Defence trees and CP-net (ceteris paribus network) are two useful approaches that can be used to help a system administrator to analyze a security scenario and to give him a model to represent preferences among attacks and countermeasures in order to select the best set of countermeasures need to stop all the vulnerabilities. However, for complex trees, the use of CP-nets could be not always effective. To overcome these limitations in this paper we use an Answer Set Optimization (ASO) program. Using ASO the best defence strategy for a scenario is obtained by computing the optimal answer set of the corresponding ASO program. An extended version of this paper with an implementation part was submitted to CP 2007 technical program3 .