Results 1 to 7 of 7
  1. #1
    Hank Cohen is offline Novice
    Windows 10 Office 365
    Join Date
    Jul 2021
    Posts
    5

    Attack Trees: Can Access help?

    I am writing an application to assist with security assessments.
    It uses Access to manage the various data objects used: assets, threats, attack scenarios, etc.


    The threat and risk assessment computations are pretty simple but there is one aspect that seems hard to structure in a relational database.

    Attack Trees. Attack trees are used to evaluate the cost and likelihood of an attack being successful.
    For a more detailed description Bruce Schneier has an excellent blog post. https://www.schneier.com/academic/ar...ack_trees.html

    The attack tree consists of nodes representing stages of the attack where the root of the tree is a successful attack.
    Subtrees are used to decompose the attack into various possibilities.
    Schneier's paper presents an attck tree for opening a safe.
    The root node says open safe,
    Under that are nodes describing how it might be done.
    Subtrees can be AND nodes or OR nodes. AND notes are list of requirements where all of the elements must be met to succeed. OR nodes list alternatives where any one of the list is sufficient for success.

    1. Open Safe
    1.1 Pick Lock
    1.2 Learn Combination
    1.2.1 Find Written Combo
    1.2.2 Get combo from target
    1.2.2.1 Threaten
    1.2.2.2 Blackmail
    1.2.2.3 Eavesdrop
    1.2.2.4 Bribe
    1.3 Cut open safe
    1.4 Install Improperly

    I have all of the elements of the attack tree stored in my database but I don't see how one would store the tree itself.
    Storing trees as linked lists is straightforward in most languages. What I am asking, is there is a way to store this kind of structure in a relational database?

    If I build the structures using VBA modules then I will need to figure out how to store them. XML or JSON would do the trick I guess.

    Any thoughts would be greatly appreciated.

    Hank Cohen

    Ooo! does Access support recursive SQL?

  2. #2
    June7's Avatar
    June7 is offline VIP
    Windows 10 Access 2010 32bit
    Join Date
    May 2011
    Location
    The Great Land
    Posts
    52,815
    No, Access does not support recursive SQL.

    Maybe you want to use an ActiveX TreeView control to display this data and interact with it.

    I have built only one for the experience and it wasn't simple. I have no idea how to handle the "AND" and "OR" conditions.
    How to attach file: http://www.accessforums.net/showthread.php?t=70301 To provide db: copy, remove confidential data, run compact & repair, zip w/Windows Compression.

  3. #3
    Minty is online now VIP
    Windows 10 Office 365
    Join Date
    Sep 2017
    Location
    UK - Wiltshire
    Posts
    3,001
    I would have a read here https://www.access-programmers.co.uk...2#post-1761252
    The main repsonder (MajP) does a lot with recursive functions and treeview type functions.

    Have a search for related posts to that one and see if it helps.

    I wouldn't use the Active X tree view, it won't work on 64-Bit office. There are VBA written examples that don't require the external components/libraries.
    DLookup Syntax and others http://access.mvps.org/access/general/gen0018.htm
    Please use the star below the post to say thanks if we have helped !
    ↓↓ It's down here ↓↓

  4. #4
    Hank Cohen is offline Novice
    Windows 10 Office 365
    Join Date
    Jul 2021
    Posts
    5
    June7, Thanks its what I expected. Recursive SQL seems like the domain of big databases and given my lack of expertise it would probably be beyond me anyway.
    Handling the AND and OR conditions is really what its all about.
    Fortunately, I have found a tool designed for the purpose. https://satoss.uni.lu/members/piotr/adtool/
    We'll just have to transfer the Access table data by hand.

    Hank

  5. #5
    CJ_London is offline VIP
    Windows 10 Access 2010 32bit
    Join Date
    Mar 2015
    Posts
    11,397
    Or use sql server express as a back end - its free and will support recursive queries.

    With regards the tree itself, this is accomplished through tables (not lists) and relationships together with vba logic

  6. #6
    pbaldy's Avatar
    pbaldy is offline Who is John Galt?
    Windows XP Access 2007
    Join Date
    Feb 2010
    Location
    Nevada, USA
    Posts
    22,518
    Post 4 was moderated, I'm posting to trigger email notifications.
    Paul (wino moderator)
    MS Access MVP 2007-2019
    www.BaldyWeb.com

  7. #7
    Hank Cohen is offline Novice
    Windows 10 Office 365
    Join Date
    Jul 2021
    Posts
    5
    I think recursive SQL is overkill for this application.
    We are just trying to automate parts of a process that is usually done by hand.
    Access is great for those parts that fit the relational model but the Attack Tree stuff is not a natural fit.

Please reply to this thread with any new information or opinions.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Other Forums: Microsoft Office Forums