Ranking Mitigations by Cost

## What ranking by cost actually compares An attack tree states one attacker goal at the root. Children under an **OR** node are alternative ways to reach the parent; children under an **AND** node are steps that must all succeed. Leaves carry an annotation — here, attacker cost in whatever unit the team agreed — and those annotations propagate upward: **summed through AND, minimised through OR**. The root's value is therefore the cost of the *cheapest path*: what the attack costs an adversary who picks well. In that model a mitigation does not remove a threat. It raises the cost of one or more nodes, possibly to the point of infeasibility. The honest measure of a mitigation is therefore not "which threats does it address" and not "how much harder does it make step X" — it is: **re-cost the entire tree with the control in place and read the root again.** The delta at the root is what the control bought. ## A worked comparison A payroll provider models the goal *redirect one salary payment*. The adversary is an external social engineer or an insider in HR operations; the asset is money. ``` GOAL redirect one salary payment [OR -> minimum] | +-- A. change bank details in employee self-service [AND -> sum] = 3 | +-- phish one employee's login = 3 | +-- submit the change form = 0 | +-- B. social-engineer HR ops into making the change = 5 | +-- C. compromise an HR-ops operator account = 8 Root = min(3, 5, 8) = 3 ``` Three candidate controls, each re-costed across the whole tree: | Control | A | B | C | New root | Root delta | |---|---|---|---|---|---| | Out-of-band callback to the employee's number on file, for every change | 9 | 11 | 14 | 9 | +6 | | 24-hour cooling-off window with a notice to the employee | 5 | 7 | 10 | 5 | +2 | | Dual approval by a second HR-ops person | 3 | 12 | 15 | 3 | 0 | Dual approval is the instructive row. It is a genuine control, it makes both operator-shaped branches far more expensive, and it buys **nothing at the root**, because the branch that sets the minimum never passes through HR ops. A team ranking by intuition or by "number of threats addressed" ships dual approval and reports progress. A team that re-costs ships the callback — or the cooling-off window, depending on the ranking rule. ## Ranking, not just measuring Root delta alone answers *how much did this help the attacker's bill*. Ranking also needs the denominator: what the control costs **you** to build, run and inflict on legitimate users. The callback buys +6 for a heavy ongoing operational and support burden. The cooling-off window buys +2 for almost nothing. Two defensible rules: - **Threshold**: if the goal is "root must exceed 8", only the callback qualifies, whatever its ratio. - **Efficiency**: if you are buying the most attacker cost per unit of defender effort, the cooling-off window wins, and stacking it with a cheap second control may beat the callback for less. Say out loud which rule you are applying. Most arguments about mitigations are really unstated disagreements about which of these two questions is being answered. ## Rules that keep the comparison honest - **Hold the tree constant.** Same scope, same branch set, same attacker profile, same units for every candidate. A control costed against a low-skill outsider and another costed against an insider are not comparable numbers. - **Re-propagate the whole tree**, not just the sub-branch you changed. The root is a minimum over alternatives, so a large local rise can produce a zero global rise. - **Treat an infeasible node as branch removal**, then read the new minimum — that is where your attacker goes next. - **Rank, do not price.** The annotations are estimates; relative ordering survives estimate error far better than absolute values do. A sensitivity check — does the ranking flip if this leaf is wrong by a factor of two? — is worth more than another digit of precision. ## Where the method misleads The cheapest path is not automatically the likeliest path: an adversary optimises for their own constraints, not only for cost. The ranking is also only as good as the branch set — comparing controls silently assumes there is no unmodelled cheaper route, and the first thing a good reviewer does is attack that assumption rather than the arithmetic. Finally, a control can raise cost while making the attack quieter; if detectability is part of your annotation set, a rise in cost is not the only column worth reading.