Package: attacktree
WIP warningThis is a work in progress, a toy that I've been working on over the weekend. It's on GitHub just as a safe place to save it. It's in a public repo because it's not sensitive but I'm not encouraging anyone to use it :)IdeaProgramatically model trees like those described byKelly Shortridge,hereThe goal is to decouple the model from the view. In reality I'm removing the need for the user to understand Graphviz and introducing a need for them to understand python.Models differentiate between controls that areimlementedand those that are not; modelling both the current security posture, and a potential (improved) posture.Therenderer.render()function can toggle whether to include unimplemented things in it's graph.Prerequisites for Installation or DevelopmentYour system needs an installed version of graphviz for rendering to work.
On MacOS this can be installed usingbrew install graphvizSeehttps://graphviz.org/download/for other options.Installationattacktree is available in PyPI, we recommend installing in a virtualenvpython3 -m venv .venv
source .venv/bin/activate
pip install attacktreeInstructions for runningS3Simple.pyis a simple model, containing only a single path in some hypothetical S3 threat model. It can be run simply:python3 examples/S3Simple.pyS3Complex.pycontains some potential blocking mitigations, things the security team might be considering but hasn't implemented yet.python3 examples/S3Complex.pyMethodologyIn messing with this idea, I've found the easiest approach is to map the existing paths out first, without consideration for things you might implement. To see what that looks like checkoutexamples/S3Simple.py. After this one can either create a new tree with potential mitigationsoradd them to the existing tree, for examples purposes I chose the former;examples/S3Complex.py.SeeMethodology.mdfor more thoughts on how this might work in practice.Node typesThere are serveral types of nodemodelled, they're mostly self documenting.Action: An attacker action expected to achieve some resultDetect: A detection, a node that represents our (security team) ability to detect that actionBlock: Our ability to block that actionDiscovery: Knowledge that an attacker gains through successful completion of an action.Line typesThere are two types of line, solid and dashed (note, these can be changed instyle.json).Solid: This path exists todayDashed: This path represents what would happen if we implemented a control that is currently not implemented.The last line in each of those files is a call to render the tree:renderer.render(
        node=root,
        renderUnimplemented=True,
        style=style,
        fname="example_complexS3",
        fout="png"
    )I imagine that in general usage, we'd just want one model for a specific attacker; not a _simple and acomplexone. However, it's very useful to be able to see what those different graphs look like, as the latter models things wecoulddo but are currentlyunimplemented- for that reason therender()function has a parameter to enable or disable rendering of unimplemented paths. This way you can record everything in one tree (and maybe add that into version control, as a system of record) and render different outputs, one that shows your current reality, and one that shows your potential reality (hopefully improved).Below is the output of running the _complex example withrenderUnimplemented=True, note that if you set this toFalsethe generated graph looks the same asexamples/S3Simple.py.pyDevelopmentInstructions for setuppython3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
deactivate