CWE - News & Events - 2010 Archive

CWE Version 1.11 has been posted on the CWE List page. A detailed report is available that lists specific changes between Version 1.10 and Version 1.11.

The main changes include: (1) creation of 7 new entries, mostly for race conditions and "functionality inclusion" issues; (2) deprecation of one entry; (3) changes in the names of 26 entries, and descriptions of 40 entries; (4) modified mitigations for 20 entries, primarily to further normalize the mitigations in the Top 25; (5) updates to relationships for 35 entries, primarily for sub-tree reorganization for race conditions; (6) updates to the demonstrative examples in 23 entries; and (7) major changes to 135 entries.

PDF documents have been updated to display graphs of views such as the Research View (CWE-1000) and the Development View (CWE-699), and a "Printable CWE" document lists all of the entries in CWE.

Future updates will be noted here and on the CWE Researcher email discussion list. Please send any comments or concerns to cwe@mitre.org.

The white paper introduces the CWSS effort and explains how it can be used for assessing and prioritizing possible software architecture, design, code, and implementation weaknesses that "might be introduced into an application, which in some cases can contribute to a vulnerability within that software ... For example, a buffer overflow vulnerability might arise from a weakness in which the programmer does not properly validate the length of an input buffer. This weakness only contributes to a vulnerability if the input buffer can be influenced by a malicious party, and the malicious buffer is copied to a smaller buffer." In addition to helping developers score the severity of weaknesses, CWSS also provides a way for software consumers to "know what they should worry about the most, and what to ask for to get a more secure product from their vendors and suppliers."

Topics discussed in the white paper include CWSS's six primary stakeholders; design considerations for the framework and metrics; various scoring methods that might need to be supported; introduction of CWSS's "Vignette" concept, which is a "shareable, formalized way to define a particular environment, the role that software plays within that environment, and its priorities with respect to software security"; a CWSS Version 0.1 scoring list; considerations for CWSS beyond Version 0.1; additional scoring factors; activities for future versions; and ways the community can participate.

The majority of the development and refinement of the first major version of CWSS is expected to occur in 2011. We encourage members of the community to review the white paper and send feedback to cwss@mitre.org.

CAPEC/CWE/MAEC Briefings at DHS/DoD/NIST SwA Working Group Meeting, December 14-16

CWE/CAPEC Program Manager Robert A. Martin will present a briefing about CWE, CWE/CAPEC Co-Founder and Architect Sean Barnum will present a briefing about CAPEC, and MAEC Program Manager Penny Chase will present a briefing about MAEC to the DHS/DoD SwA Working Group Meeting Session on December 14-16, 2010 at MITRE Corporation in McLean, Virginia, USA.

CWE/CAPEC Program Manager Robert A. Martin participated on a discussion panel about Software Assurance at CIP Congress on November 30- December 2, 2010 in Washington, D.C., USA.

New ISO/IEC Report Lists the 51 Most Common Vulnerabilities in Programming Languages

According to the report, programming language vulnerabilities should especially be avoided "in the development of systems where assured behaviour is required for security, safety, mission critical and business critical software. In general, this guidance is applicable to the software developed, reviewed, or maintained for any application." The report explains that the vulnerabilities occur in programming languages due to issues arising from incomplete or evolving language specifications, human cognitive limitations, lack of predictable execution, lack of portability and interoperability, inadequate language intrinsic support, and language features prone to erroneous use.

All of the vulnerabilities are documented in a standardized, language-independent format that allows readers to quickly comprehend and utilize the information. The report also provides standardized templates for the community to use when a new programming language vulnerability and/or resulting application vulnerability is identified.

No one language contains all of the vulnerabilities described in the report, but most are very common. Of the programming language and application vulnerabilities detailed in the report, 17 are also on the 2010 CWE/SANS Top 25 Most Dangerous Software Errors list. Future editions of the report will cover the remainder of the Top 25, any additional programming language and application vulnerabilities found in follow-on work, and annexes that apply the general guidance to particular programming languages.

