Diagrammatical framework for information system attacks

The input-process-output (IPO) model has been used in many interdisciplinary applications to convey systems fundamentals, as exemplified in abstract diagramming of attacks on information systems. The resulting IPO-based diagram can provide a framework for identifying points of potential security concern and to develop protection strategies. This paper introduces an alternative diagramming representation based on the notion of flow. It is shown that this flow-based methodology is general and complete for analyzing and categorizing attacks.