Modern organisations are complex, socio-technical systems consisting of a mixture of physical infrastructure, human actors, policies and processes. An increasing number of attacks on these organisations exploits vulnerabilities on all different levels, for example combining a malware attack with social engineering. Due to this combination of attack steps on technical and social levels, risk assessment in socio-technical systems is complex. Therefore, established risk assessment methods often abstract away the internal structure of an organisation and ignore human factors when modelling and assessing attacks. In our work we model all relevant levels of socio-technical systems, and propose evaluation techniques for analysing the security properties of the model. Our approach simplifies the identification of possible attacks and provides qualified assessment and ranking of attacks based on the expected impact. We demonstrate our approach on a home-payment system. The system is specifically designed to help elderly or disabled people, who may have difficulties leaving their home, to pay for some services, e.g., care-taking or rent. The payment is performed using the remote control of a television box with a contactless payment card (see Figure 1). When a transfer is initiated, a password is needed in order to authenticate the owner of the card.
Our model is based on work by Probst et al. [
The example scenario, also shown in Figure 2, represents an actor Alice, who receives a care-taking service provided by an actor Charlie. The company Charlie works for has a policy that forbids the employees to take money from the customers. The locations modelled in this scenario are Alice’s home, a bank with an ATM, and a bank computer. Alice’s payment card, the pin it contains, and the pin Alice knows for her card are modeled as assets. An example for a node associated with a policy is the bank computer, where the policy requires a bank account and a matching password.
In order to identify the possible attacks based on the model, our approach
does not analyse only the technical infrastructure but also takes into
consideration the human factor. Social attacks, e.g., social engineering, are an essential
component as attack threats could be easily underseen when only technical
attacks are considered. The human factor modelling in technical systems is also
formally presented using Isabelle theorem prover [
Our analysis is carried out on attack trees, a suitable tool for presenting
sociotechnical threats and conveying security information to non-experts. Attack
trees, introduced by Schneier [
Attack trees are analysed by assigning values to the basic actions and propagating them from the leaves to the root of the tree. Most attack tree analyses consider attack trees with one parameter and optimise one particular aspect of a scenario, such as likelihood of success or difficulty of a hack, in terms of time or cost of an attack. Moreover, in most attack tree models with multiple parameters values are propagating from the leaves to the root based on local decision strategies, i.e., in each step of the evaluation optimisation is made with respect
card pin, 96 Alice pwd, 313 card pin, 42 pin, 96 owner, Charlie pin, 42 owner, Alice processes network world actors
C: out(“transfer”, number, pwd, amount) account C: out(“deposit”, number, amount) number, pwd,313 cash, 34567 100 WS: out
ATM A1 safe card[(pin,X)],(pin,X) : in cash, 1000
harddrive pwd, 313
Alice: out
trustedby(Alice): move Pc Paccount
Pws to one parameter. In case of incomparable values, however, this approach may yield sup-optimal results.
In order to overcome this limitation and evaluate complex attack scenarios,
we present evaluation techniques that consider attack trees where basic actions
are assigned with more than one parameter, such as, likelihood of success and
cost. Our evaluation techniques try to optimise all parameters at once.
However, optimisation of multiple parameters might lead to incomparable values,
e.g., maximising likelihood while minimising cost. Even worse, a best solution
does not always exist. We handle this issue by computing the set of optimal
solutions [
We illustrate the evaluation techniques on the attack scenario where an attacker wants to steal money from the card-holder by forcing him/her to pay fake services. Our evaluation techniques answer the questions, such as “Can an attacker successfully steal money from the card-holder?” or “What is the maximum likelihood of success of an attack?”. Moreover, we associate with each basic action a cost of an attack, and detected the attacks with maximum likelihood and minimum cost. We compute the set of all Pareto optimal solutions, displayed in Figure 3, where each point shows a likelihood of success with the corresponding cost.
(!!" '!!" &!!" % $#"%!!" ! $!!" #!!" !"!)!!" !)!'" !)#!" !)#'" !)$!" !)$'" !)%!" !)%'" !)&!"
&'"()(*+*$,%
As future work, we plan to introduce countermeasures to the model. Besides the identification of possible socio-technical threats, we would like to determine the corresponding defender actions and evaluate attack and defence scenarios. Acknowledgment: Part of the research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/20072013) under grant agreement no. 318003 (TRESPASS). This publication reflects only the authors’ views and the Union is not liable for any use that may be made of the information contained herein.