CWE and Making Security Measurable Panel Presentation at Rethinking Cyber Security: A Systems-Based Approach Conference

CWE and Making Security Measurable Panel Presentation at Rethinking Cyber Security: A Systems-Based Approach Conference, November 16

CWE/CAPEC/MAEC Panel Discussion at 11th Annual Security Conference, November 17

CWE/CAPEC Program Manager Robert A. Martin will participate on a discussion panel about Software Assurance at CIP Congress on November 30-December 2, 2010 in Washington, D.C., USA.

CWE/CAPEC Program Manager Robert A. Martin presented a briefing about Software Assurance and the Malware Attribute Enumeration and Characterization (MAEC) Initiative at SC World Congress on November 10-11, 2010 in New York, New York, USA.

CWE/SANS Top 25 Keynote Presentation at Software Test Professionals Conference 2010

CWE/CAPEC Program Manager Robert A. Martin presented a briefing about Software Assurance and the Malware Attribute Enumeration and Characterization (MAEC) Initiative at CSI Annual Conference on October 28, 2010 in National Harbor, Maryland, USA.

CWE/SANS Top 25 Keynote Presentation at Software Test Professionals Conference 2010, October 21

CWE/CAPEC Program Manager Robert A. Martin will present a briefing about Software Assurance and the Malware Attribute Enumeration and Characterization (MAEC) Initiative at CSI Annual Conference on October 28, 2010 in National Harbor, Maryland, USA.

CWE/CAPEC/MAEC and Making Security Measurable Briefings at DHS/DoD/NIST SwA Forum

CWE Briefing and Making Security Measurable Booth at IT Security Automation Conference 2010

CWE Version 1.10 has been posted on the CWE List page. A detailed report is available that lists specific changes between Version 1.9 and Version 1.10.

The main changes include: (1) creation of 7 new entries, mostly for synchronization and "memory safety" issues; (2) small changes in the names of 9 entries, and descriptions of 15 entries, primarily to reflect enhancements to CWE's vocabulary; (3) modified mitigations for 34 entries, primarily to further normalize the mitigations in the Top 25; (4) updates to 43 relationships, primarily for sub-tree reorganization for synchronization and memory safety; and (6) major changes to 91 entries.

PDF documents have been updated to display graphs of views such as the Research View (CWE-1000) and the Development View (CWE-699), and a "Printable CWE" document lists all of the entries in CWE.

Future updates will be noted here and on the CWE Researcher email discussion list. Please send any comments or concerns to cwe@mitre.org.

CWE/CAPEC/MAEC and Making Security Measurable Briefings at DHS/DoD/NIST SwA Forum

Symantec declared that its Secure Development Lifecycle Process is CWE-Compatible. For additional information about this and other compatible products, visit the CWE Compatibility and Effectiveness section.

CWE Briefing and Making Security Measurable Booth at IT Security Automation Conference 2010, September 27-29

CWE/CAPEC/MAEC and Making Security Measurable Briefings at DHS/DoD/NIST SwA Forum, September 27-October 1

CWE/CAPEC Program Manager Robert A. Martin is scheduled to present briefings about CWE and Making Security Measurable, CAPEC/CWE Co-Founder and Architect Sean Barnum is scheduled to present a briefing about CAPEC, and MAEC Program Manager Penny Chase will present a briefing about MAEC to the DHS/DoD/NIST SwA Forum on September 27-October 1, 2010 at the U.S. National Institute of Standards and Technology (NIST) in Gaithersburg, Maryland, USA.

Discussion Panel and Making Security Measurable Booth at HSNI 2010, September 20-21

CWE/CAPEC/MAEC and Making Security Measurable Briefing at GFIRST National Conference

CWE participated in a Making Security Measurable booth at Black Hat Briefings 2010 on July 28-29, 2010 at Caesars Palace Las Vegas in Las Vegas, Nevada, USA. Attendees learned how information security data standards facilitate both effective security process coordination and the use of automation to assess, manage, and improve the security posture of enterprise security information infrastructures.

The name of the Top 25 list has been changed to the "2010 CWE/SANS Top 25 Most Dangerous Software Errors." The word "Programming" was changed to "Software" in order to more accurately describe the content of the list.

CWE Version 1.9 has been posted on the CWE List page. A detailed report is available that lists specific changes between Version 1.8.1 and Version 1.9.

