# Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment
## 1 Introduction
In comparison, the content of the \"Mitigation\" field of CAPEC techniques remains entirely freeform and in natural language. For example, the CAPEC-122 \"Privilege Abuse\" attack pattern record simply specifies \"_Configure account privileges such privileged/administrator functionality is not exposed to non-privileged/lower accounts_\" as its mitigation. Interestingly, the advised CAPEC-122 mitigation directly corresponds with the M1052 ATT&CK mitigation concept, and indeed, CAPEC-122 suggests mapping onto the ATT&CK T1548 technique which lists M1052 as one of its seven potential mitigations; yet no explicit connection is offered as a collective CAPEC and ATT&CK body of knowledge, attesting to the still somewhat disjointed nature of these two knowledge bases. While CAPEC and ATT&CK are lacking with respect to a well-structured specification of mitigations, NIST SP800-53 is a comprehensive source on security controls that offers structured definitions of security control mechanisms, including hierarchies of mitigation concepts [15]. Furthermore, NIST promotes the well-structuredness of security controls via the Open Security Controls Assessment Language (OSCAL) [16], and the NIST SP800-53 security control knowledge base is offered as an OSCAL-compliant implementation [17]. It is imperative to consider available security knowledge bases when performing threat and risk assessment if we wish to (1) rigorously reason about the security posture of system designs and (2) improve and promote a common understanding of security threats and mitigation mechanisms [4, 5]. We provide a few examples of previous research efforts that exercise security information from the aforementioned knowledge bases. VERDICT employs a specific subset of attack patterns from CAPEC to analyse system designs [18]. [PERSON] used a user-specified set of CAPEC attack patterns to create a generic risk model, which should then be further adapted to a specific target of evaluation [6]. [PERSON] et al. used CAPEC definitions for threat enumeration [2]. [PERSON] et al. constructed a dataset that allows for the training of machine learning models to classify attacks based on the \"_internationally accepted classification_\" of CAPEC [19]. [PERSON] et al. propose a textual threat modelling language based on ATT&CK techniques and mitigations [20]. [PERSON] et al. mapped ATT&CK mitigations to cyber security dimensions and domains in an attempt to promote the use of the ATT&CK knowledge base for security assessment and defensive design [21]. [PERSON] et al. used metadata from CAPEC attack patterns as well as ATT&CK mitigationsto generate attack graphs [22]. [PERSON] et al. relied on NIST SP800-53's definitions of security controls to compose security policies and perform security analysis [12]. [PERSON] et al. integrated information from multiple sources--including CAPEC and ATT&CK--into an attack database for a specific application domain (automative), with the intention of promoting _\"a common understanding of attack techniques...and possible mitigations\"_[11]. [PERSON] et al. propose an ontology-based approach to automate aspects of cybersecurity risk assessment, using CAPEC attack patterns as a catalogue of threats [5]. Of the surveyed approaches that refer to the public-domain knowledge bases, only VERDICT is supported by an open-source modelling environment. The VERDICT modelling environment embeds a specific subset of CAPEC information as a hard-coded attack patterns taxonomy, which is inaccessible to the user and cannot be adapted from a user perspective [18]. [PERSON] reports developing a _\"proof of concept tool\"_--which remains unavailable--for translating CAPEC attack patterns into a general risk model [6]. [PERSON] et al. report developing a supporting prototype tool [12]. Their tool, however, is no longer available, and it is unclear from the article as to whether the NIST security controls definitions were embedded in the tool and to what extent. [PERSON] et al.