Identifying the Architectural Roots of Vulnerabilities (Podcast Series)
Abstract
When we look at cybersecurity engineering, most folks think of vulnerabilities. Typically, those are found in the code, and those are later in the lifecycle. But, there is a major block of design weaknesses that are implemented in the system and are very hard to change later on. In terms of overall problems, design weaknesses represent probably about 40 percent of what we have identified as general weaknesses that you are dealing with, with code and design. However, when we look at what experts have identified as the top 25 problems, design weaknesses represent over 75 percent of those. This is an important area. It is a difficult area because the way that we typically think about security, we think of it as completed systems and analyzing its overall security. Here we have to think about what is the system doing? How are we building itso that it does not have those problems when we ultimately field it?
Document Details
- Document Type
- Technical Report
- Publication Date
- Jan 01, 2021
- Accession Number
- AD1147148
Entities
People
- Carol C. Woody
- Rick Kazman
Organizations
- Carnegie Mellon University