The main changes include: (1) creation of 11 entries for a new view (CWE-809) of the OWASP 2010 Top Ten; (2) small changes in the names of 22 entries, and descriptions of 55 entries, primarily to reflect enhancements to CWE's vocabulary; (3) modified mitigations for 89 entries, primarily to make the wording more consistent; (4) additions or improvements to demonstrative examples for 23 entries; (5) addition of references to each 2010 Top 25 entry; and (6) major changes to 155 entries.

The schema definition was updated from version 4.4.1 to 4.4.2, to reflect some changes to the Consequence_Technical_Impact element.

PDF documents have been updated to display graphs of views such as the Research View (CWE-1000) and the Development View (CWE-699), and a "Printable CWE" document lists all of the entries in CWE.

Future updates will be noted here and on the CWE Researcher email discussion list. Please send any comments or concerns to cwe@mitre.org.

CWE/CAPEC/MAEC Briefings at DHS/DoD SwA Working Group Meeting Session, June 21-23

CWE Team Member Conor Harris presented a briefing about CWE, CWE/CAPEC Co-Founder and Architect Sean Barnum presented a briefing about CAPEC, MAEC Program Manager Penny Chase presented a briefing about MAEC, CWE Technical Lead Steve Christey presented a briefing about the Common Weakness Scoring System (CWSS) and Pocket Guides, and CWE/CAPEC Program Manager Robert A. Martin presented a briefing about Software Assurance Automation Protocol (SwAAP) at the DHS/DoD SwA Working Group Meeting Session on June 21-23, 2010 in Balston, Virginia, USA.

CWE/CAPEC Co-Founder and Architect Sean Barnum presented CWE and CAPEC briefings and MAEC Program Manager Penny Chase presented a briefing about MAEC at MITRE's Security Automation Developer Days 2010 on June 16, 2010 at MITRE in Bedford, Massachusetts, USA.

The main purpose of the three-day conference, held June 14-16, was for the information security community to discuss current and emerging Security Content Automation Protocol (SCAP) standards in technical detail and to derive solutions that benefit all concerned parties.

Making Security Measurable Briefing at Seventh Biennial Multinational Operations Conference

MITRE hosted a Making Security Measurable booth at MIS Training Institute's (MISTI) InfoSec World Conference & Expo 2010 at the Disney Coronado Springs Resort, in Orlando, Florida, USA, on April 19-21, 2010. Attendees learned how information security data standards facilitate both effective security process coordination and the use of automation to assess, manage, and improve the security posture of enterprise security information infrastructures.

CWE Version 1.8.1 has been posted on the CWE List page. This is a minor release that does not contain any new CWE entries or critical changes. A detailed report is available that lists specific changes between Version 1.8 and Version 1.8.1.

Changes for the new release include: (1) updated CAPEC mappings for 50 entries; (2) small changes in the names of 28 entries, reflecting enhancements to CWE's vocabulary; (3) improvements to descriptions for 30 entries; (4) additions or improvements to demonstrative examples for 24 entries; (5) additions or improvements to potential mitigations for 17 entries; and (6) major changes to 105 entries.

There are no new or deprecated CWE entries, and there are no modifications to the schema. PDF documents have been updated to display graphs of views such as the Research View (CWE-1000) and the Development View (CWE-699), and a "Printable CWE" document lists all of the entries in CWE.

In addition, the 2010 CWE/SANS Top 25 has been updated to reflect the changes in CWE content.

Future updates will be noted here and on the CWE Researcher email discussion list. Please send any comments or concerns to cwe@mitre.org.

MITRE to Host "Making Security Measurable" Booth at InfoSec World 2010, April 19-21

MITRE is scheduled to host a Making Security Measurable booth at MIS Training Institute's (MISTI) InfoSec World Conference & Expo 2010 at the Disney Coronado Springs Resort, in Orlando, Florida, USA, on April 19-21, 2010. Please stop by booth 319 and say hello!

CWE/CAPEC Panel Discussion and CVE Briefing at SOURCE Boston Conference, April 21-23

CWE/CAPEC Program Manager Robert A. Martin and CWE Technical Lead Steve Christey are scheduled to participate on a panel discussion about vulnerability management, and Christey is scheduled to present a briefing about the last 10 years of Common Vulnerabilities and Exposures (CVE), at SOURCE Boston Conference on April 21-23, 2010 in Boston, Massachusetts, USA.

