A decade of reoccurring software weaknesses

Gueye, Assane; Cardoso Galhardo, Carlos; Bojanova, Irena; Mell, Peter

doi:https://doi.org/10.1109/MSEC.2021.3082757

Journal Article

A decade of reoccurring software weaknesses

Documentation Topics

Published: June 24, 2021
Citation: IEEE Security & Privacy vol. 19, no. 6, (November-December 2021) pp. 74-82

Author(s)

Assane Gueye (CMU Africa), Carlos Cardoso Galhardo (Inmetro), Irena Bojanova (NIST), Peter Mell (NIST)

Abstract

The Common Weakness Enumeration (CWE) community publishes an aggregate metric to calculate the `Most Dangerous Software Errors.' However, the used equation highly biases frequency and almost ignores exploitability and impact. We provide a metric to mitigate this bias and discuss the most significant software weaknesses over the last ten years.

Keywords

security; software errors; weaknesses, metrics

Control Families

None selected

Documentation

Publication:
Journal Article (DOI)

Supplemental Material:
Preprint (pdf)

Document History:
06/24/21: Journal Article (Final)

Topics

Security and Privacy
security measurement

Technologies
software & firmware