After the voting, the CWE team and SIG members collectively reviewed the findings and applied a scoring method where the buckets were assigned weights of +2, +1, 0, -1, and -2, respectively. For each CWE entry, these weights were multiplied against the percentage of votes in each bucket, with the percentage expressed as a value between 0 and 1. The highest possible score was 2.0 (with 100% of all votes for “Strongly Support”). The entry with the highest score had a score of 1.42. This resulted in a ranked order of the 31 previously selected hardware CWEs with a clear delineation in score after the highest 12 and the highest 17 entries. The highest 12 entries had scores from 1.03 to 1.42, and the next 5 entries ranges from 0.91 to 0.97. The next highest score was 0.80. These entries became the 2021 CWE Most Important Hardware Weaknesses List and the Hardware Weaknesses on the Cusp (see above and below). While our methodology came up with a ranking for these 12(+5) entries, the HW CWE team and the SIG believe that it is impractical to think of the list as a hierarchical, ordered set in terms of importance. The entries should be thought of as a set of mostly equal hardware weakness concerns based on our methodology.
With these criteria, future versions of the CWE Most Important Hardware Weaknesses will evolve to cover different weaknesses. Our goal is to provide the most useful list possible for the community. Limitations of our methodology are articulated below.
Weaknesses on the Cusp
In a similar way to the CWE Top 25 Most Dangerous Software Weaknesses, the CWE team feels it is important to share these five additional hardware weaknesses that were supported by the Hardware CWE SIG yet ultimately scored just outside of the final 2021 CWE Most Important Hardware Weaknesses list.