CWE/CAPEC Program Manager Robert A. Martin presented a briefing about CWE and Common Attack Pattern Enumeration and Classification (CAPEC) at GovSec/FOSE on March 23-24, 2010 in Washington, D.C., USA.

MITRE hosted a Making Security Measurable booth at RSA 2010 at the Moscone Center in San Francisco, California, USA, on March 1-5, 2010. See photos below:

CWE and the SANS Institute posted the completed 2010 CWE/SANS Top 25 Programming Errors on the CWE and SANS Web sites on February 16, 2010. A collaboration between the SANS Institute, MITRE, and over 40 top software security experts in the U.S. and Europe, the list provides detailed descriptions of the top 25 programming errors along with authoritative guidance for mitigating and avoiding them.

Top 25 Most Dangerous Programming Errors Revealed, InformationWeek, February 16, 2010
Hold vendors liable for buggy software, group says, Computerworld, February 16, 2010
Top 25 Programming Errors Highlight Application Security Challenges, eWeek, February 16, 2010
SANS Institute, MITRE release new top 25 dangerous coding errors list, SearchSecurity.com, February 16, 2010
Top 25 most dangerous programming errors, Help Net Security, February 16, 2010
Experts: Developers Responsible for Programming Problems, CIO, February 16, 2010
Security agencies release Top 25 programming errors,Government Computer News, February 16, 2010
25 ways to better secure software from cyber attacks, Scientific American, February 16, 2010
Is It Time For Software Liability?, InformationWeek blog, February 16, 2010
Top 25 programming errors for 2009 announced in Washington D.C., neowin.net, February 16, 2010
Top 25 most dangerous programming errors, net-security.org, February 16, 2010
Top 25 Most Dangerous Programming Errors Revealed, Information Week, February 16, 2010
Proposal Would Hold Software Developers Accountable For Security Bugs, DarkReading, February 16, 2010
Top 25 Programming Errors Highlight Application Security Challenges, eWeek, February 16, 2010
Software developers are to blame for most cyberattacks, say security experts, Emily Long, nextgov, February 16, 2010
Security Experts: Developers Responsible for Programming Problems, CSO Magazine, February 16, 2010
MITRE, List of 2010's Most Dangerous Programming Errors, TheServerSide.com, February 16, 2010
Top 25 Programming Errors: Should Software Developers be Liable?, Bankinfo Security, February 16, 2010
Is It Time For Software Liability?,Information Week, February 16, 2010
Group Proposes Suits Over Faulty Code, Gov Info Security, February 16, 2010
The top 25 most dangerous programming errors, Sunbelt Blog, February 16, 2010
Experts: Developers Responsible for Programming Problems, Computerworld/IDG Norway, February 16, 2010
HLRL: Common Security Vulnerabilities, HoffmanLabs.com blog, February 16, 2010
2010 SANS Top 25 Most Dangerous Programming Errors Released, cgisecurity.com, February 16, 2010
16 Feb 2010: Red Hat's Top 11 Most Serious Flaw Types for 2009, awe.com blog, February 16, 2010
CWE/SANS Top 25 Most Dangerous Programming Errors 2010, WebApp Focus Profile, TacticalWebAppSec blog, February 16, 2010
2010 CWE/SANS Top 25 Most Dangerous Programming Errors Released, The Falcon's View, February 16, 2010
Interesting Information Security Bits for 02/16/2010, Infosec Ramblings, February 16, 2010
Security agencies release Top 25 programming errors, Government Computer News, February 17, 2010
Software vendors should be legally liable for buggy code, CIO Magazine, February 17, 2010
SANS/CWE top 25 most dangerous programming errors, iTWire, February 17, 2010
Research Highlights Top 25 Programming Errors Cross-site scripting tops the list, Softpedia, February 17, 2010
Top 25 Programming Errors list updated, The H, February 17, 2010
Top 25 programming errors uncovered, Computer Business Review, February 17, 2010
List Of Top 25 Most Dangerous Programming Errors Published, ITProPortal, February 17, 2010
Top 25 coding errors – are your software suppliers secure?, ComputerWeekly.com, February 17, 2010
SANS Top 25 Most Dangerous Programming Errors, the same as very often..., infosecuritymagazine.com/blog, February 17, 2010
Experts reboot list of 25 most dangerous coding errors, The Register, February 17, 2010
Software vendors should be legally liable for buggy code, CIO Magazine, February 17, 2010
Programmers blamed for cyberattacks, Federal News Radio, February 17, 2010
Developers: The 25 Most Dangerous Programming Errors, Slashdot, February 17, 2010
Top 25 coding errors, are your software suppliers secure?, Computer Weekly, February 17, 2010
List Of Top 25 Most Dangerous Programming Errors Published, ITProPortal, February 17, 2010
Experts list dangerous coding errors, ITweb, February 17, 2010
