wshobson/attack-tree-construction

Attack Tree Construction

Systematic attack path visualization and analysis.

When to Use This Skill

• Visualizing complex attack scenarios
• Identifying defense gaps and priorities
• Communicating risks to stakeholders
• Planning defensive investments
• Penetration test planning
• Security architecture review

Core Concepts

1. Attack Tree Structure

                    [Root Goal]
                         |
            ┌────────────┴────────────┐
            │                         │
       [Sub-goal 1]              [Sub-goal 2]
       (OR node)                 (AND node)
            │                         │
      ┌─────┴─────┐             ┌─────┴─────┐
      │           │             │           │
   [Attack]   [Attack]      [Attack]   [Attack]
    (leaf)     (leaf)        (leaf)     (leaf)

2. Node Types

| Type | Symbol | Description | | -------- | --------- | ----------------------- | | OR | Oval | Any child achieves goal | | AND | Rectangle | All children required | | Leaf | Box | Atomic attack step |

3. Attack Attributes

| Attribute | Description | Values | | ------------- | ----------------------- | ------------------ | | Cost | Resources needed | $, $$, $$$ | | Time | Duration to execute | Hours, Days, Weeks | | Skill | Expertise required | Low, Medium, High | | Detection | Likelihood of detection | Low, Medium, High |

Templates and detailed worked examples

Full template library lives in references/details.md. Read that file when you need concrete templates for this skill.

Best Practices

Do's

• Start with clear goals - Define what attacker wants
• Be exhaustive - Consider all attack vectors
• Attribute attacks - Cost, skill, and detection
• Update regularly - New threats emerge
• Validate with experts - Red team review

Don'ts

• Don't oversimplify - Real attacks are complex
• Don't ignore dependencies - AND nodes matter
• Don't forget insider threats - Not all attackers are external
• Don't skip mitigations - Trees are for defense planning
• Don't make it static - Threat landscape evolves