Research Concepts

Opis

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Wpisy w tej grupie

• CWE-284 Improper Access Control
• CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities
• CWE-664 Improper Control of a Resource Through its Lifetime
• CWE-682 Incorrect Calculation
• CWE-691 Insufficient Control Flow Management
• CWE-693 Protection Mechanism Failure
• CWE-697 Incorrect Comparison
• CWE-703 Improper Check or Handling of Exceptional Conditions
• CWE-707 Improper Neutralization
• CWE-710 Improper Adherence to Coding Standards

Uwagi

This view uses a deep hierarchical organization, with more levels of abstraction than other classification schemes. The top-level entries are called Pillars. Where possible, this view uses abstractions that do not consider particular languages, frameworks, technologies, life cycle development phases, frequency of occurrence, or types of resources. It explicitly identifies relationships that form chains and composites, which have not been a formal part of past classification efforts. Chains and composites might help explain why mutual exclusivity is difficult to achieve within security error taxonomies. This view is roughly aligned with MITRE's research into vulnerability theory, especially with respect to behaviors and resources. Ideally, this view will only cover weakness-to-weakness relationships, with minimal overlap and zero categories. It is expected to include at least one parent/child relationship for every weakness within CWE.