Secrets & Lies: Digital Security in a Networked World
Secrets & Lies: Digital Security in a Networked World
Serial model for attack tree computations
ICISC'09 Proceedings of the 12th international conference on Information security and cryptology
Foundations of attack-defense trees
FAST'10 Proceedings of the 7th International conference on Formal aspects of security and trust
Prioritizing countermeasures through the countermeasure method for software security (CM-Sec)
PROFES'10 Proceedings of the 11th international conference on Product-Focused Software Process Improvement
Attribute Decoration of Attack-Defense Trees
International Journal of Secure Software Engineering
Quantitative questions on attack: defense trees
ICISC'12 Proceedings of the 15th international conference on Information Security and Cryptology
| Hi-index | 0.03 |
A common practice for studying the risk to a business is based on risk management principles. I.e., security resources are applied to vulnerabilities that pose the greatest risk to the business. Several processes for identifying and prioritizing risk are proposed in the literature. One of the most effective is threat modeling. Traditional trust modeling thought in academia involved mostly mathematical and theoretical concepts and using computer-security company marketing literature/jargon making it very hard to understand or analyze. This paper presents a practical, high-level guide to understand the concepts of threat modeling to students in an introductory level Security course or even a Managerial course. We use the concept of Attack Trees to this end. Attack Trees are conceptual diagrams of threats on systems and possible attacks to reach those threats. Here, we first provide a brief introduction to Attack Trees and then we consider Globus systems to illustrate how Attack Trees could be used to analyze their security. We specifically evaluate the security of MyProxy system, an important security subsystem part of Globus toolkit for Grid Computing.