666
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
Detection Methods
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Inter-application Flow Analysis
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that
audit mechanisms work, ensure host configuration meets certain predefined criteria Web
Application Scanner Web Services Scanner Database Scanners
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective: Host
Application Interface Scanner Cost effective for partial coverage: Fuzz Tester Framework-based
Fuzzer Automated Monitored Execution Forced Path Execution
Effectiveness = High
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused
Manual Spotcheck - Focused manual analysis of source
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Context-configured Source Code Weakness Analyzer
Effectiveness = SOAR Partial
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Configuration Checker
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
CWE Version 4.14
CWE-276: Incorrect Default Permissions
CWE-276: Incorrect Default Permissions