2KKUU7ita

Attack tree analysis is the process of creating
a flowchart-type mapping of how malicious
attackers would attack a system. Attack trees
are typically used in higher-level information
risk analyses and by security-savvy development
teams when planning out a new software
project. If you really want to take your ethical
hacking to the next level by thoroughly planning
your attacks, working very methodically, and
being more professional to boot, then attack
tree analysis is just the tool you need.
Chapter 3: Developing Your Ethical Hacking Plan
Attack tree analysis
The only drawback is that attack trees can take
considerable time to draw out and require a
fair amount of expertise. Why sweat it, though,
when you can use a computer to do a lot of
the work for you? A commercial tool called
SecurITree, by Amenaza Technologies Limited
(www.amenaza.com), specializes in attack
tree analysis, and you may consider adding it
to your toolbox. The following figure shows a
sample SecurITree attack tree analysis.
What specific systems you should test depends on several factors. If you
have a small network, you can test everything. Consider testing just publicfacing
hosts such as e-mail and web servers and their associated applications.
The ethical hacking process is flexible. Base these decisions on what
makes the most business sense.
39