2510
Category-1373: ICS Engineering (Construction/Deployment): Trust Model
Problems
Category ID : 1373
Summary
Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF
"Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made
about the user during the design or construction phase may result in vulnerabilities after the system
is installed if the user operates it using a different security approach or process than what was
designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations
from the report, as well as suggestions by the CWE team. These relationships are likely to change
in future CWE versions.
Membership
Nature Type ID Name Page
MemberOf 1362 ICS Engineering (Constructions/Deployment) 1358 2499
HasMember 269 Improper Privilege Management 1358 646
HasMember 349 Acceptance of Extraneous Untrusted Data With Trusted
Data
1358 861
HasMember 807 Reliance on Untrusted Inputs in a Security Decision 1358 1714
Notes
Relationship
Relationships in this category are not authoritative and subject to change. See Maintenance
notes.
Maintenance
This category was created in CWE 4.7 to facilitate and illuminate discussion about weaknesses
in ICS with [REF-1248] as a starting point. After the release of CWE 4.9 in October 2022, this
has been under active review by members of the "Boosting CWE" subgroup of the CWE-CAPEC
ICS/OT Special Interest Group (SIG). Relationships are still subject to change. In addition, there
may be some issues in [REF-1248] that are outside of the current scope of CWE, which will
require consultation with many CWE stakeholders to resolve.
References
[REF-1248]Securing Energy Infrastructure Executive Task Force (SEI ETF). "Categories of
Security Vulnerabilities in ICS". 2022 March 9. < https://inl.gov/wp-content/uploads/2022/03/SEIETF-
NCSV-TPT-Categories-of-Security-Vulnerabilities-ICS-v1_03-09-22.pdf >.
Category-1374: ICS Engineering (Construction/Deployment): Maker Breaker
Blindness
Category ID : 1374
Summary
Weaknesses in this category are related to the "Maker Breaker Blindness" category from the SEI
ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Lack of awareness
of deliberate attack techniques by people (vs failure modes from natural causes like weather
or metal fatigue) may lead to insufficient security controls being built into ICS systems." Note:
members of this category include "Nearest IT Neighbor" recommendations from the report, as well
as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CWE Version 4.14
CWE-1375: ICS Engineering (Construction/Deployment): Gaps in Details/Data
CWE-1375: ICS Engineering (Construction/Deployment): Gaps in Details/Data