# Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment
## 1 Introduction  
Threat modelling, alternatively security threat and risk assessment, _\"works to identify, communicate, and understand threats and mitigations within the context of protecting something of value\"_[1]. Threat modelling is crucial to understanding and communicating the security posture of systems, as well as being crucial to designing the security aspects of systems [2; 3; 4; 5]. Threat modelling typically involves manual effort, as it is a creative process which requires applying knowledge and information to analyse a system of interest [4; 6]. The systematic use of the available security body of knowledge can not only assist threat modelling but also contribute to the quality of the resulting artefacts [4]. TRADES (Threat and Risk Assessment for Design of Engineered Systems) is an established model-based methodology to support systems' security design and assessment, supported by an open-source tool implementation, _TRADES Tool_[7; 8]. In this paper, we focus on the integration of pertinent information from existing and evolving public-domain security knowledge bases. Specifically, the information of interest is information relating to two important concepts in threat and risk assessment: (1) _threat_, or alternatively _attack_, which is a potential action that could compromise a system or its constituents [3; 4; 5; 9; 10; 11; 12; 13], and (2) _security control_, or, alternatively, _mitigation_, which is a concept that can prevent the successful materialisation of a threat [4; 10; 11; 12; 13]. We next discuss the public-domain knowledge bases that can be used while modelling instances of these concepts as part of a security threat and risk assessment. The MITRE organisation offers two distinct repositories--following two different approaches--in support of security risk assessment. Common Attack Pattern Enumerationand Classification (CAPEC) focuses on application security and includes sociotechnical/non-technical aspects such as social engineering and supply chains [14]. CAPEC enumerates techniques that can be employed by adversaries to exploit weaknesses in cyber-enabled capabilities. As such, it allows for a high-level analysis of systems security. Adversarial Tactics, Techniques and Common Knowledge (ATT&CK), on the other hand, focuses on network defence. ATT&CK typically offers lower-level techniques (compared with CAPEC) that may be used to detail some CAPEC techniques. CAPEC is the approach recommended by MITRE for application threat modelling and educating system developers, which are the primary concerns of our work reported in this article. Both CAPEC and ATT&CK offer structured records of each attack pattern/technique, with some enumerations and relations to other records (of the CAPEC and ATT&CK knowledge bases) as well as natural language descriptions. Specifically, information regarding the potential mitigation mechanisms remains somewhat lacking. In ATT&CK, proposed mitigations are semi-structured, featuring metadata as well as natural language descriptions. For example, the \"User Account Control\" mitigation record has a unique ID--\"M1052\"--and the natural language description says \"_Configure Windows User Account Control to mitigate risk of adversaries obtaining elevated process access_\". Furthermore, the use of the mitigations within the context of ATT&CK techniques records is--in fact--a natural language description that provides additional mitigation guidance. For example, in the ATT&CK \"Abuse Elevation Control Mechanism\" technique (ID: T1548), the aforementioned \"User Account Control\" (ID: M1052) mitigation is identified, with the \"Description\" field offering a description tailored to the T1548 technique: \"_Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking_\" (abbreviations appear in the original description).