Attack-Defence Tree

Attack-Defence Tree (ADT) is an extension of Attack Trees that integrates defence measures into the decision-making framework. Each attack node in the tree can be paired with a corresponding defence node, allowing for a simultaneous evaluation of offensive capabilities and defensive countermeasures. This methodology is particularly relevant under ISO/SAE 21434 and NIST 800-160 standards, which require systematic threat-and-risk assessment (TARA). Unlike traditional threat modelling, ADT provides a structured way to evaluate the cost-effectiveness of security controls, making it a critical tool for both technical engineers and risk managers. It enables the identification of critical attack paths where defence is most needed, ensuring that security investments are both targeted and justifiable to stakeholders.

In practice, ADT application follows a three-step cycle: Threat-Defence Mapping, Cost-Benefit Analysis, and Risk-Adjusted Mitigation. First, using the ISO/SAE 21434 TARA process, enterprises map attack paths against existing or planned defence measures. Second, each attack path is assigned a cost-to-execute, and each defence is assigned a cost-to-implement. This allows for a quantitative comparison: if an attack path has a low cost and high impact, but the defence cost is disproportionately high, the enterprise may opt for alternative mitigations. Third, the ADT is used to validate the residual risk-adjusted by the implemented controls. For example, a Tier-1 supplier in Taiwan could use ADT to justify the cost of a Hardware Security Module (HSM) by demonstrating the reduction in attack-path profitability by 70%, directly addressing the requirements of UNECE WP.29 R155.

Taiwanese enterprises typically face three challenges: technical expertise gaps, lack of quantitative tools, and regulatory fragmentation. Many SMEs lack the specialised skills to build accurate ADTs, often relying on qualitative 'high/medium/low' ratings which lack legal weight in audits. To overcome this, companies should adopt standardized frameworks like CVSS v3.1 for attack scoring and COBIT 2019 for governance alignment. Secondly, the absence of historical attack data makes cost-benefit analysis difficult; enterprises can be closely closely correlated with industry-wide threat intelligence-sharing platforms like Auto-ISAC. Finally, the pressure to be both TISAX-compliant for European OEMs and compliant with Taiwan's Personal Data Protection Act (GDPR-like) requires a unified ADT approach. A phased implementation—starting with one critical ECU and expanding to the full vehicle architecture over 12 months—is the most effective way to manage these challenges.

Winners Consulting Services Co., Ltd. specializes in Attack-Defence Tree for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact