ICS Dependencies (& Architecture): External Digital Systems

Opis

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Wpisy w tej grupie

• CWE-15 External Control of System or Configuration Setting
• CWE-287 Improper Authentication
• CWE-306 Missing Authentication for Critical Function
• CWE-308 Use of Single-factor Authentication
• CWE-312 Cleartext Storage of Sensitive Information
• CWE-440 Expected Behavior Violation
• CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
• CWE-603 Use of Client-Side Authentication
• CWE-610 Externally Controlled Reference to a Resource in Another Sphere
• CWE-638 Not Using Complete Mediation
• CWE-1059 Insufficient Technical Documentation
• CWE-1068 Inconsistency Between Implementation and Documented Design
• CWE-1104 Use of Unmaintained Third Party Components
• CWE-1329 Reliance on Component That is Not Updateable
• CWE-1357 Reliance on Insufficiently Trustworthy Component
• CWE-1393 Use of Default Password

Uwagi

Relationships in this category are not authoritative and subject to change. See Maintenance notes.

This category was created in CWE 4.7 to facilitate and illuminate discussion about weaknesses in ICS with [REF-1248] as a starting point. After the release of CWE 4.9 in October 2022, this has been under active review by members of the "Boosting CWE" subgroup of the CWE-CAPEC ICS/OT Special Interest Group (SIG). Relationships are still subject to change. In addition, there may be some issues in [REF-1248] that are outside of the current scope of CWE, which will require consultation with many CWE stakeholders to resolve.

Źródła