← Years 9–10 Digital Systems

Attack trees

A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 76, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 77

Understanding Attack trees in Years 9–10 Digital Systems

What it does: The attack tree shows that the lowest-scoring OR path is the easiest for the attacker, so it is the best place to defend first. OR branches are alternatives. Any one of them can reach the goal, so the attacker picks whichever is easiest. AND branches are all needed together. If a defence stops one of them, the whole path is blocked. The point of an attack tree is to branch into several routes to the same goal, so defenders can compare them.

Common mistakes: Phishing, guessing a password and stealing a laptop are separate alternatives. Each one is an OR branch. AND would mean the attacker must do all of them. The easiest path is the branch that is least effort for the attacker. Finding the sticky note is marked easy, so it should be the easiest path, not guessing the password.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Attack trees to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Where does the attacker's goal go in an attack tree?
At the top, as the root of the treeAt the bottom, as the last leaf
Matches
Goal: Get into the account ├─ AND Guess password ├─ AND Steal phone for MFA code (attacker needs only one of them)
↓
The branches are labelled AND, but the note says the attacker needs only one. Alternatives should be OR branches.
Applying
Meanings
Term
attack tree
Meaning
A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.
Practice
GOAL: Read a student's email account
Testing
Gaps
: Steal teacher password
Check Answer
Spots
2 OR: Phish a teacher
3 AND: Guess a weak password

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Hedgehog' badge — First Steps, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Where does the attacker's goal go in an attack tree?
A. At the top, as the root of the tree ✓
B. At the bottom, as the last leaf
An attack tree starts with the goal at the top. It then branches down into the different ways of reaching that goal.
2. Goal: Read a student's private messages. Branches: Guess the password OR Steal the phone. What does OR mean here?
A. The attacker must complete BOTH branches
B. The attacker only needs ONE of the branches to succeed ✓
OR branches are alternatives. Any one of them can reach the goal, so the attacker picks whichever is easiest.
3. Goal: Log in to a bank account. Branches: Steal the password AND steal the MFA code. What does AND mean here?
A. The attacker can pick just one branch
B. The attacker must complete ALL the branches ✓
AND branches are all needed together. If a defence stops one of them, the whole path is blocked.
4. An attacker can reach a goal by Path A (3 easy steps) or Path B (6 hard steps). Which path would a smart attacker most likely take?
A. Path A, the easiest path ✓
B. Path B, the hardest path
Attackers usually take the easiest path. Attack trees help defenders spot that path so they can protect it first.
5. Which is a good way to use an attack tree to improve security?
A. Add a defence, like MFA, to the easiest branch ✓
B. Add a defence only to the branch the attacker is unlikely to use
Defences work best on the easiest path. Blocking the branch an attacker would actually choose makes the biggest difference.

Match the Pairs

Goal: Steal homework files ├─ OR Guess the password ├─ OR Trick user with phishing → An OR branch: the attacker only needs ONE of these paths to reach the goal at the top of the attack tree.
Goal: Enter locked room ├─ AND Steal key card ├─ AND Learn the PIN → An AND branch: the attacker must complete ALL of these steps to reach the goal.
Finding the easiest path: give each OR path a difficulty score and pick the lowest one. → OR Guess password: 2 OR Phishing email: 5 OR Hack server: 9 Easiest = Guess password
Adding a defence to a branch: attach a control to a path so it becomes harder or blocked. → OR Guess password └─ Defence: MFA on the account
Goal: Get into the account ├─ AND Guess password ├─ AND Steal phone for MFA code (attacker needs only one of them) → The branches are labelled AND, but the note says the attacker needs only one. Alternatives should be OR branches.
Goal: Steal data ├─ OR Phishing: 3 ├─ OR Guess password: 8 Easiest = Guess password → The easiest path was picked as the highest score. The easiest path is the one with the lowest difficulty (Phishing: 3).

Key Term

attack tree
A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.

Fill in the Blanks

1. GOAL: Read exam answers OR: Steal teacher password OR: Hack the school server
Hint: Type the branch keyword used when either path alone reaches the goal.
2. GOAL: Enter the server room AND: Get a key card AND: Know the door code
Hint: Type the branch keyword used when every step must be completed.
3. Path A: guess password (cost 2) Path B: hack the server (cost 9) Easiest path: Path A
Hint: Type the letter of the path with the lowest cost for the attacker.
4. GOAL: Take over account AND: steal password (3), steal code (4) Cost of AND branch = 3 + 4
Hint: Type the operator that combines costs when all steps are needed.
5. GOAL: Take over account OR: Guess the password DEFENCE: MFA blocks this branch
Hint: Type the defence that asks for a second proof of identity.

Spot the Error

Question 1
A GOAL: Read the marks file
B OR: Phish a teacher
C AND: Guess a weak password
D OR: Steal a staff laptop
Line C — Phishing, guessing a password and stealing a laptop are separate alternatives. Each one is an OR branch. AND would mean the attacker must do all of them.
Question 2
A GOAL: Read exam paper
B OR: Guess password (hard)
C OR: Find sticky note (easy)
D EASIEST PATH: Guess password
Line D — The easiest path is the branch that is least effort for the attacker. Finding the sticky note is marked easy, so it should be the easiest path, not guessing the password.
Question 3
A GOAL: Take over an account
B OR: Phish the password
C OR: Guess the password
D DEFENCE: Phishing training
Line D — A defence must block the branch it sits under. Phishing training does not stop password guessing. A lockout rule does, so it should be 'DEFENCE: Lockout rule'.
Question 4
A GOAL: Protect customer emails
B OR: Hack the web server
C OR: Phish a staff member
Line A — The top of an attack tree is the attacker's goal, not a defender's aim. It should be 'GOAL: Steal customer emails'.
Question 5
A GOAL: Use a stolen bank card
B AND: Steal the card
C OR: Learn the PIN
Line C — The attacker needs both the card and the PIN to get cash. Steps that are all required are AND branches, so this line should start with AND.

Student with a class code? Join your class →