Attack Trees

Threat Modelling & Assessment with Attack Trees: Put security on the table before it’s too late

Who is the material made for?

This course is for students and professionals interested in methodologies, techniques and tools thatsupport decision–making activities where early identification of potential security vulnerabilities andpreventive design options play a major role.

This includes software developers, security analysts, and managers interested in having a common means to communicate with each other, overcoming the usual language barriers from their own realities.

Participants will benefit from dialogue tools that allow them to collaborate in the analysis of security vulnerabilities and security–related design decisions, to acquire a common understanding of the key assets to protect and their potential threats, and to align their views on prioritizing the design of preventive measures.

Introduction

A key dilemma of security is to decide where to better invest resources to prevent security hazards. Threat modelling & assessment methodologies support this by promoting a security–by–design mindset, and providing structured processes and tools that help in finding a common understanding of the assets that need to be protected, their attack surface, expected vulnerabilities and possible countermeasures. Among all methodologies, attack trees have emerged as a lightweight, easy–to–adopt and flexible graphical notation to model and assess security.

7

Attack trees provide a representation of possible actions an attacker might take to compromise a system, and the defensive measures that a defender can employ to protect the system. They are an effective dialogue tool between the different stakeholders involved in threat modelling: designers and developers of system provide in–depth details about the attack–surface, security experts identify vulnerabilities and countermeasures, and managers contribute with business–driven priorities and decisions.

In this course, we will explore the key principles, tools, and techniques that enable organizations to model and assess security threats using attack trees. You will learn how to use attack trees to summarize attack scenarios in a graphical way, how to determine which attack scenarios are captured or excluded by an attack tree, how to assess and compare different attack scenarios, and how to incorporate countermeasures in your threat model to prevent specific vulnerabilities.

In addition to the comprehensive theoretical knowledge, this course offers an exciting opportunityto put practice and test skills using software tools to solve challenges specifically designed for threatmodelling and assessment with attack trees.

Whether you are a developer, a security analysist or a manager seeking to enhance your organization’s security posture, this course will equip you with the knowledge and skills needed to adopt a lightweight, yet effective approach to threat modelling and assessment.

9

Join us on this learning journey as we unlock the power of attack trees and empower you to bebetter at communicating about security threats and security–related decisions.