Onderwerp: Idea of CAW (Creation of Attack Wood)

hali,

there is the attack tree concept of Bruce Schneier:
http://www.schneier.com/paper-attacktrees-ddj-ft.html
http://www.counterpane.com/attacktrees.pdf

there is a SW that helps creating such trees:
SecurITree from Amenaza, http://www.amenaza.com/

i am working on attack tree of smartcards, and i have the
idea of creating as many as possible attack trees for
different systems and at the end they can build an Attack Wood
of IT security...and of course this wood is like the real one,
where new trees are born or old ones die, boughs are broken
or outgrown etc.

maybe on HEX (http://www.hex2005.org/) we will have the 1.0
version :-)

any comment, idea, opinion, advise is welcome and thnx in advance!

zoli

A levelez=F5m azt hiszi, hogy kincses zoli a k=F6vetkez=F5eket =EDrta:
> there is the attack tree concept of Bruce Schneier:
> http://www.schneier.com/paper-attacktrees-ddj-ft.html
> http://www.counterpane.com/attacktrees.pdf

[]
> i am working on attack tree of smartcards, and i have the
> idea of creating as many as possible attack trees for
> different systems and at the end they can build an Attack Wood
> of IT security...and of course this wood is like the real one,
> where new trees are born or old ones die, boughs are broken
> or outgrown etc.

It is a very good idea. Though one should always be aware
of the fact that there are two cake-slicing problems hidden here
(a cake can be sectioned any way you feel comfortable):
-Your definition of the goal is your definition. I might have
a goal which is very similar to yours, but have some different
aspects.
-Your categorisation of the ways attacking the problem is your
categorisation. I might even have a widely different categorisation
of the solutions for the same problem.

This means than you might soon find that your wood have more
instances of the same species and variations of the species.

It is not a problem as such, because one can learn a lot by
studying the different attack trees.

I am wondering if there is a benefit of having a standard set
of attack trees, in a way as part 2 and 3 of the Common
Criteria are standard sets of security functional and assurance
requirements.

>=20
> maybe on HEX (http://www.hex2005.org/) we will have the 1.0
> version :-)

Does it mean that we can send you our attack trees for inclusion
in the wood? I have already sent one, and you can expect others.
Where will the webpage of the wood will be located?


--=20
GNU GPL: csak tiszta forr=E1sb=F3l

--liOOAslEiF7prFVr
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 20, 2004 at 05:58:17PM +0000, Magos=E1nyi =C1rp=E1d wrote:
> -Your definition of the goal is your definition. I might have
> a goal which is very similar to yours, but have some different
> aspects.

The goals should be categorized, too, as the departing points are.
Preferably, these goals should be modularized out, so you end up with a
set of atomic sub-goals, which can be in turn combined in real
super-goals. This way, you get just one huge graph, instead of many
(inevitably overlapping) graphs.

Jan.

--=20
"To me, clowns aren't funny. In fact, they're kind of scary. I've wonder=
ed
where this started and I think it goes back to the time I went to the circ=
us,
and a clown killed my dad."

--liOOAslEiF7prFVr
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFAhnDk+uczK20Fa5cRAsPLAJ0ZVCYBqc+2+wNmwXsLlF +PmcEDrQCghvAs
6RIWeZWpbcmx96t1WURCPvU=
=ucif
-----END PGP SIGNATURE-----

--liOOAslEiF7prFVr--