1443
Enforcing complex and difficult-to-remember passwords that need to be frequently changed for
access to trivial resources, e.g., to use a black-and-white printer. Complex password requirements
can also cause users to store the passwords in an unsafe manner so they don't have to remember
them, such as using a sticky note or saving them in an unencrypted file.
Example 3:
Some CAPTCHA utilities produce images that are too difficult for a human to read, causing user
frustration.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 995 SFP Secondary Cluster: Feature 888 2418
MemberOf 1379 ICS Operations (& Maintenance): Human factors in ICS
environments
1358 2514
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Notes
Other
This weakness covers many security measures causing user inconvenience, requiring effort or
causing frustration, that are disproportionate to the risks or value of the protected assets, or that
are perceived to be ineffective.
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
facilitate discussion and review by the broader ICS/OT community, and they are likely to change
in future CWE versions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 2-1 Req 4.3.3.6
ISA/IEC 62443 Part 4-1 Req SD-4
References
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
[REF-539]Sean Barnum and Michael Gegick. "Psychological Acceptability". 2005 September 5. <
https://web.archive.org/web/20221104163022/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/psychological-acceptability >.2023-04-07.
[REF-540]J. D. Tygar and Alma Whitten. "Usability of Security: A Case Study". SCS Technical
Report Collection, CMU-CS-98-155. 1998 December 5. < http://reports-archive.adm.cs.cmu.edu/
anon/1998/CMU-CS-98-155.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE Version 4.14
CWE-656: Reliance on Security Through Obscurity
CWE-656: Reliance on Security Through Obscurity