2010 CWE/SANS Top 25 Most Dangerous Programming Errors, DevX.com, February 17, 2010
New group calls for holding vendors liable for buggy software, Homeland Security Newswire, February 17, 2010
Application security and Top 25 coding errors, Security Wire Weekly podcast, February 17, 2010
Research Highlights Top 25 Programming Errors, Cross-site scripting tops the list, Softpedia, February 17, 2010
2010 CWE/SANS Top 25 Most Dangerous Programming Errors Published, ditii.com, February 17, 2010
Use of hard-coded credentials, a dangerous programming error: CWE, ManageEngine.com blog, February 17, 2010
Top 25 Dangerous Programming Errors Updated, ThreatPost blog, February 17, 2010
Bug Free Software, It's The Law!,blog.utest.com, February 17, 2010
Top 25 Programming Errors list updated, h-online.com, February 17, 2010
I Repeat Myself When Under Stress, I Repeat Myself When Under Stress, Cigital.com, February 17, 2010
When will Vendors provide Risk Assessments of their products?, blog.kraasecurity.com, February 17, 2010
SANS/CWE top 25 most dangerous programming errors, iTWire, February 18, 2010
Security groups outline top 25 programming errors for 2010, infosecurity.com, February 18, 2010
Report Profiles Top Software Security Coding Errors, Application Development Trends, February 18, 2010
Report Profiles Top Software Security Coding Errors, Redmund Channel Partner Online, February 18, 2010
SANS Names Mistakes That Cause Vulnerability, InternetNews.com, February 18, 2010
New York State holds software developers accountable, infosecurity.com, February 18, 2010
SANS Names Mistakes That Cause Vulnerability, CodeGuru.com, February 18, 2010
Experts consolidate to make software companies liable for program flaws, Ecommerce Journal, February 18, 2010
Daily Dose - 25 Most Dangerous Programming Errors Updated, Javalobby, February 18, 2010
Report Profiles Top Software Security Coding Errors, Redmond Developer News, February 18, 2010
Security agencies release Top 25 programming errors, FCW.com, February 18, 2010
2010 CWE/SANS Top 25 Most Dangerous Programming Errors, DZone, February 18, 2010
Daily Dose, 25 Most Dangerous Programming Errors Updated, DZone, February 18, 2010
JavaRanch, CodeRanch.com, February 18, 2010
SANS Names Top 25 Programming Errors, CodeGuru.com, February 18, 2010
Thousands of Companies and Their Computers Hacked In Newly Discovered Coordinated Attack, IEEE Spectrum blog, February 18, 2010
Review of Top 25 document, jducoeur.livejournal.com, February 18, 2010
sans top 25 released, and thoughts on procurement contracts, terminal23.net, February 18, 2010
Software Glitches Will Take Down Your Company, blog.weblayers.com, February 18, 2010
Mitternachtshacking, Midnight Hacking, February 18, 2010
Top 25 Coding Errors, Geek News Central, February 19, 2010
application of Top 25 to control systems, digitalbond.com, February 19, 2010
2010 CWE/SANS Top 25 Most Dangerous Programming Errors Released, 12robots.com, February 22, 2010
On MeeGo, a Budding Geek and the 25 Most Dangerous Programming Errors, LinuxInsider, February 22, 2010
Top federal software security holes exposed, Federal News Radio, March 10, 2010
Die 25 gefahrlichsten Programmierfehler, Germany
Which of the Top 25 is the most dangerous?, France
Neuauflage der 25 schlimmsten Programmierfehler, Austria
Top 25 der Programmierfehler revisited, Germany
Maak softwarebedrijven verantwoordelijk voor fouten, Netherlands
Windows Administrator Blog, Thailand
CWE/SANS Top 25 Most Dangerous Programming Errors 2010, Russia
Nov seznam najpogostej.ih napak programerjev, Slovenia
prog.hu, Hungary
Top 25: cele mai periculoase erori de programare, Romania
las 25 fallas de desarrollo de aplicaciones, Spanish
Korean IDG, Korea
25 vaarallisinta koodausmokaa, Finland
Die 25 gefahrlichsten Programmierfehler, Germany
itviikko.fi, Finland
Ecco la lista dei 25 errori di programmazione piu pericolosi, Italy
root.cz, Czech Republic
Os 25 erros de programacao mais perigosos, Brazil
Descubierta y corregida una vulnerabilidad de seguridad en Google Buzz, Spain
Lista traz os 25 piores erros de programacao, Brazil
25 najniebezpieczniejszych bledow programistycznych, Poland
25-najgrozniejszych-bledow-programisty, Poland
Petindvajset najnevarnejsih programerskih napak, Slovak Republic
IT News, Slovak Republic
Les 25 erreurs de programmation les plus courantes, France
cnblogs, China
journal.mycom.co.jp/news, Japan
Japanese Slashdot, Japan
le Top 25 des erreurs de programmation, France
WNZ: Top 25 kodefejl du ikke skal lave, Denmark
op 25 gevaarlijkste programmeerfouten, Netherlands
Datubazes, Latvian translations, Latvia
dimka.lv, Latvia
Los 25 errores de programacion mas comunes, Spain
nixu.fi, Finland

