Attack Tree

An attack tree decomposes an attacker’s goal hierarchically into sub-goals and concrete attack steps. In the TARA according to ISO/SAE 21434, attack trees are used to model attack paths systematically and to rate their feasibility in a traceable way. The method comes from classical IT security and was popularised by Bruce Schneier in the late 1990s — long before the automotive standards adopted it.

Structure of an attack tree

The root of the tree is the attacker’s goal — for example “manipulation of the braking function”. Each level below refines how this goal can be achieved; the leaves are concrete, individually assessable attack steps. Two types of gates structure the tree:

• OR nodes: it is enough for one sub-path to succeed — alternative routes to the same sub-goal, such as “access via the OBD port” or “compromise of the telematics unit”.
• AND nodes: all sub-paths must succeed — for example first gaining access to the on-board network and then bypassing the ECU’s authentication.

A route from a leaf to the root describes a complete attack path. The tree thereby makes visible which combinations of steps an attacker needs — and where a single control interrupts several paths at once.

Attack trees in the TARA

In the Threat Analysis and Risk Assessment (TARA) of ISO/SAE 21434, the identification of threat scenarios is followed by the question of how a security property can concretely be violated. This is exactly where attack trees come in: they derive the associated attack steps for each threat scenario. Each step is rated using factors such as time, expertise, access and equipment; this yields the Attack Feasibility Level (AFL) of the path. Together with the impact level of the damage scenario, the AFL determines the risk level via the risk matrix — and thus which risks have to be treated.

Attack tree and fault tree: related structure, different world

The attack tree is the security counterpart of the fault tree (FTA) of functional safety. Both decompose an undesired top event into causes via AND/OR logic. The decisive difference lies in the nature of the causes: the FTA models random failures and calculates with probabilities of occurrence. The attack tree models deliberate actions of an intelligent adversary — what is rated is not how likely a step is to “happen”, but how easily a motivated attacker can carry it out.

Attack trees in practice: maintenance is the real work

Setting up an attack tree is the smaller part of the work. In real systems, the same assets and attack steps appear in several trees, and attack paths propagate across component boundaries. When a new vulnerability becomes known, the question is: does it change the AFL on a path that was previously considered acceptable? Keeping this re-evaluation consistent in five places at once quickly overwhelms spreadsheet-based approaches — the ratings drift apart, and the decision history is lost. For audit-ready analyses according to ISO/SAE 21434, model-based maintenance therefore proves its worth, with changes propagating along the paths instead of being updated by hand.