TDDC03 Projects, Spring 2006 A Comparison of Attack Trees Threat Modeling and OCTAVE

Avoidance and discovery of security vulnerabilities in information systems and managing enterprises requires awareness of typical risks and a good understanding of vulnerabilities and threats and their exploitations. Various methods for characterizing, identifying and managing threats have been presented. Bruce Schneier has invented the Attack Trees, Microsoft call their method Threat Modeling and Carnegie Mellon University developed a solution for managing an entire enterprise named OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation). In this paper we compare the three methods of Attack Trees, Threat Modeling and OCTAVE, and also compare two softwares using Attack Trees and Threat Modeling.