Chapter 26 — Security architecture and engineering: methods II

Lesson map

Lesson 26 published. Map, example, EX076.

flowchart TD
  N0["Learning outcomes"]
  N1["26.1 Attack trees"]
  N2["26.2 Comparing designs"]
  N3["26.3 Combining methods"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX076"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["26.1 Attack trees"]
  N2["26.2 Comparing designs"]
  N3["26.3 Combining methods"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX076"]

[Learning outcomes]
    |
    v
[26.1 Attack trees]
    |
    v
[26.2 Comparing designs]
    |
    v
[26.3 Combining methods]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX076]

Learning outcomes

You will (1) use attack trees to analyse a goal; (2) compare designs by attacker cost; (3) combine methods for a design decision.

26.1 Attack trees

Lucas analyses the goal "obtain a member's order history" with an attack tree, a method Shostack (2014) describes alongside STRIDE. The root is the goal; branches are ways to reach it: guess or steal the member's password, abuse a staff account, exploit the order page, or obtain a stale export. Each branch splits into steps. Writing the tree forces him to think like an attacker about paths rather than listing controls. He finds the stale export branch, an old spreadsheet emailed to a marketing agency, needs no technical skill at all.

26.2 Comparing designs

Lucas assigns rough effort levels to leaf steps and compares two designs for member accounts: passwords with email reset, and passkeys with email fallback. For each design, the cheapest path to the goal shows the attacker's likely route. With passwords, credential stuffing is cheapest. With passkeys, the email fallback becomes cheapest, so the design's strength depends on protecting the email reset. The comparison shows that adding a strong method does not help much if a weak fallback remains, a lesson that applies far beyond Fernway.

26.3 Combining methods

Lucas combines his STRIDE results, the attack tree and the risk ratings into one recommendation: adopt passkeys, require a second factor for email fallback, and recall the stale export from the agency with a data-sharing agreement for the future. Each method contributed something different: STRIDE gave breadth, the tree gave attacker paths and the risk ratings gave priority. Dr Bellini notes that experienced architects routinely combine methods because each has blind spots that the others partly cover. Lucas records which method found each issue.

Worked example

Lucas builds an attack tree for order-history theft, compares password and passkey designs by cheapest path and combines methods into a recommendation.

Synthetic case. The tree and designs are synthetic; Shostack (2014) is real.

Errors and limits

Effort estimates are rough judgements. Trees can miss branches no one imagined.

Exercises

• EX076 — Low-skill branch. Which branch needed no technical skill?
  Show marking criteria

  Rubric: 3 = the stale export emailed to a marketing agency;; 2 = stale export;; 1 = password;; 0 = none.
• EX077 — Passkey weak point. What became the cheapest path with passkeys?
  Show marking criteria

  Rubric: 3 = the email fallback;; 2 = fallback;; 1 = passkeys;; 0 = none.
• EX078 — Method contributions. What did STRIDE, the tree and ratings each contribute?
  Show marking criteria

  Rubric: 3 = breadth, attacker paths and priority;; 2 = two of three;; 1 = vague;; 0 = none.

Synthesis

Attack trees expose the cheapest attacker path, and combining methods covers each one's blind spots.

Continue studying — chapter 26 of 40

← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →