1442
[REF-535]Sean Barnum and Michael Gegick. "Separation of Privilege". 2005 December 6. <
https://web.archive.org/web/20220126060047/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/separation-of-privilege >.2023-04-07.
CWE-655: Insufficient Psychological Acceptability
Weakness ID : 655
Structure : Simple
Abstraction : Class
Description
The product has a protection mechanism that is too difficult or inconvenient to use, encouraging
non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 693 Protection Mechanism Failure 1520
ChildOf 657 Violation of Secure Design Principles 1446
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
By bypassing the security mechanism, a user might leave
the system in a less secure state than intended by the
administrator, making it more susceptible to compromise.
Potential Mitigations
Phase: Testing
Where possible, perform human factors and usability studies to identify where your product's
security mechanisms are difficult to use, and why.
Phase: Architecture and Design
Make the security mechanism as seamless as possible, while also providing the user with
sufficient details when a security decision produces unexpected results.
Demonstrative Examples
Example 1:
In "Usability of Security: A Case Study" [REF-540], the authors consider human factors in a
cryptography product. Some of the weakness relevant discoveries of this case study were: users
accidentally leaked sensitive information, could not figure out how to perform some tasks, thought
they were enabling a security option when they were not, and made improper trust decisions.
Example 2:
CWE Version 4.14
CWE-655: Insufficient Psychological Acceptability
CWE-655: Insufficient Psychological Acceptability