For those that deal with attack trees/graphs in #infosec, how much weight do you put into probability? To me, human probability is an arbitrary and unnecessary metric.
Am I wrong to think that human probability (e.g., skill set, demographic, likelihood of successful compromise) is far too random to be considered in a tabletop attack tree variable?
I'm trying to determine why this is a common thing.
Attended a great talk by @shortridge regarding Security Chaos Engineering and its concepts in #infosec.
Kelly's presentations are always interesting and engaging, and I highly recommend attending one if you can.
SCE is on pre-order. Further reading that can be complimentary to SCE: "Sludge for Good: Slowing and Imposing Costs on
Cyber Attackers": https://arxiv.org/pdf/2211.16626.pdf
While we employ similar concepts to our work, it is always beneficial to see how others are accomplishing similar goals.