“root-cause” database, as Viega calls it, strives to provide a
lexicon for the underlying problems that form the basis for the
many known security defects. As a result, not all of the issues in
this taxonomy are security problems. Furthermore, the “rootcause” database allows the same problem to be classified