What are OR nodes and AND nodes in Attack Trees?

OR = alternative paths (any one suffices); AND = required steps (all must be done). To defend an OR you must block every branch; to defend an AND you only block one.

* An OR gate is satisfied by any one branch; an AND gate needs every branch — the house-entry example from the card. *

OR nodes = Different ways to achieve the same goal (alternatives)

• Example: To break into a house you can pick the door lock OR break a window
• Attacker only needs ONE path to succeed

AND nodes = Different steps ALL required to achieve a goal

• Example: To enter through a window you need to break the window AND climb through
• Attacker must complete ALL steps

Visual notation: AND nodes often shown with an arc connecting the branches.

Security implication: Defending OR nodes requires blocking ALL alternatives. Defending AND nodes only requires blocking ONE step.