801
analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Binary / Bytecode simple extractor - strings, ELF readers, etc.
Effectiveness = SOAR Partial
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Web Application Scanner Web Services Scanner Database Scanners
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Man-in-the-middle attack tool Cost effective for partial coverage: Framework-based Fuzzer
Automated Monitored Execution Monitored Virtual Environment - run potentially malicious code
in sandbox / wrapper / virtual machine, see if it does anything suspicious
Effectiveness = High
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused
Manual Spotcheck - Focused manual analysis of source
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Effectiveness = High
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Configuration Checker
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Strategy = Libraries or Frameworks
When there is a need to store or transmit sensitive data, use strong, up-to-date cryptographic
algorithms to encrypt that data. Select a well-vetted algorithm that is currently considered to be
strong by experts in the field, and use well-tested implementations. As with all cryptographic
mechanisms, the source code should be available for analysis. For example, US government
systems require FIPS 140-2 certification [REF-1192]. Do not develop custom or private
CWE Version 4.14
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-327: Use of a Broken or Risky Cryptographic Algorithm