Chapter 23 — Threat and failure analysis for response systems
Lesson map
Lesson 23 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes and connection"]
N1["23.1 The response system is a target"]
N2["23.2 Fault trees"]
N3["23.3 Common cause"]
N4["23.5 Comparing mitigations"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["23.1 The response system is a target"]
N2["23.2 Fault trees"]
N3["23.3 Common cause"]
N4["23.5 Comparing mitigations"]
N5["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]
[Learning outcomes and connection]
|
v
[23.1 The response system is a target]
|
v
[23.2 Fault trees]
|
v
[23.3 Common cause]
|
v
[23.5 Comparing mitigations]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes and connection
After this chapter you can (1) threat-model a response platform as an attack target; (2) build fault trees combining adversarial and accidental events; (3) compute top-event probabilities and minimal cut sets; and (4) compare mitigations against service constraints. It builds on Chapters 15 and 18 and prepares Chapters 26, 32, 33 and 45.
23.1 The response system is a target
Attackers who expect to be investigated attack the investigation: disabling agents, deleting logs, compromising the case platform to learn what defenders know, abusing containment interfaces to cause disruption, or flooding queues to hide activity. Misuse cases describe these: "attacker with a stolen analyst session reads case notes to learn which indicators are known". The MITRE ATT&CK tactic Defense Evasion catalogues observed techniques such as impairing defences and indicator removal; use it as a checklist, not a complete model.
23.2 Fault trees
A fault tree decomposes an undesired top event into combinations of basic events using AND and OR gates. A minimal cut set is a smallest set of basic events that together cause the top event; single-element cut sets are single points of failure. With independent basic events, the probability of the top event can be computed exactly by enumeration for small trees, or approximated by summing cut-set probabilities when they are small. Adversarial events do not have stable probabilities; use them comparatively ("if the credential is compromised, what follows?") rather than as precise forecasts.
23.3 Common cause
Redundancy helps only if components fail independently. A shared credential, shared administrator, shared cloud account or shared software version is a common cause that defeats redundancy.
Design S in Lab 23 is exactly this case of redundancy defeated by a shared element. The evidence store has a backup and the notification service has a pager behind it, so each side looks redundant. Yet one administrator credential reaches both, and its compromise alone produces silent evidence loss. Common causes are found by listing what the redundant parts share: credentials, administrators, accounts, software versions, power and network paths.
23.4 Worked example (synthetic): silent evidence loss at HVSS
Top event: silent evidence loss — evidence for an active case is lost and nobody is alerted. In design S the notification service and the evidence store share one administrator credential; in design D they have separate credentials held by different roles.
"""Lab 23 (synthetic): fault tree for 'silent evidence loss' (evidence lost AND nobody alerted).
Design S: notification service and evidence store share one admin credential.
Design D: each has its own credential, held by different roles."""
from itertools import product
P = {"store_hw": 0.01, "backup_hw": 0.01, "notify_down": 0.02, "pager_down": 0.03,
"cred_shared": 0.005, "cred_store": 0.005, "cred_notify": 0.005}
def tree(design):
def top(e):
if design == "S": cs = cn = e["cred_shared"]
else: cs, cn = e["cred_store"], e["cred_notify"]
lost = (e["store_hw"] and e["backup_hw"]) or cs
silent = (e["notify_down"] and e["pager_down"]) or cn
return lost and silent
keys = ["store_hw", "backup_hw", "notify_down", "pager_down"] + (["cred_shared"] if design == "S" else ["cred_store", "cred_notify"])
return top, keys
def prob(top, keys):
tot = 0.0
for bits in product([0, 1], repeat=len(keys)):
e = dict(zip(keys, bits))
if top(e):
pr = 1.0
for k, b in e.items(): pr *= P[k] if b else 1 - P[k]
tot += pr
return tot
def cuts(top, keys):
out = []
for r in range(1, len(keys) + 1):
for bits in product([0, 1], repeat=len(keys)):
s = {k for k, b in zip(keys, bits) if b}
if len(s) == r and top({k: int(k in s) for k in keys}) and not any(c <= s for c in out): out.append(s)
return out
for d in ("S", "D"):
top, keys = tree(d)
print(f"design {d}: P(silent evidence loss) = {prob(top, keys):.2e}")
for c in cuts(top, keys): print(" minimal cut set:", sorted(c))
Expected output:
design S: P(silent evidence loss) = 5.00e-03
minimal cut set: ['cred_shared']
minimal cut set: ['backup_hw', 'notify_down', 'pager_down', 'store_hw']
design D: P(silent evidence loss) = 2.85e-05
minimal cut set: ['cred_notify', 'cred_store']
minimal cut set: ['cred_store', 'notify_down', 'pager_down']
minimal cut set: ['backup_hw', 'cred_notify', 'store_hw']
minimal cut set: ['backup_hw', 'notify_down', 'pager_down', 'store_hw']
In design S, the shared credential is a single-element cut set: one compromise both destroys evidence and silences the alarm, giving a top-event probability of about $5\times10^{-3}$ under these synthetic inputs. In design D the smallest cut sets need two independent events, and the probability falls by more than two orders of magnitude to about $2.9\times10^{-5}$. The numbers are illustrative; the structural finding — a single point of failure removed — holds for any credible probabilities. Constraint check: separate credentials add an administrator role and key custody work; HVSS accepted that cost because silent evidence loss defeats the purpose of the platform.
23.5 Comparing mitigations
Alternatives to credential separation: an independent integrity monitor that alerts from outside both systems; immutable storage (object lock) so a credential cannot delete evidence within the retention period. A mitigation table compares each against cut sets removed, cost, operational burden and new failure modes introduced (immutable storage complicates legitimate deletion for privacy requests).
In Lab 23 terms, an independent integrity monitor would add a third way to raise the alarm, so even design S's shared credential would no longer silence everyone. Object lock would instead make the lost branch depend on more than a stolen credential during the retention period. Each change removes a different cut set and should be compared on that basis.
23.6 Errors and limits
- Threat models that omit the response system itself.
- Treating adversarial probabilities as precise.
- Redundancy with hidden common causes.
- Mitigations evaluated without their new failure modes.
Lab 23 itself illustrates the second and third errors in this list. Its credential probability of 0.005 is a teaching input, not a forecast of how often an HVSS administrator is phished. The useful result is structural: design S has a single-element cut set, while design D needs two independent compromises. The backup and pager redundancies in design S hid exactly the common cause that the fault tree exposed.
Exercises — chapter 23
EX045 — Add a basic event. Objective: extend the tree. Inputs: Lab 23. Steps: add an event "monitoring agent disabled by attacker" (p = 0.01) that silences notification on its own; recompute both designs; interpret. Expected evidence: code change and output. Rubric: 3 = correct recomputation showing D's advantage shrinks because a new path to silence exists; 2 = numbers only; 1 = attempt; 0 = none.
EX046 — Misuse cases. Objective: threat-model the platform. Inputs: HVSS case platform with analyst, approver and admin roles. Steps: write four misuse cases with attacker capability, harm and a detection or prevention control. Expected evidence: list. Rubric: 3 = covers confidentiality (case reading), integrity (evidence edit), availability (queue flood) and control abuse (malicious containment); 2 = three; 1 = vague; 0 = none.
Chapter synthesis
Analyse the response system as both target and fallible machine. Fault trees with minimal cut sets reveal single points of failure and common causes; compare mitigations by structure removed, cost and new failure modes.
Continue studying — chapter 23 of 50
← Chapter 22 · Course chapter index · Chapter 24 →
Continue to the next authored lesson.