Decoding Cyber Threats: A Practical Guide to Using Attack Trees
summary
Attack trees provide a decision-first threat model that maps sequential events to controls, combining MITRE ATT&CK and the Diamond Model and often built in under 30 minutes on a whiteboard. Use the MITRE Ingenuity Excel and Splunk Security Content to surface detectable choke points; a common, actionable finding is a PowerShell choke point (high prevalence, high impact). Examples: prioritize detections mapped to controls, but test before deployment — a DLP roll‑out once stopped core R&D.
AI-written summary · about
chapters (9)
- 0:00Introduction to attack trees
- 4:29History and structure
- 8:18Modern CTI integration
- 12:28Decision-making and modeling
- 15:42Prioritization and action
- 19:45Practical guide to modeling
- 23:46Real-world example
- 27:20Actionability assessment
- 30:59Conclusion
related talks
27mFrom Attacks to Action - Building a Usable Threat Model to Drive Defensive Choices
37mThreats versus Capabilities Building Better Detect and Respond Capabilities
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
48mMITRE ATT&CK: The Play at Home Edition
34mMITRE Attack Flow: Laying Foundations for Predictive Intelligence
29mThreat Modeling the Death Star
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
58mMITRE ATT&CK for Developers