Attack Trees and Abuse Cases

Annotate each leaf with independent attributes: money, skill level, elapsed time, required access, equipment and detectability. Collapsing them into one number hides that a step can be cheap in cash yet demand rare skill or insider access nobody can buy.

Keep the three story clauses and make each hostile: the role becomes a named attacker persona, the capability becomes what they want the system to allow, and the benefit becomes their payoff. The asset stays in the final clause.

A concrete-action leaf names one specific thing an attacker does on this system, specific enough to cost and to defend. A category leaf such as 'obtain a credential' only restates the sub-goal above it, hides the real work, and maps to no control.

Restate the attacker's goal as a must-not statement with an observable outcome, then write a test that runs from the adversary's position and asserts the refusal, the unchanged state, and the recorded evidence.

Re-cost the whole tree with each control applied and compare the rise in the root's cheapest-path value, not the rise on the node the control touches. Then weigh that rise against what the control costs you to build and run.

An OR node means any one child suffices, so the branch costs whatever the cheapest child costs and hardening only some children buys nothing. An AND node needs every child, so breaking one conjunct closes the whole branch.

That root names a vulnerability, not an attacker objective. An attack tree's root must state what the attacker wants to achieve - post as a moderator to the whole membership - leaving the flaw as one branch beneath it.

A reusable subtree is one sub-goal decomposed once - say 'gain write access to the build runner' - and re-attached under many attack trees by reference. Re-attach when the sub-goal genuinely recurs with the same shape.

Cheapest-path propagation assumes an attacker minimising your cost estimate for one attempt. Real adversaries optimise repeatability, exposure risk and capability they already own, so the attack you actually see is often a costlier branch run at volume.

Detectability and elapsed time. For a caseworker with legitimate access, cost, skill, equipment and required access are near identical on both branches; the slow branch trades months of wall-clock time for a much lower chance of being noticed.

Stop when the node already names an action you can cost and defend, when every child would resolve to the same control, or when further detail describes work you cannot influence. Depth is a budget, and uneven depth is expected.

Pair every negative assertion with a positive control in the same run, assert the exact refusal the design chose plus unchanged state and a denial record, and confirm the test fails when the guard is disabled.

Because the attacker displaces onto the next-cheapest branch. An OR node takes the minimum over alternatives, so removing one path only helps by the gap to the runner-up — which is often small, and often reached by a completely different adversary.

Share the branch structure; set everything measurable per console - leaf cost, skill, detectability, feasibility. Prune branches a console lacks, raise leaves an existing control blocks, then re-propagate: the cheapest path can differ per console.

Attach each evil user story to the feature story it inverts so it is sized in the same slice, and express its value as a capability removed from the attacker rather than one added for a user. A separate security backlog ages and dies.

A useful attacker persona states the access the person already holds, what they want from this specific system, what counts as good enough for them, and what they will not risk. A caricature states only a label.

Rewrite the level so every sibling sits at the same grain, each naming a state the attacker still has to reach. Demote the over-specific child under the sub-goal it serves; promote anything vaguer than its neighbours.

Each attribute's minimum can land on a different OR branch, so the root reports one branch's money beside another branch's hours. That combination is not an attack anyone can run. Propagate whole annotated paths, not independent columns of numbers.

Replace unsourceable point figures with a few named qualitative bands and record where each value came from. A precise-looking number nobody can trace survives review because it has digits, and it makes a guess look like evidence.

Duplicate only when the copies genuinely differ under each parent. If it is the same work, share one node or lift it into its own tree with reference stubs, and read the repetition itself as a chokepoint where one control cuts three paths.

Split the narrative into steps, automate the technical invariants, and keep each human-dependent step visible in the model with a stated reason and a named substitute exercise instead of quietly deleting it.

Stop stacking on that branch. Once a path is hardened past the next-cheapest alternative, further controls there buy nothing at the root. Spend on whichever branch now sets the root cost, or on detection and response instead of prevention.

Give each shared subtree a named owner and a recorded consumer list, review it whenever a consumer's architecture changes, fork when branches diverge in shape, and retire subtrees no live system matches.