Federal News Radio interviewed CWE/CAPEC Program Manager Robert A. Martin on March 10, 2010 about CWE and the Top 25 Most Dangerous Programming Errors. In the interview, entitled "Top federal software security holes exposed," Martin states: "The big problem is that traditional education in our country and across the world for software developers, for testers, for program managers has pretty much ignored this area. We put them into our software because we didn't know how they happened. So the CWE, the full Common Weakness Enumeration and then this prioritized part of the CWE, which we're calling the Top 25 Most Dangerous Programming Errors is basically an education tool at the first level. These are issues you should be aware of. You should ask your developers "have you been trained to recognize these if someone puts them in accidentally? Do you know how to program around these so that you don't introduce them?" You test people. "Do you know how to try to misuse and abuse your system?" So that, if there any of these latently in your software, you can find them before the user has it in his hands." A summary of the interview was published on the Federal News Radio Web site.

Federal News Radio interviewed Joe Jarzombek, director for software assurance in the National Cyber Security Division of the Department of Homeland Security, on March 3, 2010 about software assurance. In the interview, entitled, "Software assurance affects more than just programmers," Jarzombek "explains why the CWE benefits cyber security -- and why this impacts more than programmers." A summary of the interview was published on the Federal News Radio Web site.

Coverity, Inc. declared that its static analysis assessment and remediation tools, Coverity Prevent and Coverity Integrity Center, are now CWE-Compatible. For additional information about this and other compatible products, visit the CWE Compatibility and Effectiveness section.

MITRE hosted a Making Security Measurable booth at RSA 2010 at the Moscone Center in San Francisco, California, USA, on March 1-5, 2010. Attendees learned how information security data standards facilitate both effective security process coordination and the use of automation to assess, manage, and improve the security posture of enterprise security information infrastructures.

The 2010 version of the SANS/MITRE Top 25 Most Dangerous Programming Errors that can lead to serious software vulnerabilities is now available on the CWE and SANS Web sites. Based primarily on the CWE List and leveraging the SANS Top 20 attack vectors, the main goal of the Top 25 list is to stop vulnerabilities at the source by educating programmers on how to eliminate all-too-common mistakes before software is even shipped. The list is a tool for education and awareness that will help programmers to prevent the kinds of vulnerabilities that plague the software industry. Software consumers may also use the list to help them to ask for more secure software, and software managers and CIOs can use the Top 25 as a measuring stick of progress in their efforts to secure their software.

