HS-Esslingen/swb6-it-sec
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update part2 tree, more realistic

Browse source
This commit is contained in:
Florian Hoss 2022-06-23 17:29:05 +02:00
parent b69c7048f1
commit 3b06bd75db
2 changed files with 67 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

68
Lab05/documentation/part2/part2.tex
View file

@ -2,7 +2,9 @@
\subsection{Baum}
\begin{sideways}
Siehe Abbildung \ref{tree:Attack tree}
\begin{sidewaysfigure}
\begin{forest}
for tree={
draw,
@ -11,47 +13,47 @@
align=center,
child anchor=parent
},
[{Daten in Datenbank angreifen}, name=AD
[{Zugang zum Server}
[{Sicherheitsdients\\bestechen\\10.000€}, angle below
[{Zugang zum Gebäude 10€}, color my roots=teal, rotate=270]
[{Festplatten klauen 10€}, color my roots=teal, rotate=270]
[{Spuren verwischen 50.000€}, color my roots=teal, rotate=270]
]
[{Feueralarm\\aktivieren\\10€}, angle below
[{Als Feuerwehrmann Gebäude betreten 100€}, color my roots=teal, rotate=270]
[{Im Chaos Festplatten klauen 10€}, color my roots=teal, rotate=270]
[{Unauthorized Access to DB Data}, name=AD
[{No authentication}, angle below, color=red
[{Access to\\server room}, color=red]
[{Access to\\the building}, color=teal
[{Bribe\\security\\guard}, color=teal]
[{Disguise yourself\\as fireman}, angle below, color=red
[{Steal\\fireman\\clothes}, color=red]
[{Activate\\firealarm}, color=teal]
[{firealarm\\disables\\locks}, color=red]
]
[{Break into\\building}, color=red
[{Hire crew\\for heist}, color=red]
]
]
]
[{Zugang zu Daten}
[{SSH\\hijack\\10€}
[{Man In the Middle 10€}, color my roots=teal, rotate=270]
[{Zertifikate klauen 1.000€}, color my roots=teal, rotate=270]
]
[{SQL\\Injection\\10€}
[{Passworteingabe 10€}, color my roots=teal, rotate=270]
[{Kommentarfunktion 10€}, color my roots=teal, rotate=270]
]
[{Schlechte\\Auth\\10€}
[{Password ist 12345678 10€}, color my roots=red, rotate=270]
[{Harddrives unencrypted}, color=red, angle below
[{Unsupervised}, color=red]
[{Access to the harddrives}, color=teal
[{Collect harddrives\\for cleansing}, angle below, color=teal
[{Get company\\to hire you}, color=teal]
[{Work in\\data cleansing}, color=teal]
]
]
]
[{Zugang zu Mitarbeiter}
[{Daten auf\\USB Stick\\100.000€}, angle below
[{Daten auf Server löschen 10.000€}, color my roots=teal, rotate=270]
[{Daten an Firma verkaufen 500€}, color my roots=teal, rotate=270]
[{Daten im Netz verkaufen 500€}, color my roots=teal, rotate=270]
[{Access to db terminal}, color=teal
[{Access to\\SSH Keys}, color=red
[{Access to\\Key storage}, angle below, color=red
[{Employee uses\\bad password}, color=teal]
[{Access to\\employee laptop}, color=teal]
]
]
[{Daten\\in Cloud\\100.000€}
[{Daten im Netz verkaufen 500€}, color my roots=teal, rotate=270]
[{Firma mit Veröffentlichung drohen 1000€}, color my roots=teal, rotate=270]
[{Flaw in\\Authentication}, color=teal
[{MITM}, color=teal]
[{Spoofing}, color=teal]
]
]
]
\end{forest}
\end{sideways}
Wenn keine Kosten für die Aktion vorhanden sind werden trotzdem 10€ für Sprit, Strom, etc. gerechnet.
\caption{Attack tree}
\label{tree:Attack tree}
\end{sidewaysfigure}
\subsection{Kosten des günstigsten Angriffs}