Attack-tree Challenge
Thinking like an attacker, as a contest. Every team draws one attacker goal and builds the routes towards it along three branches — people, technology, supply chain. Points for what is plausible, extra points for what nobody else came up with, and the top prize for the cut point: the single measure that severs the most branches at once.
01 The material
Three sheets: the worksheet the team builds on, a worked teacher example, and the goal cards with the score sheet for the jury. Click the image for full resolution.
02 How the worksheet works
The goal comes off the card and is written in the attacker’s own voice — “I want to …”, never “I hack …”. Beside it the persona non grata: who is this, what does it get them, and where is their limit? A goal without an attacker produces movie plots.
Through people, through devices and technology, through the supply chain and the process. Every leaf gets one sentence of “how exactly?”, an asset number from week 1, and a choice between AND and OR: does this leaf stand on its own, or only together with the one above it?
Which measure removes the most leaves in one go — and how would you notice someone trying anyway? Next to it the strip for the paths that died on “how exactly?”, and the box where the jury adds up the points.
Two rules do most of the work. A path without an asset number is an opinion — that sends teams back to the week 1 canvas and keeps the tree tied to the case. And “how exactly?” has to fit in one sentence, with a Tuesday morning in it: who does what, where, holding what. That is the brake on the Hollywood attack, and at the same time the opening for non-technical team members: the route through people is usually the shortest one, and it takes no code at all.
03 The game in four rounds
Forty-five minutes, tightly timed. The challenge is not a brainstorm: every round has its own output, and the jury — you, or a team sitting a round out — keeps the pace up.
- Round 1 · 12 minBuildEach team draws one goal card and keeps it to itself. Three routes, at least two leaves per route. Think out loud, one writer, laptops closed.
- Round 2 · 8 minPass onThe sheets move one seat along. The neighbouring team adds what it would have come up with — initialled, because those leaves count for the team that built the tree, not for the one adding them.
- Round 3 · 15 minDefendEvery team reads out its strongest leaves; the jury asks the same question each time: how exactly? Plausible is one point. Then the question to the room: did anyone else have this? One hand up and the extra point is gone.
- Round 4 · 10 minCut pointBack to your own sheet: which single measure severs the most branches, and how would you notice someone trying anyway? Three points — and this is what carries over into block 9.
The scoring steers the behaviour, and that is deliberate. ✔ plausible = 1 point keeps teams away from zero-days and ninjas. ★ unique and plausible = 1 extra point rewards the route nobody saw — usually a human or organisational one. ✂ the cut point = 3 points, but only with detection: a measure without “how would we notice” is half a measure. Whatever dies on “how exactly?” scores nothing but earns an honourable mention, and one follow-up question: for which attacker would this add up?
04 What it connects to
The challenge does not stand alone. The asset numbers come from week 1, the vocabulary from the threat cards in block 2, and the cut points are the first measures in the risk profile of block 9. What was A1 in week 1 stays A1 here.
- Week 1 · block 9Security Context Canvasassets A1, A2 … + abuse cases
- Week 2 · block 2Threat cardswords for what can go wrong
- Week 2 · block 8Attack-tree challengeroutes → cut point with detection
- Week 2 · block 9Risk profiletop-5 risks + first measures
05 Want to weigh in?
The challenge is still a proposal — feedback on the goal cards, the scoring or the timing is welcome. Use the feedback button in the corner, or get in touch. contact