SANS and MITRE releases 2011 Top 25 Most Dangerous Software Errors.

1. The CWE/SANS Top 25 Most Dangerous Software
Errors Announced… Along With a New Set of Standards
In a new and revised format, SANS along with MITRE has published the latest list of the highest risk software security
vulnerabilities; the revision to the list is based on the CWE, CWSS and CWRAF security standards. The announcement
leverages and highlights these new standards and collaboration efforts among the security community (including
corporate, non-profit and government entities). As this announcement publicizes some new standards efforts that many
of us will undoubtedly hear a lot about in the coming months, I thought it made sense to leverage the CWE/SANS Top 25
Most Dangerous Software Errors list to put these other standards in context.
First, let’s summarize the standards.
CVE List
Before diving into these other standards, it’s perhaps best to start with the CVE list. The Common Vulnerabilities and
Exposures (CVE) List was started by the MITRE Corporation, a non-profit think tank, in 1999. The CVE List is free
(http://cve.mitre.org) and publicly available and creates a standardized set of identifiers for common vulnerabilities and
exposures. The List provides common identifiers so automated tools, such as vulnerability scanners and patch
management systems can exchange vulnerability data using unique identifiers. You can think of the CVE List as the
master set of security vulnerabilities. CVE numbers have become the interoperability standard amongst security vendors.
CWE List
Where the CWE list is a complete list of individual vulnerabilities, the Common Weakness Enumeration (CWE) provides a
categorical view describing classifications of risk. The CWE List can be thought of as a taxonomy of vulnerability
categories such that unique vulnerabilities in various software systems can be categorized. As such there are many more
unique software vulnerabilities than categories that classify them. For example, the CVE List has almost 50,000 entries
while the CWE List has only 870.
Common Weakness Scoring System (CWSS)
The CWSS provides a consistent method by which vulnerabilities can be scored. This would potentially address, for
example, (at least in theory) a big problem with automated vulnerability scanners: they tend to create reams of output
without any context as to what is important in a given environment. Given that every environment is unique, its difficult
for automated software processes to programmatically determine the relevance of a particular instance of a vulnerability.
The CWSS would provide a repeatable approach to determine the relevance of risk as well as provide a way to
quantifiably measure unaddressed vulnerabilities.
Common Weakness Risk Analysis Framework (CWRAF)
The CWRAF provides a method for organizations to customize the application of the CWSS to account for their particular
business and technology environments. So as the CWSS provides a repeatable process to score vulnerabilities, the
CWRAF provides a repeatable way for organizations to apply the CWSS to their own unique business environments
So what’s all this got to do with the CWE/SANS Top 25?
Well, perhaps nothing. The list itself is a prioritized list of the top 25 security weaknesses in software as a function of
prevalence, probability of exploitation, and importance. The list is a great resource for any IT or security professional that
wants to focus their efforts on the most important issues. Considering that every organization has security risk (an often

2. plenty of it) and IT resources are limited, keeping focused on the important issues is incredibly important in a structured
risk management program. But what about CVE, CWE, CWSS, CWRAF….? So it’s not the CWE/SANS Top 25 list that has
to do with these standards, its more that this alphabet soup of standards is how the Top 25 list was created. SANS
worked with MITRE along with security experts worldwide to compile the list. While experts in the field often work with
individual CVE identifiers, the TOP 25 list is based on CWE categories. The list is prioritized based on the scores that were
calculated based on the CWSS. Specific industries and organizations could customize the scoring using the CWRAF.
Below is the current CWE/SANS Top 25 Most Dangerous Software Errors list. Notice how CWE categories are referenced
as opposed to CVE numbers or ad hoc categories, and the CWSS score is used for prioritization.
1. 93.8 CWE-89 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
2. 83.3 CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
3. 79.0 CWE-120 Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’)
4. 77.7 CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
5. 76.9 CWE-306 Missing Authentication for Critical Function
6. 76.8 CWE-862 Missing Authorization
7. 75.0 CWE-798 Use of Hard-coded Credentials
8. 75.0 CWE-311 Missing Encryption of Sensitive Data
9. 74.0 CWE-434 Unrestricted Upload of File with Dangerous Type
10. 73.8 CWE-807 Reliance on Untrusted Inputs in a Security Decision
11. 73.1 CWE-250 Execution with Unnecessary Privileges
12. 70.1 CWE-352 Cross-Site Request Forgery (CSRF)
13. 69.3 CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
14. 68.5 CWE-494 Download of Code Without Integrity Check
15. 67.8 CWE-863 Incorrect Authorization
16. 66.0 CWE-829 Inclusion of Functionality from Untrusted Control Sphere
17. 65.5 CWE-732 Incorrect Permission Assignment for Critical Resource
18. 64.6 CWE-676 Use of Potentially Dangerous Function
19. 64.1 CWE-327 Use of a Broken or Risky Cryptographic Algorithm
20. 62.4 CWE-131 Incorrect Calculation of Buffer Size
21. 61.5 CWE-307 Improper Restriction of Excessive Authentication Attempts
22. 61.1 CWE-601 URL Redirection to Untrusted Site (‘Open Redirect’)
23. 61.0 CWE-134 Uncontrolled Format String
24. 60.3 CWE-190 Integer Overflow or Wraparound
25. 59.9 CWE-759 Use of a One-Way Hash without a Salt
Overall, we applaud this effort; both the list and the accompanying standards. Any effort that prioritizes risk and provides
a systematic and repeatable process to do so is a big boost for enterprise security. In the short term, the value of these
methodologies will surely be a function of the capabilities and dedication of those that use them (the garbage in –
garbage out rule will still apply), but any methodology that adds some structure to security risk analysis is a worthy effort.
WEB PHONE EMAIL
WWW.REDSPIN.COM 800-721-9177 INFO@REDSPIN.COM