From Categories to Paths
STRIDE tells you what kind of threat you are facing. Attack Trees tell you how an attacker achieves their goal — the sequence of steps and decisions they must make. These two tools are complementary: STRIDE for breadth, Attack Trees for depth.
An Attack Tree is a hierarchical diagram rooted at the attacker's ultimate goal. Each node below the root represents a sub-goal or step. Nodes are connected by two types of logic:
- OR nodes: The attacker only needs to succeed at one of the child paths to achieve the parent goal.
- AND nodes: The attacker must succeed at all child steps to achieve the parent goal.
Example: Compromising a Production Database
ROOT GOAL: Read all customer records from production database
│
├── [OR] Path A: Compromise the application server
│ ├── [OR] Exploit an unpatched RCE vulnerability in the web framework
│ └── [OR] Phish a developer to steal their SSH private key
│
├── [OR] Path B: Access the database directly
│ ├── [AND] Obtain database credentials
│ │ ├── Read plaintext credentials from config file (requires server access)
│ │ └── [OR] Find credentials in a public GitHub commit
│ └── [AND] Reach the database network port
│ └── Database security group allows inbound from 0.0.0.0/0 (misconfiguration)
│
└── [OR] Path C: Compromise a database backup
├── Access an S3 bucket with public read permissions
└── [OR] Intercept an unencrypted backup transferred over HTTP
Reading the Tree for Defensive Insight
The power of an attack tree is not just documentation — it is prioritization. Look for nodes that appear in multiple paths. In the example above, "Phish a developer" appears as a path to server compromise. If you add MFA to all developer accounts, you do not eliminate phishing, but you make that branch significantly harder, raising the attacker's cost.
Similarly, "Find credentials in a public GitHub commit" is a leaf node that is both high-impact (it enables full DB access) and low-effort for an attacker (automated scanners like truffleHog do this continuously). That combination — high impact, low attacker effort — means it should be mitigated immediately.
A common interview question is: "How do you decide which security vulnerabilities to fix first?" A weak answer is "the most critical ones." A strong answer references a structured approach: use Attack Trees to identify which mitigations cut off the most attack paths simultaneously, then layer in a risk scoring model (impact × likelihood) to sequence the remaining work. This demonstrates systems thinking, not just tool knowledge.