A Holistic Approach to Security Attack Modeling and Analysis ∗

Abstract. Protecting socio-technical systems is a challenging task, as a single vulnerability or exposure of any component of the systems can lead to serious security breaches. This problem is exacerbated by the fact that the system development community has not kept up with advances in attack tactics. In this paper, we present ongoing research on the de-velopment of a holistic attack analysis technique. Our approach adopts a goal modeling technique to capture attacker malicious intention as anti-goals, which are systematically refined and operationalized into con-crete attack actions which target various assets (e.g., human, software, and hardware). A comprehensive attack pattern repository (CAPEC) is seamlessly integrated into our approach in order to provide analysts with practical security knowledge and assist them in identifying poten-tial attacks under specific contexts. Finally, a set of security controls is provided for mitigating identified attacks.