Attack trees

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Where does the attacker's goal go in an attack tree?

A At the top, as the root of the tree

B At the bottom, as the last leaf

2. Goal: Read a student's private messages. Branches: Guess the password OR Steal the phone. What does OR mean here?

A The attacker must complete BOTH branches

B The attacker only needs ONE of the branches to succeed

3. Goal: Log in to a bank account. Branches: Steal the password AND steal the MFA code. What does AND mean here?

A The attacker can pick just one branch

B The attacker must complete ALL the branches

4. An attacker can reach a goal by Path A (3 easy steps) or Path B (6 hard steps). Which path would a smart attacker most likely take?

A Path A, the easiest path

B Path B, the hardest path

5. Which is a good way to use an attack tree to improve security?

A Add a defence, like MFA, to the easiest branch

B Add a defence only to the branch the attacker is unlikely to use

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Goal: Steal homework files ├─ OR Guess the password ├─ OR Trick user with phishing		AThe easiest path was picked as the highest score. The easiest path is the one with the lowest difficulty (Phishing: 3).
2Goal: Enter locked room ├─ AND Steal key card ├─ AND Learn the PIN		BAn AND branch: the attacker must complete ALL of these steps to reach the goal.
3Finding the easiest path: give each OR path a difficulty score and pick the lowest one.		CAn OR branch: the attacker only needs ONE of these paths to reach the goal at the top of the attack tree.
4Adding a defence to a branch: attach a control to a path so it becomes harder or blocked.		DThe branches are labelled AND, but the note says the attacker needs only one. Alternatives should be OR branches.
5Goal: Get into the account ├─ AND Guess password ├─ AND Steal phone for MFA code (attacker needs only one of them)		EOR Guess password └─ Defence: MFA on the account
6Goal: Steal data ├─ OR Phishing: 3 ├─ OR Guess password: 8 Easiest = Guess password		FOR Guess password: 2 OR Phishing email: 5 OR Hack server: 9 Easiest = Guess password

Definitions

attack tree

Fill in the Blanks

Complete each line of code by filling in the missing parts.

GOAL: Read exam answers __: Steal teacher password OR: Hack the school server

GOAL: Enter the server room ___: Get a key card AND: Know the door code

Path A: guess password (cost 2) Path B: hack the server (cost 9) Easiest path: Path _

GOAL: Take over account AND: steal password (3), steal code (4) Cost of AND branch = 3 _ 4

GOAL: Take over account OR: Guess the password DEFENCE: ___ blocks this branch

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A GOAL: Read the marks file

B OR: Phish a teacher

C AND: Guess a weak password

D OR: Steal a staff laptop

Question 2

A GOAL: Read exam paper

B OR: Guess password (hard)

C OR: Find sticky note (easy)

D EASIEST PATH: Guess password

Question 3

A GOAL: Take over an account

B OR: Phish the password

C OR: Guess the password

D DEFENCE: Phishing training

Question 4

A GOAL: Protect customer emails

B OR: Hack the web server

C OR: Phish a staff member

Question 5

A GOAL: Use a stolen bank card

B AND: Steal the card

C OR: Learn the PIN

Answer Key

Attack trees

Section A: Quick Questions

A — At the top, as the root of the tree

B — The attacker only needs ONE of the branches to succeed

B — The attacker must complete ALL the branches

A — Path A, the easiest path

A — Add a defence, like MFA, to the easiest branch

Section B: Match the Pairs

Goal: Steal homework files ├─ OR Guess the password ├─ OR Trick user with phishing → An OR branch: the attacker only needs ONE of these paths to reach the goal at the top of the attack tree.

Goal: Enter locked room ├─ AND Steal key card ├─ AND Learn the PIN → An AND branch: the attacker must complete ALL of these steps to reach the goal.

Finding the easiest path: give each OR path a difficulty score and pick the lowest one. → OR Guess password: 2 OR Phishing email: 5 OR Hack server: 9 Easiest = Guess password

Adding a defence to a branch: attach a control to a path so it becomes harder or blocked. → OR Guess password └─ Defence: MFA on the account

Goal: Get into the account ├─ AND Guess password ├─ AND Steal phone for MFA code (attacker needs only one of them) → The branches are labelled AND, but the note says the attacker needs only one. Alternatives should be OR branches.

Goal: Steal data ├─ OR Phishing: 3 ├─ OR Guess password: 8 Easiest = Guess password → The easiest path was picked as the highest score. The easiest path is the one with the lowest difficulty (Phishing: 3).

Section C: Definitions

attack tree — A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.

Section D: Fill in the Blanks

GOAL: Read exam answers
OR: Steal teacher password
OR: Hack the school server

GOAL: Enter the server room
AND: Get a key card
AND: Know the door code

Path A: guess password (cost 2)
Path B: hack the server (cost 9)
Easiest path: Path A

GOAL: Take over account
AND: steal password (3), steal code (4)
Cost of AND branch = 3 + 4

GOAL: Take over account
OR: Guess the password
  DEFENCE: MFA blocks this branch

Section E: Spot the Error

C — Phishing, guessing a password and stealing a laptop are separate alternatives. Each one is an OR branch. AND would mean the attacker must do all of them.

D — The easiest path is the branch that is least effort for the attacker. Finding the sticky note is marked easy, so it should be the easiest path, not guessing the password.

D — A defence must block the branch it sits under. Phishing training does not stop password guessing. A lockout rule does, so it should be 'DEFENCE: Lockout rule'.

A — The top of an attack tree is the attacker's goal, not a defender's aim. It should be 'GOAL: Steal customer emails'.

C — The attacker needs both the card and the PIN to get cash. Steps that are all required are AND branches, so this line should start with AND.