Updates for the 2010 version include substantial improvements to the 2009 list. The structure of the list has been modified to distinguish mitigations and general secure programming principles from more concrete weaknesses. This year's Top 25 entries are prioritized using inputs from over 20 different organizations, who evaluated each weakness based on prevalence and importance. The 2010 version introduces focus profiles that allow developers and other users to select the parts of the Top 25 that are most relevant to their concerns. The 2010 version also adds a small set of the most effective "Monster Mitigations," which help developers to reduce or eliminate entire groups of the Top 25 weaknesses, as well as many of the other 800 weaknesses that are documented in the Common Weakness Enumeration (CWE). Finally, many high-level weaknesses from the 2009 version have been replaced with lower-level variants that are more actionable.

Future updates will be noted here and on the CWE Researcher email discussion list. Please send any comments or concerns to cwe@mitre.org.

Changes for the new release include: (1) creation of 11 new entries, primarily in support of the 2010 CWE/SANS Top 25; (2) significant quality improvements to approximately 20 entries that are part of the 2010 Top 25, or "On the Cusp";" (3) additions or improvements to demonstrative examples for 33 entries; (4) additions or improvements to potential mitigations for 43 entries; (5) additions or improvements in references for 54 entries; (6) detection methods for 33 entries; (7) mappings to the WASC threat classification; (8) updated relationships for 77 entries; and (9) major changes to 162 entries.

The schema definition was updated from version 4.3 to version 4.4, to reflect some additional elements to support mitigations and detection methods. A summary is available here.

PDF documents have been updated to display graphs of views such as the Research View (CWE-1000) and the Development View (CWE-699), and a "Printable CWE" document lists all of the entries in CWE.

Future updates will be noted here and on the CWE Researcher email discussion list. Please send any comments or concerns to cwe@mitre.org.

MITRE is scheduled to host a Making Security Measurable booth at RSA 2010 at the Moscone Center in San Francisco, California, USA, on March 1-5, 2010. Please stop by Booth 2617 and say hello!

MITRE to Present Making Security Measurable Briefing at DHS/DoD/NIST SwA Forum, March 9-12

MAEC Team Member and CWE/CAPEC Program Manager Robert A. Martin is scheduled to present a briefing about Making Security Measurable to the DHS/DoD/NIST SwA Forum on March 9-12, 2010 at MITRE Corporation in McLean, Virginia, USA.

MITRE Hosts Making Security Measurable Booth at the 2010 Information Assurance Symposium

MITRE hosted a Making Security Measurable booth at the 2010 Information Assurance Symposium in Nashville, Tennessee, USA, on February 2-5, 2010. In addition, CWE/CAPEC Co-Founder and Architect Sean Barnum participated on a SwA Panel Discussion. The symposium is designed to bring together industry, government, and military information assurance professionals with "the latest Information Assurance (IA) products and solutions available to secure voice and data networks."

MITRE Announces Initial "Making Security Measurable" Calendar of Events for 2010

MITRE has announced its initial Making Security Measurable calendar of events for 2010. Details regarding MITRE's scheduled participation at these events are noted on the CWE Calendar page. Each listing includes the event name with URL, date of the event, location, and a description of our activity at the event.

"Security Automation: A New Approach to Managing and Protecting Critical Information" is the main topic of the Winter 2010 issue of the Department of Defense's (DoD) Information Assurance Technology Analysis Center's (IATAC) IAnewsletter.

According to the newsletter, a security automation strategy will enable automation of "many security and configuration management, compliance, and network defense functions and give our [DoD] system administrators and network defenders a chance to succeed." Specific articles topics include: An Introduction to Security Automation; Security Automation: A New Approach Managing and Protecting Critical Information; Security Content Automation Protocol; Secure Configuration Management (SCM); DoD Activities Underway to Mature SCAP Standards; Why Industry Needs Federal Government Leadership to Gain the Benefits of Security Automation; and Practicing Standards-Based Security Assessment and Management.

Common Weakness Enumeration

News & Events - 2010 Archive News & Events - 2010 Archive

News & Events - 2010 Archive
News & Events - 2010 Archive