Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

18

|

Chapter 1: Threat Modeling and Risk Management

Based on the cost of hiring the right kind of criminals to perform these attacks, the

most promising attacks in this example are hacking the SMTP gateway and hacking

remote users. ABC Corp., it seems, had better take a close look at their perimeter

network architecture, their SMTP server’s system security, and their remote-access

policies and practices.

Cost, by the way, is not the only type of value you can attach to leaf nodes. Boolean

values such as “feasible” and “not feasible” can be used: a “not feasible” at any point

on an attack path indicates that you can dismiss the chances of an attack on that

path with some safety. Alternatively, you can assign effort indices, measured in min-

utes or hours. In short, you can analyze the same attack tree in any number of ways,

creating as detailed a picture of your vulnerabilities as you need to.

Before we leave the subject of attack-tree threat modeling, I should mention the

importance of considering different types of attackers. The cost estimates in Figure 1-5

are all based on the assumption that the attacker will need to hire others to carry out

the various tasks. These costs might be computed very differently if the attacker is

himself a skilled system cracker; in such a case, time