Architectural Concepts

Opis

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Wpisy w tej grupie

• CWE-1009 Audit
• CWE-1010 Authenticate Actors
• CWE-1011 Authorize Actors
• CWE-1012 Cross Cutting
• CWE-1013 Encrypt Data
• CWE-1014 Identify Actors
• CWE-1015 Limit Access
• CWE-1016 Limit Exposure
• CWE-1017 Lock Computer
• CWE-1018 Manage User Sessions
• CWE-1019 Validate Inputs
• CWE-1020 Verify Message Integrity

Uwagi

The top level categories in this view represent the individual tactics that are part of a secure-by-design approach to software development. The weaknesses that are members of each category contain information about how each is introduced relative to the software's architecture. Three different modes of introduction are used: Omission - caused by missing a security tactic when it is necessary. Commission - refers to incorrect choice of tactics which could result in undesirable consequences. Realization - appropriate security tactics are adopted but are incorrectly implemented.

Źródła