The Use of Attack and Protection Trees to Analyze Security for an Online Banking System

Online banking has become increasingly important to the profitability of financial institutions as well as adding convenience for their customers. As the number of customers using online banking increases, online banking systems are becoming more desirable targets for criminals to attack. To maintain their customers’ trust and confidence in the security of their online bank accounts, financial institutions must identify how attackers compromise accounts and develop methods to protect them. Attack trees and protection trees are a cost effective way to do this. Attack trees highlight the weaknesses in a system and protection trees provide a methodical means of mitigating these weaknesses. In this paper, a notional online banking system is analyzed and protection solutions are proposed for varying budgets.

• Type: Conference
• Year: 2007
• Where: HICSS
• Authors: Kenneth S. Edge, Richard A. Raines, Michael R. Grimaila, Rusty O. Baldwin, Robert W. Bennington, Christopher E. Reuter
• Keywords: Attack Trees, Biometrics, HICSS 2007, Online Banking, Protection Trees, System Sciences