Resilience design using the Challenge Countermeasure Tree (CCT) model

Graphical models are powerful tools for risk analysis and decision-making support. In this paper, we introduce an extension of the attack tree model that integrates countermeasures into its nodes. We name it CCT: “Challenge Countermeasure Tree”. Challenges involve both accidental failures and intentional attacks. The CCT model distinguishes between three classes of countermeasures: (i) prevention to reduce the probability of occurrence of a challenge; (ii) mitigation to reduce its impact; (iii) recovery to return (bounce back) to normal operation. This explicit differentiation improves the selection process of the optimal set of countermeasures during resilience design. We illustrate the features of CCT using a case study.