2578
Software Developers
Architects that are part of a software development team may find this view useful as the
weaknesses are organized by known security tactics, aiding the arcitect in embedding security
throughout the design process instead of discovering weaknesses after the software has been
built.
Educators
Educators may use this view as reference material when discussing security by design or
architectural weaknesses, and the types of mistakes that can be made.
Membership
Nature Type ID Name Page
HasMember 1009 Audit 2424
HasMember 1010 Authenticate Actors 2424
HasMember 1011 Authorize Actors 2425
HasMember 1012 Cross Cutting 2427
HasMember 1013 Encrypt Data 2428
HasMember 1014 Identify Actors 2429
HasMember 1015 Limit Access 2430
HasMember 1016 Limit Exposure 2431
HasMember 1017 Lock Computer 2431
HasMember 1018 Manage User Sessions 2432
HasMember 1019 Validate Inputs 2433
HasMember 1020 Verify Message Integrity 2434
Notes
Other
The top level categories in this view represent the individual tactics that are part of a secureby-
design approach to software development. The weaknesses that are members of each
category contain information about how each is introduced relative to the software's architecture.
Three different modes of introduction are used: Omission - caused by missing a security tactic
when it is necessary. Commission - refers to incorrect choice of tactics which could result
in undesirable consequences. Realization - appropriate security tactics are adopted but are
incorrectly implemented.
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Metrics
CWEs in this view Total CWEs
Weaknesses 223 out of 938
Categories 12 out of 374
Views 0 out of 50
Total 235 out of 1362
View-1026: Weaknesses in OWASP Top Ten (2017)
CWE Version 4.14
CWE-1026: Weaknesses in OWASP Top Ten (2017)
CWE-1026: Weaknesses in OWASP Top Ten (2017)