Development approach to the attack modeling for the needs of cyber security education

摘要

Critical infrastructure faces changed landscape of threats which requires progress in the understanding of highly sophisticated attacks. A reflection of this awareness is the upcoming technical documentation of umbrella organizations in critical infrastructure. The attack modeling is an important approach in the design stage of the system. The attack tree is a structural technique for attack modeling. In terms of graphic presentation, attack trees are not complex and can be designed manually, also, they are an important tool in recognizing threats and evaluating risks. The absence of the presentation of comprehensive and systematic approaches to the attack modeling is often reflected in rather generalized and inconsistent presentations of the attack modeling as well as in difficult transfer of attack modeling techniques into practice. The current absence of the agreement and lack of consistency in the development approach of structural attack models limits the transfer of concepts in the field of cyber-attacks to educational environments. The purpose of the paper is to present, in clear practical example, a proposal for the development approach to the attack modeling. Thus, we want to contribute to the implementation of attack modeling into practice, especially in the field of cyber security education.