2424
Category-1009: Audit
Category ID : 1009
Summary
Weaknesses in this category are related to the design and architecture of audit-based components
of the system. Frequently these deal with logging user activities in order to identify attackers and
modifications to the system. The weaknesses in this category could lead to a degradation of the
quality of the audit capability if they are not addressed when designing or implementing a secure
architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 117 Improper Output Neutralization for Logs 1008 288
HasMember 223 Omission of Security-relevant Information 1008 559
HasMember 224 Obscured Security-relevant Information by Alternate
Name
1008 561
HasMember 532 Insertion of Sensitive Information into Log File 1008 1241
HasMember 778 Insufficient Logging 1008 1638
HasMember 779 Logging of Excessive Data 1008 1642
References
[REF-9]Santos, J. C. S., Tarrit, K. and Mirakhorli, M.. "A Catalog of Security Architecture
Weaknesses.". 2017 IEEE International Conference on Software Architecture (ICSA). 2017. <
https://design.se.rit.edu/papers/cawe-paper.pdf >.
[REF-10]Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M. and Sejfia, A.. "Understanding
Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of
Chromium, PHP and Thunderbird.". 2017 IEEE International Conference on Software Architecture
(ICSA). 2017. < https://design.se.rit.edu/papers/TacticalVulnerabilities.pdf >.
Category-1010: Authenticate Actors
Category ID : 1010
Summary
Weaknesses in this category are related to the design and architecture of authentication
components of the system. Frequently these deal with verifying the entity is indeed who it claims to
be. The weaknesses in this category could lead to a degradation of the quality of authentication if
they are not addressed when designing or implementing a secure architecture.
Membership
Nature Type ID Name Page
MemberOf 1008 Architectural Concepts 1008 2577
HasMember 258 Empty Password in Configuration File 1008 621
HasMember 259 Use of Hard-coded Password 1008 623
HasMember 262 Not Using Password Aging 1008 633
HasMember 263 Password Aging with Long Expiration 1008 636
HasMember 287 Improper Authentication 1008 692
HasMember 288 Authentication Bypass Using an Alternate Path or
Channel
1008 700
CWE Version 4.14
CWE-1011: Authorize Actors
CWE-1011: Authorize Actors