threats on computer systems and possible attacks to realize those threats. However, their use is not restricted to the analysis of conventional information systems. They are widely used in the fields of defense and aerospace for the analysis of threats against tamper resistant electronics systems (e.g., avionics on military aircraft).〔U.S. Department of Defense, ("Defense Acquisition Guidebook", Section 8.5.3.3 )〕 Attack trees are increasingly being applied to computer control systems (especially relating to the electric power grid ).〔Chee-Wooi Ten, Chen-Ching Liu, Manimaran Govindarasu, Vulnerability Assessment of Cybersecurity for SCADA Systems Using Attack Trees, ()〕 Attack trees have also been used to understand threats to physical systems. Some of the earliest descriptions of attack trees are found in papers and articles by Bruce Schneier, CTO of Counterpane Internet Security. Schneier was clearly involved in the development of attack tree concepts and was instrumental in publicizing them. However, the attributions in some of the early publicly available papers on attack trees〔Chris Salter, O. Sami Saydjari, Bruce Schneier, Jim Wallner, Toward a Secure System Engineering Methodology, http://www.schneier.com/paper-secure-methodology.pdf〕 also suggest the involvement of the National Security Agency in the initial development. Attack trees are very similar, if not identical, to ''threat trees''. Threat trees were discussed in 1994 by Edward Amoroso. ==Basic== Attack trees are multi-leveled diagrams consisting of one root, leaves, and children. From the bottom up, ''child nodes'' are conditions which must be satisfied to make the direct parent ''node'' true; when the ''root'' is satisfied, the attack is complete. Each ''node'' may be satisfied only by its direct ''child nodes''. A ''node'' may be the ''child'' of another node; in such a case, it becomes logical that multiple steps must be taken to carry out an attack. For example, consider classroom computers which are secured to the desks. To steal one, the securing cable must be cut or the lock unlocked. The lock may be unlocked by picking or by obtaining the key. The key may be obtained by threatening a key holder, bribing a keyholder, or taking it from where it is stored (e.g. under a mousemat). Thus a four level attack tree can be drawn, of which one path is (''Bribe Keyholder'',''Obtain Key'',''Unlock Lock'',''Steal Computer''). Note also that an attack described in a ''node'' may require one or more of many attacks described in ''child nodes'' to be satisfied. Our above condition shows only ''OR conditions''; however, an ''AND condition'' can be created, for example, by assuming an electronic alarm which must be disabled if and only if the cable will be cut. Rather than making this task a ''child node'' of cutting the lock, both tasks can simply reach a summing junction. Thus the path ((''Disable Alarm'',''Cut Cable''),''Steal Computer'') is created. Attack trees are related to the established fault tree〔(【引用サイトリンク】title= Fault Tree Handbook with Aerospace Applications )〕 formalism. Fault tree methodology employs boolean expressions to gate conditions when parent nodes are satisfied by leaf nodes. By including a priori probabilities with each node, it is possible to perform calculate probabilities with higher nodes using Bayes Rule. However, in reality accurate probability estimates are either unavailable or too expensive to gather. With respect to computer security with active participants (i.e., attackers), the probability distribution of events are probably not independent nor uniformly distributed, hence, naive Bayesian analysis is unsuitable. Since the Bayesian analytic techniques used in fault tree analysis cannot legitimately be applied to attack trees, analysts instead use other techniques〔Donald L Buckshaw, Gregory S Parnell, Willard L Ulkenholz, Donald L Parks, James M Wallner, O. Sami Saydjari, Mission Oriented Design Analysis of Critical Information Systems, Military Operations Research V10, N2, 2005, ()〕〔Terrance R Ingoldsby, Amenaza Technologies Limited, Attack Tree-based Threat Risk Analysis, A vendor white paper, ()〕 to determine which attacks will be preferred by a particular attacker. These may involve comparing the attacker's capabilities (time, money, skill, equipment) with the resource requirements of the specified attack. Attacks which are near or beyond the attacker's ability to perform are less preferred than attacks that are perceived as cheap and easy. The degree to which an attack satisfies the adversary's objectives also affects the attacker's choices. Attacks that are both within the adversary's capabilities, and which satisfy their goals, are more likely than those that do not. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Attack tree」の詳細全文を読む スポンサード リンク
|