From ATT&CKcon 4.0 By Jeremy Straub, NDSU Cybersecurity Institute This presentation will briefly summarize work that we've done regarding implementing the ATT&CK framework as a rule-fact-action network within a Blackboard Architecture, allowing the ATT&CK framework to enable security testing automation. The presentation will start with a quick summary of the concept behind this and then present a few implementation examples.

1. Automating testing by
implementing ATT&CK using
the Blackboard Architecture
Jeremy Straub
Cybersecurity Institute
North Dakota State University
Background images from Shutterstock throughout presentation

2. What is the Blackboard
Architecture?
• First introduced by Hayes-Roth in the late
1970s, expanded/enhanced since then
• Expansion of the rule-fact expert system
concept
• Adds actualization capability with actions
• Multiple ways of implementing the concept
Figure from: J. Straub. A modern Blackboard Architecture implementation
with external command execution capability. Software Impacts, Vol. 11

3. Implementing ATT&CK in the Blackboard Architecture
• Models components of phases using the rule-fact logic
• Modeling can include tactics and techniques (and mitigations, etc.)
• Can implement different levels of granularity and include abstraction
• Figure shows implementation based on ATT&CK, Lockheed Martin CKC and similar
Figure from: J. Straub. Modeling Attack, Defense and Threat Trees and the Cyber Kill Chain, ATT&CK and STRIDE
Frameworks as Blackboard Architecture Networks. IEEE International Conference on Smart Cloud, 2020.