Chapter 16 — Security architecture and engineering: methods II
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 An attack tree"]
N2["16.2 Cheapest path"]
N3["16.3 Prioritising defences"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 An attack tree"]
N2["16.2 Cheapest path"]
N3["16.3 Prioritising defences"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 An attack tree]
|
v
[16.2 Cheapest path]
|
v
[16.3 Prioritising defences]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) use an attack tree for the conveyor; (2) find the cheapest attack path; (3) prioritise defences.
16.1 An attack tree
Tomás analyses the goal "stop the conveyor during peak season". Branches include: misuse the vendor's remote support account, infect the conveyor workstation through a USB stick, flood the control network from a compromised office PC, or physically damage the controller. Each branch splits into steps. Building the tree with the maintenance engineer reveals that the USB branch is realistic: engineers copy configuration files using personal sticks. Attack trees bring attacker thinking into a structured, reviewable form. The finished tree fits on one page and is kept with the conveyor documentation.
16.2 Cheapest path
Tomás estimates effort for each leaf as low, medium or high. Physical damage needs site access and is noticed quickly. Flooding needs a path from office to control network, which the zone design from chapter 8 blocks. The vendor account needs stolen credentials, which is medium effort. The USB path is low effort if malware reaches a personal stick. The cheapest path is therefore the USB route, which no previous control addressed. The tree points defensive effort at the attacker's easiest option.
16.3 Prioritising defences
Tomás recommends company-issued, scanned USB sticks for configuration work, disabling USB storage on the conveyor workstation except for an approved device, and a backup of the controller configuration kept offline. For the vendor account he confirms time-limited access is in place. He presents the recommendations in order of the attack paths they close. The maintenance engineer agrees, noting the offline configuration backup would also speed recovery after ordinary hardware faults, giving a business benefit beyond security. Sam schedules the three changes for the next maintenance window before peak season.
Worked example
Tomás builds an attack tree for stopping the conveyor, finds the USB path cheapest and prioritises three defences.
Synthetic case. The tree and estimates are synthetic.
Errors and limits
Effort estimates are judgement. Trees miss branches nobody imagined.
Exercises
- EX046 — Realistic branch. Which branch did the maintenance engineer make realistic? Rubric: 3 = USB sticks used to copy configuration files;; 2 = USB;; 1 = vendor;; 0 = none.
- EX047 — Blocked path. Why is flooding from an office PC unlikely? Rubric: 3 = the zone design blocks office-to-control paths;; 2 = zones;; 1 = vague;; 0 = none.
- EX048 — Extra benefit. What business benefit did the offline configuration backup bring? Rubric: 3 = faster recovery from ordinary hardware faults;; 2 = recovery;; 1 = vague;; 0 = none.
Synthesis
Attack trees reveal the cheapest attacker path so that defences close it first.
Continue studying — chapter 16 of 30
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →