# Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment
## 4 Discussion  
Threat and risk assessment is a creative effort that should rely on the available security body of knowledge. While threat and risk assessment is likely to remain manual--at least to some extent--due to its creative nature, utilising existing security knowledge bases can contribute to its systemisation and rigour. In this work, we provide an extended security modelling environment. This environment can incorporate and integrate information from multiple security knowledge bases. Specifically, catalogues of threats and security controls are automatically derived from three knowledge bases: CAPEC, ATT&CK and NIST SP800-53. These catalogues are made available within the _TRADES Tool_ security modelling environment. Relations between elements imported from these catalogues can be established and their mappings can be visually represented. The extended _TRADES Tool_ modelling environment and the model transformations that generate catalogues are available as open-source solutions, addressing an existing gap [11]. Two complementary aspects of the tools being open are: (1) allowing for extension and updating of information from the available, supported knowledge bases. This can be performed at the user level in a way that accommodates revisions in the knowledge bases; and (2) allowing for adapting and extending the use of knowledge bases within the modelling environment. This can be performed at the organisation/developer level. We have provided a highly generalisable example of using the modelling environment to integrate and enhance the use of security knowledge bases. By carefully curating and investigating information from knowledge bases, users--typically security specialists, security analysts or security engineers--can compose domain-specific/organisation-specific security guidance and policies. We have demonstrated how the modelling environment can support this as well as how this can be communicated graphically using the tool. Specifically, any derived, tailored or integrated organisational/domain guidance can be differentiated from the more general, public-domain body of knowledge. Still, the relations between the specific guidance and the body of knowledge allow for impact analysis as a result of changes in the integrated knowledge bases. Further adaptations of the tool's representations can be developed by practitioners, accommodating specific needs. Future research can also provide adaptations, exploring how well-structured security models can be effectively composed and communicated. While our efforts to translate information from existing knowledge bases into _TRADES Tool_ were successful, we identified a lack of a standardised form for security knowledge bases as a gap that future work can address. NIST's OSCAL is a step forward in the standardisation of security controls, yet ATT&CK mitigations are not officially available in OSCAL form. Also, while CAPEC patterns are available as a self-contained XML file, ATT&CK information is not. Future efforts may seek to provide a standardised form for attack patterns, techniques and mitigations. The rigorous, ontology and model-based approach that underpins _TRADES Tool_--and allows one to correlate threats with controls--can provide a preliminary direction for such efforts, possibly in tandem with the design of a formal ontology [5, 13]. Future work may incorporate additional knowledge bases into _TRADES Tool_ in an integrative form. For example, _TRADES Tool_'s underlying methodology is currently being expanded to support vulnerability management, and this can facilitate the integration with MITRE's Common Weakness Enumeration knowledge base. Furthermore, if practiced extensively, TRADES models that integrate and extend various knowledge bases can be used for mining and contributing new security insights--such as a definitive mapping of NIST security controls to CAPEC/ATT&CK or relations between threats in various levels of abstraction. TRADES-based threat modelling can, therefore, contribute to elaborating the codified security body of knowledge.