Attack Model

Definition

An Attack Model describes how an attacker carries out an attack. It explains the attack method, target, entry point, timing, and frequency. In threat modeling, it helps engineers understand the steps an attacker might take to compromise a CPES.

The Problem That Led to It

Knowing who the attacker is (Adversary Model) is useful, but it doesn't explain how they will break into the system. For example, a hacker could attack through fake sensor data, malware, or network traffic. Engineers needed a way to map the attack process itself.

What Problem It Solves

The Attack Model helps engineers:

• Identify possible attack paths.
• Protect vulnerable components.
• Test whether existing security can stop specific attacks.

What Happens If Not Used

Engineers may know an attacker exists but won't know which systems they are most likely to target or how to defend them effectively.

Easy Wording

An Attack Model is a step-by-step plan showing how an attacker could break into a system.

Layman Example

A thief wants to rob a house.

• Adversary Model: Who is the thief? (experienced burglar)
• Attack Model: How will they enter? (through an unlocked window at night)

Technical Example

Before Attack Model

• Identify a hacker as the attacker.
• Deploy the system.
• Unsure how the hacker will attack.

After Attack Model

• Attacker scans the network.
• Finds an unprotected RTU.
• Sends fake commands or false sensor data.
• SCADA receives incorrect information.
• Operators make wrong decisions unless security blocks the attack.

Limitation

An Attack Model lists possible attack methods, but it does not systematically ensure that all categories of threats have been considered.

Solution

The next concept is STRIDE, a threat-modeling framework that provides a checklist of six common threat categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege) so engineers don't overlook important attack types.