
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
18
|
Chapter 1: Threat Modeling and Risk Management
Based on the cost of hiring the right kind of criminals to perform these attacks, the
most promising attacks in this example are hacking the SMTP gateway and hacking
remote users. ABC Corp., it seems, had better take a close look at their perimeter
network architecture, their SMTP server’s system security, and their remote-access
policies and practices.
Cost, by the way, is not the only type of value you can attach to leaf nodes. Boolean
values such as “feasible” and “not feasible” can be used: a “not feasible” at any point
on an attack path indicates that you can dismiss the chances of an attack on that
path with some safety. Alternatively, you can assign effort indices, measured in min-
utes or hours. In short, you can analyze the same attack tree in any number of ways,
creating as detailed a picture of your vulnerabilities as you need to.
Before we leave the subject of attack-tree threat modeling, I should mention the
importance of considering different types of attackers. The cost estimates in Figure 1-5
are all based on the assumption that the attacker will need to hire others to carry out
the various tasks. These costs might be computed very differently if the attacker is
himself a skilled system cracker; in such a case, time