TREsPASS: Attack Navigator Map

About TREsPASS

TREsPASS is an EU-funded research project about (cyber) security.

Information security threats to organisations have changed completely over the last decade, due to the complexity and dynamic nature of infrastructures and attacks. Defenders need to make rapid decisions regarding which attacks to block, as both infrastructure and attacker knowledge change rapidly.

The TREsPASS project develops methods and tools to analyse and visualize information security risks in dynamic organisations, as well as possible countermeasures. It combines knowledge from technical sciences (how vulnerable protocols and software are), social sciences (how likely people are to succumb to social engineering), and state-of-the-art industry processes and tools.

Attack Navigator Map

The Attack Navigator Map is a tool for predicting and prioritising attack scenarios based on a model of the system or organisation concerned. The model takes the form of a ‘map’, with assets, items, actors, processes, policies. The analysis of the scenario is visualized to help make decisions. The tool can also be used to judge the effect of countermeasures, by re-running the analysis with an adapted model.

The main view of the ANM is a graphical model editor, where existing models can be loaded, or created from scratch. Single components or pre-defined patterns are added to the map via drag and drop, and connected with each other. Connections can express physical connections (as in ‘a door connects two rooms’), containment (as in ‘the laptop is in the office’ or ‘the file is stored on the server’), or arbitrary relationships (as in ‘the employee works for the company’).

In order to analyze a model as part of a scenario, the user selects one of the actors on the map to be the attacker, and assigns an attacker profile to him / her. Such a profile defines the skill and resources (money, time) of an attacker. The user also picks one asset on the map as the attacker’s goal, and specifies the monetary gain for the attacker, should the attack be successful.

The analysis of the model is invoked through the ANM interface, but runs in the background. Once the analysis results become available, they are visualized in a dashboard. It gathers all the results of the analysis (and other intermediate tools) and visualises them as attack trees. There are different layout options and view modes, and the possibility to highlight the relevant parts of an attack on the map.