Comprehensive Categorization for Software Assurance Trends

A view in the Common Weakness Enumeration published by The MITRE Corporation.


Objective

Views in the Common Weakness Enumeration (CWE) represent one perspective with which to consider a set of weaknesses.

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown.

Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis.

Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Target Audience

Academic Researchers

Researchers can use this view to evaluate the breadth and depth of software assurance with respect to mitigating and managing weaknesses before they become vulnerabilities.

Categories

Comprehensive Categorization: Access Control

Weaknesses in this category are related to access control.

Comprehensive Categorization: Comparison

Weaknesses in this category are related to comparison.

Comprehensive Categorization: Component Interaction

Weaknesses in this category are related to component interaction.

Comprehensive Categorization: Concurrency

Weaknesses in this category are related to concurrency.

Comprehensive Categorization: Encryption

Weaknesses in this category are related to encryption.

Comprehensive Categorization: Exposed Resource

Weaknesses in this category are related to exposed resource.

Comprehensive Categorization: File Handling

Weaknesses in this category are related to file handling.

Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Comprehensive Categorization: Improper Input Validation

Weaknesses in this category are related to improper input validation.

Comprehensive Categorization: Improper Neutralization

Weaknesses in this category are related to improper neutralization.

Comprehensive Categorization: Incorrect Calculation

Weaknesses in this category are related to incorrect calculation.

Comprehensive Categorization: Injection

Weaknesses in this category are related to injection.

Comprehensive Categorization: Insufficient Control Flow Management

Weaknesses in this category are related to insufficient control flow management.

Comprehensive Categorization: Insufficient Verification of Data Authenticity

Weaknesses in this category are related to insufficient verification of data authenticity.

Comprehensive Categorization: Memory Safety

Weaknesses in this category are related to memory safety.

Comprehensive Categorization: Poor Coding Practices

Weaknesses in this category are related to poor coding practices.

Comprehensive Categorization: Protection Mechanism Failure

Weaknesses in this category are related to protection mechanism failure.

Comprehensive Categorization: Randomness

Weaknesses in this category are related to randomness.

Comprehensive Categorization: Resource Control

Weaknesses in this category are related to resource control.

Comprehensive Categorization: Resource Lifecycle Management

Weaknesses in this category are related to resource lifecycle management.

Comprehensive Categorization: Sensitive Information Exposure

Weaknesses in this category are related to sensitive information exposure.

Comprehensive Categorization: Violation of Secure Design Principles

Weaknesses in this category are related to violation of secure design principles.


Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.