# Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment
## 3 Results
### Curating Security Guidance from Multiple Knowledge Bases  
We provide a generalisable example of using the extended _TRADES Tool_ to curate security-related information from multiple sources. We discuss the mapping of a specific threat--threat #6 of the United Nations' vehicle cyber security regulation (henceforth: UN-T6) [24]--to CAPEC and ATT&CK information, based on the work by [PERSON] et al. [11]. We selected this particular threat's mapping due to the relatively low number of mappings to CAPEC and ATT&CK (as identified originally by [PERSON] et al. ), which allows us to concisely demonstrate our contribution to representing and improving the mapping, without overloading the reader. Figure 7 shows an extended _TRADES Tool_ representation of the UN-T6 threat element mapping to CAPEC and ATT&CK, based on the mapping by [PERSON] et al. This representation suggests a possible authoring technique to curate security information using the extended _TRADES Tool_. The UN threat (UN-T6) is denoted with a red label, and its mappings to other security knowledge bases appear with red edges. Threat elements and relations derived from CAPEC are denoted with black labels and black edges, respectively. Threat and Control elements and relations derived from CAPEC are denoted with blue labels and blue edges, respectively. UN-T6 maps into two CAPEC attack patterns--\"Adversary in the Middle (AiTM)\" (CAPEC94) and \"Content Spoofing\" (CAPEC148)--and one ATT&CK technique--\"Adversary-in-the-Middle\" (T1557). In [PERSON] et al. 's original mappings of UN threats to ATT&CK, the association of ATT&CK mitigations remains implicit, by their association with the specific ATT&CK techniques that are mapped to each  
Figure 6: A panel from the modelling tool, showing a filtered view with relevant results from the installed catalogues. threat. For UN-T6, the original mapping to ATT&CK T1557 suggests seven mitigations. Using the extended _TRADES Tool_, we explicitly represent these mitigations as security control elements. Figure 7 shows the ATT&CK mitigations as Control elements as well as their mitigation relations to the related ATT&CK-derived threat element. The representation in Figure 7 allows for visual, graph-like navigation of the UN threat (UN-T6) mapping, with each element pointing to a respective model element and allowing the security modeller to receive additional information based on the element's properties (e.g., Figure 3) or links to external references. Such representations can be helpful to communicate the mappings and their use as security guidance. The specific representation of UN-T6 mapping can, for example, raise a question with the viewer/reader as to the possible exploitation of ATT&CK to address the CAPEC Content Spoofing pattern. This gap is not communicated by the original textual/table orientation of the mapping [11]. If one methodically looks into the mapping method then--since the specific CAPEC pattern suggests a mapping to an ATT&CK technique--there should be a mapping between the CAPEC pattern into the relevant ATT&CK technique, and this can possibly lead to some ATT&CK-derived mitigation guidance. Specifically, CAPEC maps \"Content Spoofing\" to ATT&CK's \"Defacement\" (T1491), and ATT&CK associates this technique with a single mitigation: \"Data Backup\" (M1053). Figure 8 shows the expanded mapping. [PERSON] et al. do not explain why \"Content Spoofing\" and, consequently, UN-T6 remain unmapped to  
Figure 7: Mapping of UN-T6 to other knowledge bases, based on [11] and visualised using the extended _TRADES Tool_. the relevant ATT&CK technique and mitigation. A possible explanation may be that the specific ATT&CK technique is deemed irrelevant to the domain of interest (automotive). Figure 8 also suggests a possible methodical improvement of the mapping, by omitting the direct link from UN-T6 to the ATT&CK technique. The representation in the figure stresses that this mapping relies on CAPEC mapping rather than original/user mapping.