Common Weakness Enumeration_logo.svg){kind=logo} The Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities. It is sustained by a community project with the goals of understanding flaws in software and hardware and creating automated tools that can be used to identify, fix, and prevent those flaws.[1] The project is sponsored by the office of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), which is operated by The MITRE Corporation,[2] with support from US-CERT and the National Cyber Security Division of the U.S. Department of Homeland Security.[3][4] The first release of the list and associated classification taxonomy was in 2006.[5] Version 4.15 of the CWE standard was released in July 2024.[6] CWE has over 600 categories, including classes for buffer overflows, path/directory tree traversal errors, race conditions, cross-site scripting, hard-coded passwords, and insecure random numbers.[7] Examples
CWE compatibilityCommon Weakness Enumeration (CWE) Compatibility program allows a service or a product to be reviewed and registered as officially "CWE-Compatible" and "CWE-Effective". The program assists organizations in selecting the right software tools and learning about possible weaknesses and their possible impact. In order to obtain CWE Compatible status a product or a service must meet 4 out of 6 requirements, shown below:
There are 56 organizations as of September 2019 that develop and maintain products and services that achieved CWE Compatible status.[9] Research, critiques, and new developmentsSome researchers think that ambiguities in CWE can be avoided or reduced.[10] As of 4/16/2024, the CWE Compatibility Program has been discontinued.[11]
See also
References
External links
|
Portal di Ensiklopedia Dunia
